CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36062 – Adobe Connect Reflected Cross-site Scripting via 'campaign-id' parameter
https://notcve.org/view.php?id=CVE-2021-36062
01 Sep 2021 — Adobe Connect version 11.2.2 (and earlier) is affected by a Reflected Cross-site Scripting vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Adobe Connect versiones 11.2.2 (y anteriores), está afectada por una vulnerabilidad de tipo Cross-site Scripting Reflejado que podría s... • https://helpx.adobe.com/security/products/connect/apsb21-66.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36758
https://notcve.org/view.php?id=CVE-2021-36758
15 Jul 2021 — 1Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens that can be used to perform privilege escalation. Malicious users authorized to create Secrets Automation access tokens can create tokens that have access beyond what the user is authorized to access, but limited to the existing authorizations of the Secret Automation the token is created in. El servidor de 1Password Connect anterior a la versión 1.2 carece de comprobaciones de valid... • https://support.1password.com/kb/202106 • CWE-20: Improper Input Validation CWE-863: Incorrect Authorization •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-3613
https://notcve.org/view.php?id=CVE-2021-3613
02 Jul 2021 — OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (OpenVPNConnect.exe). OpenVPN Connect versiones 3.2.0 hasta 3.3.0, permite a usuarios locales cargar bibliotecas dinámicas arbitrarias por medio de un archivo de configuración de OpenSSL si está presente, permitiendo a un usuario ejecutar código arbitrario con el ... • https://openvpn.net/vpn-server-resources/openvpn-connect-for-windows-change-log • CWE-427: Uncontrolled Search Path Element •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-28579 – Adobe Connect improper access control could lead to privilege escalation
https://notcve.org/view.php?id=CVE-2021-28579
28 Jun 2021 — Adobe Connect version 11.2.1 (and earlier) is affected by an Improper access control vulnerability that can lead to the elevation of privileges. An attacker with 'Learner' permissions can leverage this scenario to access the list of event participants. Adobe Connect versiones 11.2.1 (y anteriores), está afectada por una vulnerabilidad de control inapropiado de acceso que puede conllevar a una escalada de privilegios. Un atacante con permisos de "Learner" puede aprovechar este escenario para acceder a la lis... • https://helpx.adobe.com/security/products/connect/apsb21-36.html • CWE-284: Improper Access Control •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15075
https://notcve.org/view.php?id=CVE-2020-15075
30 Mar 2021 — OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in /tmp. El instalador de OpenVPN Connect para macOS versión 3.2.6 y anteriores, puede corromper archivos críticos del sistema a los que no debería tener acceso por medio de enlaces simbólicos en /tmp. • https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-61: UNIX Symbolic Link (Symlink) Following •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-26715
https://notcve.org/view.php?id=CVE-2021-26715
25 Mar 2021 — The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arises due to unsafe usage of the logo_uri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP request from the vulnerable server to any address in the internal network and obtain its response (which might, for example, have a JavaScript payload for resultant XSS). The issue can be exploited to bypass network b... • https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/releases • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-25265
https://notcve.org/view.php?id=CVE-2021-25265
22 Mar 2021 — A malicious website could execute code remotely in Sophos Connect Client before version 2.1. Un sitio web malicioso podría ejecutar código remotamente en Sophos Connect Client versiones anteriores a 2.1 • https://community.sophos.com/b/security-blog •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21085 – Adobe Connect CSV injection via export feature could lead to code execution
https://notcve.org/view.php?id=CVE-2021-21085
12 Mar 2021 — Adobe Connect version 11.0.7 (and earlier) is affected by an Input Validation vulnerability in the export feature. An attacker could exploit this vulnerability by injecting a payload into an online event form and achieve code execution if the victim exports and opens the data on their local machine. La versión 11.0.7 de Adobe Connect (y anteriores) se ve afectada por una vulnerabilidad de Validación de Entradas en la función de exportación. Un atacante podría aprovechar esta vulnerabilidad inyectando una ca... • https://helpx.adobe.com/security/products/connect/apsb21-19.html • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21080 – Adobe Connect Reflected Cross-site Scripting via query parameter
https://notcve.org/view.php?id=CVE-2021-21080
12 Mar 2021 — Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript content that may be executed within the context of the victim's browser when they browse to the page containing the vulnerable field. Adobe Connect versiones 11.0.7 (y anteriores), está afectado por una vulnerabilidad de tipo Cross-Site Scripting (XSS) reflejado. Un atacante podría explotar esta vulnerabilidad para in... • https://helpx.adobe.com/security/products/connect/apsb21-19.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21079 – Adobe Connect Reflected Cross-site Scripting via archiveOffset parameter
https://notcve.org/view.php?id=CVE-2021-21079
12 Mar 2021 — Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript content that may be executed within the context of the victim's browser when they browse to the page containing the vulnerable field. Adobe Connect versiones 11.0.7 (y anteriores), está afectado por una vulnerabilidad de tipo Cross-Site Scripting (XSS) reflejado. Un atacante podría explotar esta vulnerabilidad para in... • https://helpx.adobe.com/security/products/connect/apsb21-19.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •