Archive
January 2021
Vulnerabilities first published in this month (UTC), newest first.
375 results · Clear filters · Feed
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions…
-
Medium 4.3
Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Proxy User Delegation). Supp…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PAM Auth Plugin). Supported versions that…
-
Medium 5.9
Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are …
-
Medium 5.0
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: RAS subsystems). The suppor…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are…
-
Medium 4.3
Vulnerability in the Siebel Core - Server BizLogic Script product of Oracle Siebel CRM (component: Integration - Script…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 5.4
Vulnerability in the Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics…
-
Medium 5.3
Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are …
-
Medium 4.7
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: BI…
-
Medium 6.5
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported ve…
-
Medium 4.8
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12…
-
Medium 6.3
Command Injection
This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection.
-
Medium —
Cross Site Scripting (XSS) in XWiki
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section.
-
Medium 5.4
Gravity Forms stored HTML injection vulnerability
Multiple stored HTML injection vulnerabilities in the "poll" and "quiz" features in an additional paid add-on of Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary HTML code via poll or quiz answers. This code is interpreted …
-
Medium 5.4
Gravity Forms stored Cross-Site Scripting (XSS) vulnerability in the survey feature
A stored Cross-Site Scripting (XSS) vulnerability in the survey feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via a textarea field. This code is interpreted by users in a privileged role (Ad…
-
Medium 4.8
Gravity Forms stored Cross-Site Scripting (XSS) vulnerability
A stored Cross-Site Scripting (XSS) vulnerability in forms import feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via the import of a GF form. This code is interpreted by users in a privileged…
-
Medium 5.9
IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the lack of server …
-
Medium 5.3
IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS pol…
-
Medium 4.0
IBM Planning Analytics 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X…
-
Medium 5.9
Cross-site Request Forgery (CSRF)
This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path: '/', sameSite: true } 2. The CSRF token was available in the GET query parameter
-
Medium 5.9
Denial of Service (DoS)
The package jointjs before 3.3.0 are vulnerable to Denial of Service (DoS) via the unsetByPath function.
-
Medium 5.3
Insecure Defaults
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
-
Medium 5.3
HGiga OAKloud Portal - Security Misconfiguration
HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions.
-
Medium 5.5
Improper Authorization vulnerability in MA
Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detectio…
-
Medium 6.8
Web Cache Poisoning
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the req…
-
Medium 6.8
Junos Space: Shared secrets stored in recoverable format and directly exposed through the UI
The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who is able to execute arbitrary code in the victim browser (for example via XSS) or access cached conte…
-
Medium 6.5
Junos OS: QFX Series: Traffic loop Denial of Service (DoS) upon receipt of specific IP multicast traffic
In an EVPN/VXLAN scenario, if an IRB interface with a virtual gateway address (VGA) is configured on a PE, a traffic loop may occur upon receipt of specific IP multicast traffic. The traffic loop will cause interface traffic to increase abnormally, ultimately…
-
Medium 6.7
Junos OS: Command injection vulnerability in 'request system software' CLI command
A command injection vulnerability in install package validation subsystem of Juniper Networks Junos OS that may allow a locally authenticated attacker with privileges to execute commands with root privilege. To validate a package in Junos before installation,…
-
Medium 6.5
Junos OS: EX Series, QFX Series, SRX Branch Series, MX Series: Memory leak in packet forwarding engine due to 802.1X authenticator port interface flaps
On Juniper Networks Junos EX series, QFX Series, MX Series and SRX branch series devices, a memory leak occurs every time the 802.1X authenticator port interface flaps which can lead to other processes, such as the pfex process, responsible for packet forward…
-
Medium 5.0
Contrail Networking: Administrator credentials are exposed in a plaintext file
An Information Exposure vulnerability in Juniper Networks Contrail Networking allows a locally authenticated attacker able to read files to retrieve administrator credentials stored in plaintext thereby elevating their privileges over the system. This issue a…
-
Medium 6.5
Junos OS Evolved: Receipt of certain valid BGP update packets from BGP peers may cause RPD to core when using REGEX.
In Juniper Networks Junos OS Evolved an attacker sending certain valid BGP update packets may cause Junos OS Evolved to access an uninitialized pointer causing RPD to core leading to a Denial of Service (DoS). Continued receipt of these types of valid BGP upd…
-
Medium 6.8
Junos OS: Privilege escalation in J-Web due to arbitrary command and code execution via information disclosure from another users active session
An Information Exposure vulnerability in J-Web of Juniper Networks Junos OS allows an unauthenticated attacker to elevate their privileges over the target system through opportunistic use of an authenticated users session. This issue affects: Juniper Networks…
-
Medium 5.8
Junos OS: MX Series: Dynamic filter fails to match IPv6 prefix
When the "Intrusion Detection Service" (IDS) feature is configured on Juniper Networks MX series with a dynamic firewall filter using IPv6 source or destination prefix, it may incorrectly match the prefix as /32, causing the filter to block unexpected traffic…
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is w…
-
Medium 5.3
An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed meth…
-
Medium 5.3
An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project…
-
Medium 4.3
A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting…