Security Vulnerabilities - CVEs Published In 2021
In FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c has missing input checks for a FILECONTENTS_SIZE File Contents Request PDU.
CVSS Score
9.8
EPSS Score
0.014
Published
2021-07-30
In FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c has missing input checks for a FILECONTENTS_RANGE File Contents Request PDU.
CVSS Score
9.8
EPSS Score
0.015
Published
2021-07-30
Telegram Web K Alpha 0.6.1 allows XSS via a document name.
CVSS Score
6.1
EPSS Score
0.006
Published
2021-07-30
An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.
CVSS Score
5.5
EPSS Score
0.007
Published
2021-07-30
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.
CVSS Score
7.5
EPSS Score
0.023
Published
2021-07-30
A SQL Injection vulnerability in Sourcecodester Basic Shopping Cart 1.0 allows a remote attacker to Bypass Authentication and become Admin.
CVSS Score
9.8
EPSS Score
0.028
Published
2021-07-30
A SQL INJECTION vulnerability in Sourcecodester Simple Food Website 1.0 allows a remote attacker to Bypass Authentication and become Admin.
CVSS Score
9.8
EPSS Score
0.029
Published
2021-07-30
A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 and 4.3 could allow authenticated users to execute commands with elevated privileges.
CVSS Score
8.8
EPSS Score
0.01
Published
2021-07-30
Online Pet Shop We App 1.0 is vulnerable to Union SQL Injection in products.php (aka p=products) via the c or s parameter.
CVSS Score
9.8
EPSS Score
0.025
Published
2021-07-30
An issue was discovered in LemonLDAP::NG before 2.0.12. Session cache corruption can lead to authorization bypass or spoofing. By running a loop that makes many authentication attempts, an attacker might alternately be authenticated as one of two different users.
CVSS Score
8.8
EPSS Score
0.018
Published
2021-07-30