Archive
12 January 2021
Vulnerabilities first published on this day (UTC), newest first.
178 results · Feed
-
Medium 5.5
Windows DNS Query Information Disclosure Vulnerability
Windows DNS Query Information Disclosure Vulnerability
-
Medium 6.1
rails_admin ruby gem XSS vulnerability
RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms.
-
High 7.7
Information disclosure vulnerability in iTop
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access…
-
Unscored —
Mubu 2.2.1 allows local users to gain privileges to execute commands, aka CNVD-2020-68878.
-
Unscored —
The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages.
-
Unscored —
OpenText Carbonite Server Backup Portal before 8.8.7 allows XSS by an authenticated user via policy creation.
-
High 7.1
TIBCO EBX EXML External Entity
The TIBCO EBX Add-on for Oracle Hyperion EPM, TIBCO EBX Data Exchange Add-on, and TIBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-ons contain a vulnerability that theoretically allows a low privileged attacker with network access to…
-
Medium 4.3
IBM Workload Automation 9.5 stores the server path in URLs that could aid in further attacks against the system. IBM X-…
-
Medium 6.4
IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to stored cross-site scripting. This vulnerability allows users …
-
Medium 4.3
IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the…
-
Medium 5.3
When security guidelines for SAP NetWeaver Master Data Management running on windows have not been thoroughly reviewed,…
-
Critical 9.9
SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow…
-
Medium 5.4
SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated da…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted source…
-
Medium 4.3
SAP Banking Services (Generic Market Data) does not perform necessary authorization checks for an authenticated user, r…
-
Low 3.6
SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows a…
-
Critical 9.9
The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the …
-
Medium 6.5
The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escal…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted source…
-
Medium 5.4
SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malic…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted source…
-
Medium 5.3
SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend …
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted source…
-
High 7.5
SAP NetWeaver AS ABAP, versions 740, 750, 751, 752, 753, 754, 755, allows an unauthenticated attacker to prevent legiti…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SGI file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted source…
-
Unscored —
A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in th…
-
High 7.8
ClusterLabs crmsh vulnerable to shell code injection
An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalation of privileges.
-
Unscored —
Information disclosure vulnerability in HCL Commerce 9.0.1.9 through 9.0.1.14 and 9.1 through 9.1.4 could allow a remot…
-
Unscored —
Security vulnerability in HCL Commerce 9.0.0.5 through 9.0.0.13, 9.0.1.0 through 9.0.1.14 and 9.1 through 9.1.4 could a…