Archive
5 January 2021
Vulnerabilities first published on this day (UTC), newest first.
48 results · Feed
-
Medium 6.6
Network Security Management (NSM) - Cross Site Request Forgery vulnerability
Cross Site Request Forgery vulnerability in McAfee Network Security Management (NSM) prior to 10.1.7.35 and NSM 9.x prior to 9.2.9.55 may allow an attacker to change the configuration of the Network Security Manager via a carefully crafted HTTP request.
-
Unscored —
Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment.
-
Unscored —
GigaVUE-OS (GVOS) 5.4 - 5.9 stores a Redis database password in plaintext.
-
Unscored —
GigaVUE-OS (GVOS) 5.4 - 5.9 uses a weak algorithm for a hash stored in internal database.
-
Medium 6.3
Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, …
-
High 7.5
Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X…
-
Medium 6.4
Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X…
-
High 7.5
Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore T…
-
High 7.5
Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a Denial of Service vulnerability on NAS…
-
Medium 6.4
Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerabi…
-
High 7.0
Dell EMC Isilon OneFS versions 8.1 and later and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation…
-
Medium 6.4
Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a plain-text password storage vulnerabil…
-
Unscored —
Directory traversal vulnerability in page_edit.php in MiniCMS V1.10 allows remote attackers to read arbitrary files via…
-
Unscored —
Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote attackers to include and execute arbi…
-
Unscored —
An issue was discovered in Viki Vera 4.9.1.26180. A user without access to a project could download or upload project f…
-
Unscored —
An issue was discovered in Viki Vera 4.9.1.26180. An attacker could set a user's last name to an XSS Payload, and read …
-
High 7.5
github.com/tidwall/gjson is vulnerable to Denial of service
GJSON <1.6.5 allows attackers to cause a denial of service (remote) via crafted JSON.
-
High 7.5
Improper Validation of Array Index in GJSON
GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call.
-
Unscored —
SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQ…
-
Medium 5.3
Veritas Desktop and Laptop Option (DLO) before 9.5 disclosed operational information on the backup processing status th…
-
Unscored —
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Broadcom Bluetooth chipsets) softwa…
-
Unscored —
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) (Exynos chipsets) software.…
-
Unscored —
An issue was discovered in the fingerprint scanner on Samsung Note20 mobile devices with Q(10.0) software. When a scree…
-
Unscored —
There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrus…
-
Unscored —
A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide…
-
Unscored —
An issue was discovered on LG mobile devices with Android OS 10 software. There was no write protection for the MTK pro…
-
High 7.7
Directory Traversal
spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vu…
-
Unscored —
CA Service Catalog 17.2 and 17.3 contain a vulnerability in the default configuration of the Setup Utility that may all…
-
Unscored —
A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted inpu…
-
Unscored —
There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to…
-
Unscored —
There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide craf…
-
Unscored —
ISPConfig before 3.2.2 allows SQL injection.
-
Critical 9.3
An exploitable local privilege elevation vulnerability exists in the file system permissions of the Mobile-911 Server V…
-
Critical 9.3
An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise …
-
Critical 9.3
An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise …
-
High 7.4
IBM API Connect 5.0.0.0 through 5.0.8.10 could potentially leak sensitive information or allow for data corruption due …
-
Medium 5.3
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allo…
-
High 8.8
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allo…
-
High 8.8
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allo…
-
Unscored —
FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malici…