Archive
21 January 2021
Vulnerabilities first published on this day (UTC), newest first.
72 results · Feed
-
Unscored —
TinyCheck before commits 9fd360d and ea53de8 allowed an authenticated attacker to send an HTTP GET request to the craft…
-
Unscored —
TinyCheck before commits 9fd360d and ea53de8 was vulnerable to command injection due to insufficient checks of input pa…
-
Unscored —
RockOA V1.9.8 is affected by a cross-site scripting (XSS) vulnerability which allows remote attackers to send malicious…
-
Medium 6.1
Feehi CMS vulnerable to Cross-site Scripting in Username Field
Feehi CMS 2.0.8 is affected by a cross-site scripting (XSS) vulnerability. When the user name is inserted as JavaScript code, browsing the post will trigger the XSS.
-
Unscored —
An issue was discovered in certain Xerox WorkCentre products. They do not properly encrypt passwords. This affects 3655…
-
Unscored —
LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID.
-
Unscored —
Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL web…
-
Unscored —
Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly acc…
-
Unscored —CVE-2021-22873 EPSS 70%
Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the l…
-
Unscored —
Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting (XSS) vulnerability via the drag & drop fu…
-
Unscored —
The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerabilit…
-
Unscored —
Some ZTE products have a DoS vulnerability. Due to the improper handling of memory release in some specific scenarios, …
-
Medium 4.9
Kubernetes Secrets Store CSI Driver plugin directory traversals
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesys…
-
High 7.5CVE-2020-8570 Public exploit
Kubernetes Java client libraries unvalidated path traversal in Copy implementation
Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any f…
-
Medium 4.3
Kubernetes CSI snapshot-controller DoS
Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotCl…
-
Medium 6.3CVE-2020-8554 Public exploit
Kubernetes man in the middle using LoadBalancer or ExternalIPs
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a pri…
-
Medium 5.8
Kubernetes Secrets Store CSI Driver sync/rotate directory traversal
Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes pa…
-
High 7.2
Feehi CMS arbitrary file upload vulnerability
Feehi CMS 2.1.0 is affected by an arbitrary file upload vulnerability, potentially resulting in remote code execution. After an administrator logs in, open the administrator image upload page to potentially upload malicious files.
-
Unscored —
Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks ag…
-
Unscored —CVE-2020-28874 Public exploit
reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect busines…
-
Unscored —
Bakeshop Online Ordering System in PHP/MySQLi 1.0 is affected by cross-site scripting (XSS) which allows remote attacke…
-
Unscored —
Online News Portal using PHP/MySQLi 1.0 is affected by cross-site scripting (XSS) which allows remote attackers to inje…
-
Unscored —
A local (authenticated) low-privileged user can exploit a behavior in an ESET installer to achieve arbitrary file overw…
-
Medium 5.8
Use of a One-Way Hash without a Salt in OnlineVotingSystem
OnlineVotingSystem is an open source project hosted on GitHub. OnlineVotingSystem before version 1.1.2 hashes user passwords without a salt, which is vulnerable to dictionary attacks. Therefore there is a threat of security breach in the voting system. Withou…
-
Medium 6.5
SAML XML Signature wrapping
PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is…
-
Medium 6.5CVE-2021-21239 Public exploit
Open default xmlsec1 key-type preference
PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML d…
-
Low 2.6
IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, …
-
Medium 5.3
IBM Security Identity Governance and Intelligence 5.2.6 uses weaker than expected cryptographic algorithms that could a…
-
High 7.4
IBM Security Identity Governance and Intelligence 5.2.6 does not perform any authentication for functionality that requ…
-
Medium 4.3
IBM Security Identity Governance and Intelligence 5.2.6 does not set the secure attribute on authorization tokens or se…
-
High 8.7
CMS Editor code execution
OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml. The late…
-
High 8.7
Widget instances allows a hacker to inject an executable file on the server on OpenMage
OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create w…
-
Unscored —
Possible out of bound memory access in audio due to integer underflow while processing modified contents in Snapdragon …
-
Unscored —
Local privilege escalation in admin services in Windows environment can occur due to an arbitrary read issue.
-
Unscored —
Possible memory out of bound issue during music playback when an incorrect bit stream content is copied into array with…
-
Unscored —
Pointer variable which is freed is not cleared can result in memory corruption and leads to denial of service in Snapdr…
-
Unscored —
A possible double free or invalid memory access in audio driver while reading Speaker Protection parameters in Snapdrag…
-
Unscored —
Out of bound access in WLAN driver due to lack of validation of array length before copying into array in Snapdragon Au…
-
Unscored —
Buffer over read can happen in video driver when playing clip with atomsize having value UINT32_MAX in Snapdragon Auto,…
-
Unscored —
An out of bounds read can happen when processing VSA attribute due to improper minimum required length check in Snapdra…