Archive
4 January 2021
Vulnerabilities first published on this day (UTC), newest first.
45 results · Feed
-
Medium 5.1
Select Dell Client Commercial and Consumer platforms support a BIOS password reset capability that is designed to assis…
-
Medium 6.1
Dell Wyse Management Suite versions prior to 3.1 contain an open redirect vulnerability. A remote unauthenticated attac…
-
Medium 4.8
Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. A remote authenti…
-
Medium 5.4
Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. A remote authenti…
-
Critical 10.0
Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticat…
-
Critical 10.0
Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticat…
-
High 8.2
XSS in mdBook's search page
mdBook is a utility to create modern online books from Markdown files and is written in Rust. In mdBook before version 0.4.5, there is a vulnerability affecting the search feature of mdBook, which could allow an attacker to execute arbitrary JavaScript code o…
-
Unscored —
In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter.
-
High 7.4
Exposure of server configuration
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can …
-
Medium 6.1
Possible XSS bypass if style tag is allowed
HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the `<style…
-
Low 3.1
Potential Malware Discovered (Possible False Positive)
Creeper is an experimental dynamic, interpreted language. The binary release of Creeper Interpreter 1.1.3 contains potential malware. The compromised binary release was available for a few hours between December 26, 2020 at 3:22 PM EST to December 26, 2020 at…
-
Unscored —
The ASUS DSL-N17U modem with firmware 1.1.0.2 allows attackers to access the admin interface by changing the admin pass…
-
Critical 10.0
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escala…
-
Critical 9.9
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalati…
-
Critical 10.0
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escala…
-
Unscored —
An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernati…
-
Unscored —
Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a craft…
-
Unscored —
The Application Wrapper in Pearson VUE VTS Installer 2.3.1911 has Full Control permissions for Everyone in the "%SYSTEM…
-
Unscored —CVE-2020-36112 EPSS 18%
CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pu…
-
Unscored —
There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an …
-
Unscored —
There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to su…
-
Unscored —
There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the ob…
-
Unscored —
There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed…
-
Unscored —
A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump co…
-
Unscored —
Veno File Manager 3.5.6 is affected by a directory traversal vulnerability. Using the traversal allows an attacker to d…
-
Medium 6.5
IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery which could allow an a…
-
Medium 6.7
IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files. By intercepting the request…
-
Medium 4.7
IBM Cloud Pak System 2.3 has insufficient logout controls which could allow an authenticated privileged user to imperso…
-
Low 2.3
IBM Cloud Pak System 2.3 could allow l local privileged user to disclose sensitive information due to an insecure direc…
-
Medium 4.3
IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious…
-
Medium 5.5
IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Java…
-
Medium 4.4
IBM Cloud Pak System 2.3 could reveal credential information in the HTTP response to a local privileged user. IBM X-For…
-
Medium 4.7
IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the user request URL when…
-
Medium 4.8
IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Java…
-
Medium 4.8
IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Java…
-
Unscored —
interfaces2 is unmaintained, use interfaces instead
The `interfaces2` crate is not maintained any more; use [`interfaces`](https://crates.io/crates/interfaces) instead.
-
Critical 9.8
Remote Code Execution (RCE)
This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.
-
High 7.5
Prototype Pollution
The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function.
-
Unscored —
SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field.
-
Unscored —
SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket.