Archive
28 January 2021
Vulnerabilities first published on this day (UTC), newest first.
31 results · Feed
-
Unscored —
OnCommand Unified Manager Core Package versions prior to 5.2.5 may disclose sensitive account information to unauthoriz…
-
Unscored —
In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authen…
-
Unscored —
Deserialization of untrusted data in the login page of ASSUWEB 359.3 build 1 subcomponent of ACA ASSUREX RENTES product…
-
Unscored —
The Hide-Thread-Content plugin through 2021-01-27 for MyBB allows remote attackers to bypass intended content-reading r…
-
Unscored —
OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequent…
-
Unscored —
Stored Cross Site Scripting (XSS) vulnerability in EGavilan Media CRUD Operation with PHP, MySQL, Bootstrap, and Dompdf…
-
Unscored —
A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where …
-
Unscored —
A flaw was found in Keycloak Gatekeeper (Louketo). The logout endpoint can be abused to redirect logged-in users to arb…
-
Medium 5.4
Incorrect Authorization in keycloak
A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappings in Keycloak and after expiration of the previous access token.
-
Medium 5.3
Moodle Client side denial of service via personal message
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result in client-side (browser) denial of service for users receiving very large messages.
-
Unscored —
Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" messag…
-
Medium 4.3
Moodle Grade information disclosure in grade's external fetch functions
It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meant students were able to view other students grades.
-
Medium 5.4
Moodle Cross-site Scripting
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of TeX content was required to prevent the risk of stored XSS.
-
Medium 5.4
Moodle Vulnerable to Reflected Cross-site Scripting
It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of search queries.
-
High 7.2
Moodle Arbitrary PHP code execution by site admins via Shibboleth configuration
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication.
-
Medium 5.4
Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs
The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer proces…
-
Unscored —CVE-2021-22875 EPSS 18%
Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter.
-
Unscored —CVE-2021-22874 EPSS 18%
Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the `period_preset…
-
Medium 6.3CVE-2020-4888 EPSS 62%
IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary co…
-
High 8.1
IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, c…
-
High 8.8
A cross-site request forgery vulnerability exists in the GACL functionality of OpenEMR 5.0.2 and development version 6.…
-
Unscored —
Cross-site scripting vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 fi…
-
Unscored —
Logstorage version 8.0.0 and earlier, and ELC Analytics version 3.0.0 and earlier allow remote attackers to execute arb…
-
Unscored —
Cross-site scripting vulnerability in Aterm WF800HP firmware Ver1.0.9 and earlier allows remote attackers to inject an …
-
Critical —
XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic
A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript through the Referer header of asset downloads.
-
Unscored —
An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15…
-
Unscored —
An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15…
-
Unscored —
An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15…
-
Unscored —CVE-2020-25782 Public exploit
An issue was discovered on Accfly Wireless Security IR Camera 720P System with software versions v3.10.73 through v4.15…
-
Unscored —
Affected versions of Atlassian Bamboo allow an unauthenticated remote attacker to view a stack trace that may reveal th…