CVE-2021-26595

MEDIUM Year: 2021
CVSS v3 Score
5.3
Medium
CVSS v2 Score
5.0
Medium
Weakness Type
CWE-312
View all →

Vulnerability Description

In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of the DBMS, simply by view the result of the api-aa, called automatically upon a connection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Related Vulnerabilities

CVE-2019-8118

MEDIUM
CVSS:5.3(Medium)

Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for customer accounts.

CWE-3122019

CVE-2020-12859

MEDIUM
CVSS:5.3(Medium)

Unnecessary fields in the OpenTrace/BlueTrace protocol in COVIDSafe through v1.0.17 allow a remote attacker to identify a device model by observing cleartext payload data. This allows re-identificatio...

CWE-3122020

CVE-2020-15325

MEDIUM
CVSS:5.3(Medium)

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded Erlang cookie for ejabberd replication.

CWE-3122020

CVE-2020-15384

MEDIUM
CVSS:5.3(Medium)

Brocade SANNav before version 2.1.1 contains an information disclosure vulnerability. Successful exploitation of internal server information in the initial login response header.

CWE-3122020

CVE-2020-15784

MEDIUM
CVSS:5.3(Medium)

A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP8). Insecure storage of sensitive information in the configuration files could allow the retrieval of user names.

CWE-3122020

CVE-2020-35658

MEDIUM
CVSS:5.3(Medium)

SpamTitan before 7.09 allows attackers to tamper with backups, because backups are not encrypted.

CWE-3122020