Archive
25 January 2021
Vulnerabilities first published on this day (UTC), newest first.
39 results · Feed
-
Medium 5.3
CSRF in MediaWiki Report extension
The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability. Before fixed version, there was no protection against CSRF checks on Special:Report, so requests to report a revision could be forged. The problem has been fixed in commit…
-
Unscored —
Rostelecom CS-C2SHW 5.0.082.1 is affected by: Bash command injection. The camera reads configuration from QR code (incl…
-
Unscored —
Denial of Service vulnerability in Rostelecom CS-C2SHW 5.0.082.1. AgentGreen service has a bug in parsing broadcast dis…
-
Unscored —
Heap overflow with full parsing of HTTP respose in Rostelecom CS-C2SHW 5.0.082.1. AgentUpdater service has a self-writt…
-
Unscored —
Bash injection vulnerability and bypass of signature verification in Rostelecom CS-C2SHW 5.0.082.1. The camera reads fi…
-
Unscored —
FastStone Image Viewer 7.5 has an out-of-bounds write (via a crafted image file) at FSViewer.exe+0x96cf.
-
Unscored —
FastStone Image Viewer 7.5 has an out-of-bounds write (via a crafted image file) at FSViewer.exe+0xbe9c4.
-
Unscored —
FastStone Image Viewer 7.5 has an out-of-bounds write (via a crafted image file) at FSViewer.exe+0x956e.
-
Unscored —
anasonic FPWIN Pro
FPWIN Pro is vulnerable to an out-of-bounds read vulnerability when a user opens a maliciously crafted project file, which may allow an attacker to remotely execute arbitrary code.
-
Medium 4.4
Password Hash With Insufficient Computational Effort in the Database of Bosch FSM-2500 Server and Bosch FSM-5000 Server
Use of Password Hash With Insufficient Computational Effort in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2 allows a remote attacker with admin privileges to dump the credentials of other users and possibly r…
-
Critical 10.0
Hard-coded Credentials in the Database of Bosch FSM-2500 Server and Bosch FSM-5000 Server
Use of Hard-coded Credentials in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2 allows an unauthenticated remote attacker to log into the database with admin-privileges. This may result in complete compromise o…
-
Unscored —
A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw…
-
High 7.7
zip slip in ORAS
ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The director…
-
Unscored —
An elevation of privilege vulnerability exists in Hackolade versions prior 4.2.0 on Windows has an issue in specific de…
-
Unscored —
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsod…
-
Unscored —
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsod…
-
Unscored —
A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (ve…
-
Unscored —
In A2DP_GetCodecType of a2dp_codec_config, there is a possible out-of-bounds read due to improper input validation. Thi…
-
Unscored —
A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an…
-
Unscored —
A flaw incorrect umask during file or directory modification in the Linux kernel NFS (network file system) functionalit…
-
Unscored —
Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection…
-
Unscored —
Textpattern 4.8.4 is affected by cross-site scripting (XSS) in the Body parameter.
-
Unscored —
4images Image Gallery Management System 1.7.11 is affected by cross-site scripting (XSS) in the Image URL. This vulnera…
-
Unscored —
Student Result Management System In PHP With Source Code is affected by SQL injection. An attacker can able to access o…
-
Unscored —CVE-2020-36221 EPSS 85%
An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Asserti…
-
Unscored —CVE-2020-36222 EPSS 77%
A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation,…
-
Unscored —
A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo p…
-
Unscored —
A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing,…
-
Unscored —
A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAu…
-
Unscored —CVE-2020-36228 EPSS 85%
An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact As…
-
Unscored —
A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in a…
-
Unscored —CVE-2020-36230 EPSS 12%
A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in dec…
-
Unscored —CVE-2020-36227 EPSS 77%
A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel opera…
-
Unscored —
A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, …
-
High 8.8
Apache ServiceComb Yaml remote deserialization vulnerability
When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5
-
Critical 9.1
An XML external entity (XXE) injection vulnerability exists in the Nutch DmozParser
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere wi…
-
Unscored —
PlugIns\IDE_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE_ACD…
-
Unscored —
PlugIns\IDE_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE_ACD…
-
Unscored —
A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 20121…