NVD disclosure day
CVE-2021-38163
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An authenticated user can upload a malicious file to SAP NetWeaver Visual Composer, leading to operating system command execution. This can result in data compromise or server unavailability, posing a business risk.
CVE-2021-36582
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The Kooboo CMS vulnerability allows unauthenticated attackers to upload and execute a remote shell on the server, enabling full server compromise and control via a reverse shell. This issue is reachable over the network and could expose sensitive data or disrupt operations.
CVE-2021-36581
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Kooboo CMS is susceptible to insecure file uploads, allowing any file extension, including malicious ones, to be uploaded to the server without proper validation. This could lead to arbitrary code execution on the server, impacting the confidentiality, integrity, and availability of systems and data. Due to its network