Archive
27 January 2021
Vulnerabilities first published on this day (UTC), newest first.
44 results · Feed
-
Unscored —
WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted U…
-
Medium 5.3
Improper Control of Dynamically-Managed Code Resources in config-shield
scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. NOTE: the vendor reportedly states that this is not a vulnerability. The set command was not intended for use with …
-
Unscored —
A DLL hijacking vulnerability Trend Micro HouseCall for Home Networks version 5.3.1063 and below could allow an attacke…
-
Unscored —
A memory exhaustion vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow a local attacker to craft spec…
-
Unscored —
A memory exhaustion vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow a local attacker to craft spec…
-
Unscored —
A memory exhaustion vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow a local attacker to craft spec…
-
Unscored —
Multiple stack-based buffer overflow issues have been identified in the way the application processes project files, al…
-
Unscored —
Multiple out-of-bounds read issues have been identified in the way the application processes project files, allowing an…
-
Unscored —
An uninitialized pointer issue has been identified in the way the application processes project files, allowing an atta…
-
Unscored —
A heap-based buffer overflow issue has been identified in the way the application processes project files, allowing an …
-
Unscored —
Multiple out-of-bounds write issues have been identified in the way the application processes project files, allowing a…
-
Unscored —
Monitorix 3.13.0 allows remote attackers to bypass Basic Authentication in a default installation (i.e., an installatio…
-
High 7.5
Flaw in ActiveMQ Artemis OpenWire support
While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject t…
-
Unscored —
This module enables you to add groups to other groups in a tree structure where access can be inherited up or down the …
-
Medium 5.1
Possibility of SQL Injection in Spring Cloud Task Execution Sorting Query
In applications using Spring Cloud Task 2.2.4.RELEASE and below, may be vulnerable to SQL injection when exercising certain lookup queries in the TaskExplorer.
-
Medium 5.7
Possibility of SQL Injection in Spring Cloud Data Flow Task Execution Sorting Query
In Spring Cloud Data Flow, versions 2.6.x prior to 2.6.5, versions 2.5.x prior 2.5.4, an application is vulnerable to SQL injection when requesting task execution.
-
Unscored —CVE-2021-3318 Public exploit
attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter.
-
High 8.8
IBM Security Guardium 11.2 could allow an authenticated user to gain root access due to improper access control. IBM X-…
-
Medium 6.5
IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 could allow a remote atta…
-
Medium 4.2
IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 is vulnerable to server s…
-
Medium 5.4
IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 is vulnerable to server s…
-
Medium 4.3
IBM Security Guardium 11.2 discloses sensitive information in the response headers that could be used in further attack…
-
Medium 5.4
IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary …
-
Medium 5.4
IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary …
-
Medium 5.4
IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary …
-
Medium 5.4
IBM Jazz Foundation products could allow a remote attacker to hijack the clicking action of the victim. By persuading a…
-
Medium 5.4
IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary …
-
Unscored —
condor_credd in HTCondor before 8.9.11 allows Directory Traversal outside the SEC_CREDENTIAL_DIRECTORY_OAUTH directory,…
-
Unscored —
HTCondor before 8.9.11 allows a user to submit a job as another user on the system, because of a flaw in the IDTOKENS a…
-
Unscored —
phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishan…
-
Unscored —
oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical passwo…
-
Unscored —
WeBid 1.2.2 admin/newuser.php has an issue with password rechecking during registration because it uses a loose compari…
-
Unscored —
dmin/kernel/api/login.class.phpin in nibbleblog v3.7.1c allows type juggling for login bypass because == is used instea…
-
High 7.5
Codiad Vulnerable to PHP Magic Hash Vulnerability
** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Codiad 2.8.4 /componetns/user/class.user.php:Authenticate() is vulnerable in magic hash authentication bypass. If encrypted or hash value for the passwords form certain formats of magic hash, e.g, 0e123, another hash …
-
Unscored —
Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control. PHP loose comparison and a magic hash can be used to b…
-
Low 3.1
IBM Cloud Pak for Security (CP4S) 1.3.0.1 could disclose sensitive information through HTTP headers which could be used…
-
Medium 6.1
IBM Cloud Pak for Security (CP4S) 1.4.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to emb…
-
Medium 5.3
IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote attacker to obtain sensitive information, caused by the …
-
Medium 5.3
IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response …
-
Medium 5.3
IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information whe…