Archive
January 2021
Vulnerabilities first published in this month (UTC), newest first.
365 results · Clear filters · Feed
-
High 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
Remote Procedure Call Runtime Remote Code Execution Vulnerability
-
High 8.8
Windows Remote Desktop Protocol Core Security Feature Bypass Vulnerability
Windows Remote Desktop Protocol Core Security Feature Bypass Vulnerability
-
High 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
Remote Procedure Call Runtime Remote Code Execution Vulnerability
-
High 8.8
Windows Remote Desktop Security Feature Bypass Vulnerability
Windows Remote Desktop Security Feature Bypass Vulnerability
-
High 7.8
Microsoft DTV-DVD Video Decoder Remote Code Execution Vulnerability
Microsoft DTV-DVD Video Decoder Remote Code Execution Vulnerability
-
High 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
Remote Procedure Call Runtime Remote Code Execution Vulnerability
-
High 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
Remote Procedure Call Runtime Remote Code Execution Vulnerability
-
High 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
Remote Procedure Call Runtime Remote Code Execution Vulnerability
-
High 7.8
GDI+ Remote Code Execution Vulnerability
GDI+ Remote Code Execution Vulnerability
-
High 7.8
Windows Event Tracing Elevation of Privilege Vulnerability
Windows Event Tracing Elevation of Privilege Vulnerability
-
High 7.8
Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
-
High 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
Remote Procedure Call Runtime Remote Code Execution Vulnerability
-
High 7.8
Windows CSC Service Elevation of Privilege Vulnerability
Windows CSC Service Elevation of Privilege Vulnerability
-
High 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
Remote Procedure Call Runtime Remote Code Execution Vulnerability
-
High 7.8
Windows Fax Compose Form Remote Code Execution Vulnerability
Windows Fax Compose Form Remote Code Execution Vulnerability
-
High 7.8
Windows CSC Service Elevation of Privilege Vulnerability
Windows CSC Service Elevation of Privilege Vulnerability
-
High 7.8
Windows CSC Service Elevation of Privilege Vulnerability
Windows CSC Service Elevation of Privilege Vulnerability
-
High 7.8
Windows CSC Service Elevation of Privilege Vulnerability
Windows CSC Service Elevation of Privilege Vulnerability
-
High 7.8
Windows CSC Service Elevation of Privilege Vulnerability
Windows CSC Service Elevation of Privilege Vulnerability
-
High 7.8
Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability
Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability
-
High 7.8
Windows Runtime C++ Template Library Elevation of Privilege Vulnerability
Windows Runtime C++ Template Library Elevation of Privilege Vulnerability
-
High 7.8
Active Template Library Elevation of Privilege Vulnerability
Active Template Library Elevation of Privilege Vulnerability
-
High 7.8
Microsoft splwow64 Elevation of Privilege Vulnerability
Microsoft splwow64 Elevation of Privilege Vulnerability
-
High 7.8
Microsoft Defender Remote Code Execution Vulnerability
Microsoft Defender Remote Code Execution Vulnerability
KEV Nov 3, 2021 -
High 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
HEVC Video Extensions Remote Code Execution Vulnerability
-
High 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
HEVC Video Extensions Remote Code Execution Vulnerability
-
High 7.8
Windows AppX Deployment Extensions Elevation of Privilege Vulnerability
Windows AppX Deployment Extensions Elevation of Privilege Vulnerability
-
High 7.7
Windows Bluetooth Security Feature Bypass Vulnerability
Microsoft is aware of the "Impersonation in the Passkey Entry Protocol" vulnerability. For more information regarding the vulnerability, please see this statement from the Bluetooth SIG. To address the vulnerability, Microsoft has released a softwar…
-
High 8.8CVE-2021-1636 Public exploit
Microsoft SQL Elevation of Privilege Vulnerability
Microsoft SQL Elevation of Privilege Vulnerability
-
High 7.7
Information disclosure vulnerability in iTop
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access…
-
High 7.1
TIBCO EBX EXML External Entity
The TIBCO EBX Add-on for Oracle Hyperion EPM, TIBCO EBX Data Exchange Add-on, and TIBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-ons contain a vulnerability that theoretically allows a low privileged attacker with network access to…
-
High 7.5
SAP NetWeaver AS ABAP, versions 740, 750, 751, 752, 753, 754, 755, allows an unauthenticated attacker to prevent legiti…
-
High 7.8
ClusterLabs crmsh vulnerable to shell code injection
An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalation of privileges.
-
High 8.8
Pillow Out-of-bounds Write
In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.
-
High 7.1
Pillow Out-of-bounds Read
In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.
-
High 7.4
CSRF can expose users authentication token in Flask-Security-Too
The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and…
-
High 8.8
Cross-Site Request Forgery in ForkCMS
Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass of the user's comments, (2) restoring a deleted user, (3) ins…
-
High 7.0
Improper synchronization in Apache Netbeans HTML/Java API
There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject of HTML/Java API version 1.7. A similar vulnerability has recently been disclosed in other Java projects and the fix in…
-
High 8.8
In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authenti…
-
High 7.2
Command Injection Vulnerability in QTS and QuTS hero
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions…