Archive
January 2021
Vulnerabilities first published in this month (UTC), newest first.
365 results · Clear filters · Feed
-
High 7.6
Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Web Server). Supported version…
-
High 7.6
Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Administration). Supported ver…
-
High 7.6
Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Suppo…
-
High 7.2
Vulnerability in the RDBMS Sharding component of Oracle Database Server. Supported versions that are affected are 12.2.…
-
High 7.6
Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Suppo…
-
High 7.6
Vulnerability in the Siebel Core - Server Framework product of Oracle Siebel CRM (component: Search). Supported version…
-
High 8.1
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: In…
-
High 8.2
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Support…
-
High 8.2
Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Tasks). Support…
-
High 8.8
Vulnerability in the RDBMS Scheduler component of Oracle Database Server. Supported versions that are affected are 12.1…
-
High 8.2
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: An…
-
High 8.2
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Support…
-
High 8.3
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affect…
-
High 8.2
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Worklist). Supported versions that …
-
High 7.6
Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security). Suppor…
-
High 8.1
Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (compo…
-
High 8.8
Cross-Site Request Forgery in Vert.x-Web framework
Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, it compares the CSRF token in the cookie against a CSRF token that is stored in the ses…
-
High 7.2
Query Binding Exploitation in Laravel
Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field th…
-
High 8.1
Deserialization of untrusted data in jackson-databind
A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
-
High 7.3
Prototype Pollution
The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object's key and set the value is not properly sanitized, leadin…
-
High 8.0
D-Link DCS-5220 devices have a buffer overflow. NOTE: This vulnerability only affects products that are no longer suppo…
-
High 7.3
Prototype Pollution
This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the ap…
-
High 7.5
-
High 7.5
-
High 8.8
HGiga OAKloud Portal - SQL injection -2
HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (online registration) to obtain database schema and data.
-
High 7.5
Directory Traversal in Archive_Tar
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
KEV Aug 25, 2022 -
High 8.6
Pre-Auth Access token leak
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/{id}` endpoint there are no security checks …
-
High 7.7
Post-Auth External Entity Expansion (XXE)
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which may lead to arbitrary file read. When BuildSpec is provided in XML format, the spec is processed by XmlBuildSpecMigrator.migrate(buildSpecString);…
-
High 7.7CVE-2021-21251 EPSS 13%
ZipSlip Arbitrary File Upload
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3 there is a critical "zip slip" vulnerability. This issue may lead to arbitrary file write. The KubernetesResource REST endpoint untars user controlled data from the request body using Tar…
-
High 7.2
Git LFS can execute a Git binary from the current directory on Windows
Git LFS is a command line extension for managing large files with Git. On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitr…
-
High 7.8
Junos OS: telnetd.real Local Privilege Escalation vulnerabilities in SUID binaries
A local privilege escalation vulnerability in telnetd.real of Juniper Networks Junos OS may allow a locally authenticated shell user to escalate privileges and execute arbitrary commands as root. telnetd.real is shipped with setuid permissions enabled and is …
-
High 7.4
Junos OS: Upon receipt of certain protocol packets with invalid payloads a self-propagating Denial of Service may occur.
A vulnerability in Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the device by sending certain crafted protocol packets from an adjacent device with invalid payloads to the device. These crafted packets, which should be di…
-
High 7.8
Junos OS: Command injection vulnerability in license-check daemon
A command injection vulnerability in the license-check daemon of Juniper Networks Junos OS that may allow a locally authenticated attacker with low privileges to execute commands with root privilege. license-check is a daemon used to manage licenses in Junos …
-
High 7.4
Junos OS: EX Series and QFX Series: Memory leak issue processing specific DHCP packets
A vulnerability in processing of certain DHCP packets from adjacent clients on EX Series and QFX Series switches running Juniper Networks Junos OS with DHCP local/relay server configured may lead to exhaustion of DMA memory causing a Denial of Service (DoS). …
-
High 8.8
Junos OS and Junos OS Evolved: In bidirectional LSP configurations, on MPLS egress router RPD may core upon receipt of specific malformed RSVP packet.
An improper input validation vulnerability in the Routing Protocol Daemon (RPD) service of Juniper Networks Junos OS allows an attacker to send a malformed RSVP packet when bidirectional LSPs are in use, which when received by an egress router crashes the RPD…
-
High 7.5
NFX250, NFX350, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series: Certain genuine traffic received by the Junos OS device will be discarded instead of forwarded.
An improper interpretation conflict of certain data between certain software components within the Juniper Networks Junos OS devices does not allow certain traffic to pass through the device upon receipt from an ingress interface filtering certain specific ty…
-
High 7.5
Junos OS: NFX Series, SRX Series: PFE may crash upon receipt of specific packet when SSL Proxy is configured.
A NULL Pointer Dereference vulnerability in Juniper Networks Junos OS allows an attacker to send a specific packet causing the packet forwarding engine (PFE) to crash and restart, resulting in a Denial of Service (DoS). By continuously sending these specific …
-
High 8.6
Junos OS: EX and QFX5K Series: Storm Control does not work as expected when Redundant Trunk Group is configured
On Juniper Networks EX and QFX5K Series platforms configured with Redundant Trunk Group (RTG), Storm Control profile applied on the RTG interface might not take affect when it reaches the threshold condition. Storm Control enables the device to monitor traffi…
-
High 7.8
Junos OS: dexp Local Privilege Escalation vulnerabilities in SUID binaries
A sensitive information disclosure vulnerability in delta-export configuration utility (dexp) of Juniper Networks Junos OS may allow a locally authenticated shell user the ability to create and read database files generated by the dexp utility, including pass…
-
High 7.5
Junos OS: MX Series, EX9200 Series: Trio-based MPC memory leak when Integrated Routing and Bridging (IRB) interface is mapped to a VPLS instance or a Bridge-Domain
On Juniper Networks MX Series and EX9200 Series platforms with Trio-based MPC (Modular Port Concentrator) where Integrated Routing and Bridging (IRB) interface is configured and it is mapped to a VPLS instance or a Bridge-Domain, certain network events at Cus…