Archive
7 January 2021
Vulnerabilities first published on this day (UTC), newest first.
57 results · Feed
-
High 7.5
Resource exhaustion in engine.io
Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
-
High 7.5
Resource exhaustion in socket.io-parser
socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
-
Unscored —
A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1 allows an attacker to read any co…
-
Unscored —
A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and…
-
Unscored —
An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to ove…
-
Unscored —
In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg) potentially allow an attacker to…
-
Unscored —
Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro before 3.8 allows Command Injection (issue 1 o…
-
Unscored —
Rock RMS version before 8.6 is vulnerable to account takeover by tampering with the user ID parameter in the profile up…
-
Unscored —
Rock RMS versions before 8.10 and versions 9.0 through 9.3 fails to properly validate files uploaded in the application…
-
Unscored —
PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows atta…
-
Unscored —CVE-2021-23241 EPSS 13%
MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI …
-
Unscored —
MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server, as demonstrated by the /../..…
-
Unscored —
The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of h…
-
Medium 5.9
IBM Emptoris Strategic Supply Management 10.1.3 uses weaker than expected cryptographic algorithms that could allow an …
-
Medium 5.3
IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attack…
-
Medium 6.5
IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3 is vulnerable to web cache poisoning, caused by improper input validat…
-
Medium 5.9
IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 transmits sensitive information in HTTP GET request…
-
Medium 6.4
IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. This …
-
Medium 5.4
IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
-
Unscored —
The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of h…
-
Unscored —
A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore…
-
High 7.5
A denial-of-service vulnerability exists in the Ethernet/IP server functionality of Rockwell Automation RSLinx Classic …
-
Unscored —
A use after free in the Linux kernel infiniband hfi1 driver in versions prior to 5.10-rc6 was found in the way user cal…
-
Medium 5.8
File parsing Type Confusion Remote code execution vulerability
Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user upload a malformed .E70 file in t…
-
Medium 5.8
File parsing Out-Of-Bounds read remote code execution
The Eaton's easySoft software v7.xx prior to v7.22 are susceptible to Out-of-bounds remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user to upload the malformed .E70 file in the ap…
-
Unscored —
Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can c…
-
Unscored —
Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a race condition that can cause a stack-b…
-
Unscored —
Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCheckLicence race condition that c…
-
Unscored —
Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyPreviewAction race condition that …
-
Unscored —
Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can c…
-
Unscored —
Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCPDFAction race condition that can…
-
Unscored —
Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can c…
-
Unscored —
Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyGetAppEdition race condition that …
-
Unscored —
Foxit PDF ActiveX before 5.5.1 allows remote code execution via command injection because of the lack of a security per…
-
Medium 6.1
Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via User Name Parameter
Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar. An attacker can insert the malicious payload on the username, lastname or surname fields of its own profile, an…
-
Unscored —
An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure…
-
Unscored —CVE-2020-28672 EPSS 12%
MonoCMS Blog 1.0 is affected by incorrect access control that can lead to remote arbitrary code execution. At monofiles…
-
Unscored —
Restaurant Reservation System 1.0 suffers from an authenticated SQL injection vulnerability, which allows a remote, aut…
-
Unscored —
EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has an OS Command Injection vulnerability via shell metacharacter…
-
Unscored —
Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video …