Security Vulnerabilities - CVEs Published In 2021
Cross Site Request Forgery (CSRF) vulnerability in FlatPress 1.1 via the DeleteFile function in flat/admin.php.
CVSS Score
8.8
EPSS Score
0.008
Published
2021-07-30
Cross Site Scripting (XSS) vulnerability in NukeViet cms 4.4.0 via the editor in the News module.
CVSS Score
6.1
EPSS Score
0.006
Published
2021-07-30
Replicated Classic 2.x versions have an improperly secured API that exposes sensitive data from the Replicated Admin Console configuration. An attacker with network access to the Admin Console port (8800) on the Replicated Classic server could retrieve the TLS Keypair (Cert and Key) used to configure the Admin Console.
CVSS Score
7.5
EPSS Score
0.013
Published
2021-07-30
The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter.
CVSS Score
8.1
EPSS Score
0.032
Published
2021-07-30
A logic bug in system monitoring driver of Acronis Agent after 12.5.21540 and before 12.5.23094 allowed to bypass Windows memory protection and access sensitive data.
CVSS Score
7.5
EPSS Score
0.011
Published
2021-07-30
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote user to gain elevated privileges on the system. IBM X-Force ID: 201300.
CVSS Score
5.0
EPSS Score
0.011
Published
2021-07-30
IBM Partner Engagement Manager 2.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 203091.
CVSS Score
9.8
EPSS Score
0.029
Published
2021-07-30
Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.
CVSS Score
4.8
EPSS Score
0.008
Published
2021-07-29
CVE-2021-36741
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.
Known exploited
CVSS Score
8.8
EPSS Score
0.05
Published
2021-07-29
CVE-2021-36742
A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Known exploited
CVSS Score
7.8
EPSS Score
0.015
Published
2021-07-29