Commits 10/10/2021

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

Entry

Field

Commit Conf

Approve Conf

◂ Previous Overview Next ▸

ID	User	Entry	Field	Change	Remarks	Moderated	Reason	C
11696809	VulD...	184135	price_0day	$0-$5k	see exploit price documentation	10/10/2021	accepted	90
11696808	VulD...	184135	cvss3_meta_tempscore	7.4	see CVSS documentation	10/10/2021	accepted	90
11696807	VulD...	184135	cvss3_meta_basescore	7.5	see CVSS documentation	10/10/2021	accepted	90
11696806	VulD...	184135	cvss3_vuldb_tempscore	6.0	see CVSS documentation	10/10/2021	accepted	90
11696805	VulD...	184135	cvss3_vuldb_basescore	6.3	see CVSS documentation	10/10/2021	accepted	90
11696804	VulD...	184135	cvss2_vuldb_tempscore	6.5	see CVSS documentation	10/10/2021	accepted	90
11696803	VulD...	184135	cvss2_vuldb_basescore	7.5	see CVSS documentation	10/10/2021	accepted	90
11696802	VulD...	184135	cvss3_cna_basescore	8.8	see CVSS documentation	10/10/2021	accepted	90
11696801	VulD...	184135	cvss3_vuldb_e	X	derived from historical data	10/10/2021	accepted	80
11696800	VulD...	184135	cvss2_vuldb_e	ND	derived from historical data	10/10/2021	accepted	80
11696799	VulD...	184135	cvss2_vuldb_rl	OF	derived from vuldb v3 vector	10/10/2021	accepted	80
11696798	VulD...	184135	cvss2_vuldb_rc	C	derived from vuldb v3 vector	10/10/2021	accepted	80
11696797	VulD...	184135	cvss2_vuldb_ai	P	derived from vuldb v3 vector	10/10/2021	accepted	80
11696796	VulD...	184135	cvss2_vuldb_ii	P	derived from vuldb v3 vector	10/10/2021	accepted	80
11696795	VulD...	184135	cvss2_vuldb_ci	P	derived from vuldb v3 vector	10/10/2021	accepted	80
11696794	VulD...	184135	cvss2_vuldb_au	N	derived from vuldb v3 vector	10/10/2021	accepted	80
11696793	VulD...	184135	cvss2_vuldb_ac	L	derived from vuldb v3 vector	10/10/2021	accepted	80
11696792	VulD...	184135	cvss2_vuldb_av	N	derived from vuldb v3 vector	10/10/2021	accepted	80
11696791	VulD...	184135	type	Content Management System		10/10/2021	accepted	90
11696790	VulD...	184135	date	1633816800 (10/10/2021)		10/10/2021	accepted	90
11696789	VulD...	184135	cve_cna	WhiteSource	mitre.org	10/10/2021	accepted	90
11696788	VulD...	184135	cve_assigned	1611270000	mitre.org	10/10/2021	accepted	90
11696787	VulD...	184135	cve	CVE-2021-25966	mitre.org	10/10/2021	accepted	90
11696786	VulD...	184135	patch_url	https://github.com/OrchardCMS/OrchardCore/blob/v1.0.0/src/OrchardCore.Modules/OrchardCore.Users/Controllers/ResetPasswordController.cs#L123	github.com	10/10/2021	accepted	90
11696785	VulD...	184135	name	Patch		10/10/2021	accepted	90
11696784	VulD...	184135	url	https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25966	whitesourcesoftware.com	10/10/2021	accepted	90
11696783	VulD...	184135	cvss3_cna_a	H	see CVSS documentation	10/10/2021	accepted	90
11696782	VulD...	184135	cvss3_cna_i	H	see CVSS documentation	10/10/2021	accepted	90
11696781	VulD...	184135	cvss3_cna_c	H	see CVSS documentation	10/10/2021	accepted	90
11696780	VulD...	184135	cvss3_cna_s	U	see CVSS documentation	10/10/2021	accepted	90
11696779	VulD...	184135	cvss3_cna_ui	R	see CVSS documentation	10/10/2021	accepted	90
11696778	VulD...	184135	cvss3_cna_pr	N	see CVSS documentation	10/10/2021	accepted	90
11696777	VulD...	184135	cvss3_cna_ac	L	see CVSS documentation	10/10/2021	accepted	90
11696776	VulD...	184135	cvss3_cna_av	N	see CVSS documentation	10/10/2021	accepted	90
11696775	VulD...	184135	cvss3_vuldb_rc	C	see CVSS documentation	10/10/2021	accepted	90
11696774	VulD...	184135	cvss3_vuldb_rl	O	see CVSS documentation	10/10/2021	accepted	90
11696773	VulD...	184135	cvss3_vuldb_a	L	see CVSS documentation	10/10/2021	accepted	90
11696772	VulD...	184135	cvss3_vuldb_i	L	see CVSS documentation	10/10/2021	accepted	90
11696771	VulD...	184135	cvss3_vuldb_c	L	see CVSS documentation	10/10/2021	accepted	90
11696770	VulD...	184135	cvss3_vuldb_s	U	see CVSS documentation	10/10/2021	accepted	90
11696769	VulD...	184135	cvss3_vuldb_ui	R	see CVSS documentation	10/10/2021	accepted	90
11696768	VulD...	184135	cvss3_vuldb_pr	N	see CVSS documentation	10/10/2021	accepted	90
11696767	VulD...	184135	cvss3_vuldb_ac	L	see CVSS documentation	10/10/2021	accepted	90
11696766	VulD...	184135	cvss3_vuldb_av	N	see CVSS documentation	10/10/2021	accepted	90
11696765	VulD...	184135	cwe	613 (weak authentication)		10/10/2021	accepted	90
11696764	VulD...	184135	component	Password Change Handler		10/10/2021	accepted	90
11696763	VulD...	184135	version	<=1.0.0	see version documentation	10/10/2021	accepted	90
11696762	VulD...	184135	name	CMS		10/10/2021	accepted	90
11696761	VulD...	184135	vendor	Orchard		10/10/2021	accepted	90
11696194	VulD...	184068	cve_nvd_summary	Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.	mitre.org	10/10/2021	accepted	70
11696193	VulD...	184067	cve_nvd_summary	Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.	mitre.org	10/10/2021	accepted	70
11696192	VulD...	184066	cve_nvd_summary	Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.	mitre.org	10/10/2021	accepted	70
11696191	VulD...	184065	cve_nvd_summary	Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.	mitre.org	10/10/2021	accepted	70
11696190	VulD...	184064	cve_nvd_summary	Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.	mitre.org	10/10/2021	accepted	70
11696189	VulD...	184063	cve_nvd_summary	Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.	mitre.org	10/10/2021	accepted	70
11696188	VulD...	184062	cve_nvd_summary	Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.	mitre.org	10/10/2021	accepted	70
11696187	VulD...	184061	cve_nvd_summary	Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file overwrite leading to remote code execution.	mitre.org	10/10/2021	accepted	70
11696186	VulD...	184060	cve_nvd_summary	An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserialization is mishandled.	mitre.org	10/10/2021	accepted	70
11696185	VulD...	184059	cve_nvd_summary	Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML files. All versions of Apache OpenOffice up to 4.1.10 are subject to this issue. expat in version 4.1.11 is patched.	mitre.org	10/10/2021	accepted	70
11696184	VulD...	184058	cve_nvd_summary	While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but instead used a userid and groupid of 500. This both caused issues with desktop integration and could allow a crafted attack on files owned by that user or group if they exist. Users who installed the Apache OpenOffice 4.1.8 DEB packaging should upgrade to the latest version of Apache OpenOffice.	mitre.org	10/10/2021	accepted	70
11696183	VulD...	184057	cve_nvd_summary	Integria IMS in its 5.0.92 version does not filter correctly some fields related to the login.php file. An attacker could exploit this vulnerability in order to perform a cross-site scripting attack (XSS).	mitre.org	10/10/2021	accepted	70
11696182	VulD...	184057	confirm_url	https://integriaims.com/en/services/updates/	integriaims.com	10/10/2021	accepted	70
11696181	VulD...	184056	cve_nvd_summary	OpenSNS v6.1.0 contains a blind SQL injection vulnerability in /Controller/ChinaCityController.class.php via the cid parameter.	mitre.org	10/10/2021	accepted	70
11696180	VulD...	184055	cve_nvd_summary	OpenSNS v6.1.0 contains a blind SQL injection vulnerability in /Controller/ChinaCityController.class.php via the pid parameter.	mitre.org	10/10/2021	accepted	70
11696179	VulD...	184054	cve_nvd_summary	IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authneticated attacker to obtain sensitive information from configuration files that could aid in further attacks against the system. IBM X-Force ID: 200656.	mitre.org	10/10/2021	accepted	70
11696178	VulD...	184054	confirm_url	https://www.ibm.com/support/pages/node/6496749	ibm.com	10/10/2021	accepted	70
11696177	VulD...	184053	cve_nvd_summary	IBM Sterling File Gateway User Interface 2.2.0.0 through 6.1.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 196944.	mitre.org	10/10/2021	accepted	70
11696176	VulD...	184053	confirm_url	https://www.ibm.com/support/pages/node/6496785	ibm.com	10/10/2021	accepted	70
11696175	VulD...	184052	cve_nvd_summary	IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to intercept and replace a message sent by another user due to improper access controls. IBM X-Force ID: 195567.	mitre.org	10/10/2021	accepted	70
11696174	VulD...	184052	confirm_url	https://www.ibm.com/support/pages/node/6496803	ibm.com	10/10/2021	accepted	70
11696173	VulD...	184051	cve_nvd_summary	IBM Sterling B2B Integrator 5.2.0.0 through 6.1.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199246.	mitre.org	10/10/2021	accepted	70
11696172	VulD...	184051	confirm_url	https://www.ibm.com/support/pages/node/6496753	ibm.com	10/10/2021	accepted	70
11696171	VulD...	184050	cve_nvd_summary	IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199230.	mitre.org	10/10/2021	accepted	70
11696170	VulD...	184050	confirm_url	https://www.ibm.com/support/pages/node/6496759	ibm.com	10/10/2021	accepted	70
11696169	VulD...	184049	cve_nvd_summary	IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 197790.	mitre.org	10/10/2021	accepted	70
11696168	VulD...	184049	confirm_url	https://www.ibm.com/support/pages/node/6496777	ibm.com	10/10/2021	accepted	70
11696167	VulD...	184048	cve_nvd_summary	IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 197503.	mitre.org	10/10/2021	accepted	70
11696166	VulD...	184048	confirm_url	https://www.ibm.com/support/pages/node/6496781	ibm.com	10/10/2021	accepted	70
11696165	VulD...	184047	cve_nvd_summary	IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote attacker to upload arbitrary files, caused by improper access controls. IBM X-Force ID: 199397.	mitre.org	10/10/2021	accepted	70
11696164	VulD...	184047	confirm_url	https://www.ibm.com/support/pages/node/6496751	ibm.com	10/10/2021	accepted	70
11696163	VulD...	184046	cve_nvd_summary	IBM Sterling File Gateway 6.0.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 199170.	mitre.org	10/10/2021	accepted	70
11696162	VulD...	184046	confirm_url	https://www.ibm.com/support/pages/node/6496771	ibm.com	10/10/2021	accepted	70
11696161	VulD...	184045	cve_nvd_summary	IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated attacker to enumerate usernames due to there being an observable discrepancy in returned messages. IBM X-Force ID: 195568.	mitre.org	10/10/2021	accepted	70
11696160	VulD...	184045	confirm_url	https://www.ibm.com/support/pages/node/6496789	ibm.com	10/10/2021	accepted	70
11696159	VulD...	184044	cve_nvd_summary	IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote authenticated user to cause a denial of another user's service due to insufficient permission checking. IBM X-Force ID: 195518.	mitre.org	10/10/2021	accepted	70
11696158	VulD...	184044	cve_nvd_summary	IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote authenticated user to cause a denial of another user's service due to insufficient permission checking. IBM X-Force ID: 195518.	mitre.org	10/10/2021	accepted	70
11696157	VulD...	184044	confirm_url	https://www.ibm.com/support/pages/node/6496805	ibm.com	10/10/2021	accepted	70
11696156	VulD...	184043	cve_nvd_summary	ThinkPHP50-CMS v1.0 contains a remote code execution (RCE) vulnerability in the component /public/?s=captcha.	mitre.org	10/10/2021	accepted	70
11696155	VulD...	184042	cve_nvd_summary	It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.	mitre.org	10/10/2021	accepted	70
11696154	VulD...	184041	cve_nvd_summary	In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCOM devices, changing the password of the root user via the CLI does not change the password of the root user for SNMPv3 access. (However, changing the password of the root user via LANconfig does change the password of the root user for SNMPv3 access.)	mitre.org	10/10/2021	accepted	70
11696153	VulD...	184040	cve_nvd_summary	Improper Input Validation vulnerability in GOT2000 series GT21 model GT2107-WTBD all versions, GT2107-WTSD all versions, GT2104-RTBD all versions, GT2104-PMBD all versions, GT2103-PMBD all versions, GOT SIMPLE series GS21 model GS2110-WTBD all versions, GS2107-WTBD all versions, GS2110-WTBD-N all versions, GS2107-WTBD-N all versions and LE7-40GU-L all versions allows a remote unauthenticated attacker to cause DoS condition of the products by sending specially crafted packets.	mitre.org	10/10/2021	accepted	70
11696152	VulD...	184039	cve_nvd_summary	Improper Input Validation vulnerability in GOT2000 series GT21 model GT2107-WTBD all versions, GT2107-WTSD all versions, GT2104-RTBD all versions, GT2104-PMBD all versions, GT2103-PMBD all versions, GOT SIMPLE series GS21 model GS2110-WTBD all versions, GS2107-WTBD all versions, GS2110-WTBD-N all versions, GS2107-WTBD-N all versions and LE7-40GU-L all versions allows a remote unauthenticated attacker to cause DoS condition of the products by sending specially crafted packets.	mitre.org	10/10/2021	accepted	70
11696151	VulD...	184038	cve_nvd_summary	Improper Input Validation vulnerability in GOT2000 series GT21 model GT2107-WTBD all versions, GT2107-WTSD all versions, GT2104-RTBD all versions, GT2104-PMBD all versions, GT2103-PMBD all versions, GOT SIMPLE series GS21 model GS2110-WTBD all versions, GS2107-WTBD all versions, GS2110-WTBD-N all versions, GS2107-WTBD-N all versions and LE7-40GU-L all versions allows a remote unauthenticated attacker to cause DoS condition of the products by sending specially crafted packets.	mitre.org	10/10/2021	accepted	70
11696150	VulD...	184037	cve_nvd_summary	Improper Handling of Exceptional Conditions vulnerability in GOT2000 series GT21 model GT2107-WTBD all versions, GT2107-WTSD all versions, GT2104-RTBD all versions, GT2104-PMBD all versions, GT2103-PMBD all versions, GOT SIMPLE series GS21 model GS2110-WTBD all versions, GS2107-WTBD all versions, GS2110-WTBD-N all versions, GS2107-WTBD-N all versions and LE7-40GU-L all versions allows a remote unauthenticated attacker to cause DoS condition of the products by sending specially crafted packets.	mitre.org	10/10/2021	accepted	70
11696149	VulD...	184036	cve_nvd_summary	Assuming a shell privilege is gained, an improper exception handling for multi_sim_bar_show_on_qspanel value in SystemUI prior to SMR Oct-2021 Release 1 allows an attacker to cause a permanent denial of service in user device before factory reset.	mitre.org	10/10/2021	accepted	70
11696148	VulD...	184035	cve_nvd_summary	Assuming a shell privilege is gained, an improper exception handling for multi_sim_bar_hide_by_meadia_full value in SystemUI prior to SMR Oct-2021 Release 1 allows an attacker to cause a permanent denial of service in user device before factory reset.	mitre.org	10/10/2021	accepted	70
11696147	VulD...	184034	cve_nvd_summary	Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\Config.php, which can be exploited via the addqq() method.	mitre.org	10/10/2021	accepted	70
11696146	VulD...	184033	cve_nvd_summary	Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\point.php, which can be exploited via the add() method.	mitre.org	10/10/2021	accepted	70
11696145	VulD...	184032	cve_nvd_summary	Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\Config.php, which can be exploited via the add() method.	mitre.org	10/10/2021	accepted	70
11696144	VulD...	184031	cve_nvd_summary	A vulnerability in the REST API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform a command injection attack and elevate privileges to root. This vulnerability is due to insufficient input validation for specific API endpoints. An attacker in a man-in-the-middle position could exploit this vulnerability by intercepting and modifying specific internode communications from one ISE persona to another ISE persona. A successful exploit could allow the attacker to run arbitrary commands with root privileges on the underlying operating system. To exploit this vulnerability, the attacker would need to decrypt HTTPS traffic between two ISE personas that are located on separate nodes.	mitre.org	10/10/2021	accepted	70