Archive
January 2021
Vulnerabilities first published in this month (UTC), newest first.
375 results · Clear filters · Feed
-
Medium 5.0
Windows Docker Information Disclosure Vulnerability
Windows Docker Information Disclosure Vulnerability
-
Medium 4.6
Microsoft SharePoint Server Spoofing Vulnerability
Microsoft SharePoint Server Spoofing Vulnerability
-
Medium 5.5
Windows DNS Query Information Disclosure Vulnerability
Windows DNS Query Information Disclosure Vulnerability
-
Medium 6.1
rails_admin ruby gem XSS vulnerability
RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms.
-
Medium 4.3
IBM Workload Automation 9.5 stores the server path in URLs that could aid in further attacks against the system. IBM X-…
-
Medium 6.4
IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to stored cross-site scripting. This vulnerability allows users …
-
Medium 4.3
IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the…
-
Medium 5.3
When security guidelines for SAP NetWeaver Master Data Management running on windows have not been thoroughly reviewed,…
-
Medium 5.4
SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated da…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted source…
-
Medium 4.3
SAP Banking Services (Generic Market Data) does not perform necessary authorization checks for an authenticated user, r…
-
Medium 6.5
The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escal…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted source…
-
Medium 5.4
SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malic…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted source…
-
Medium 5.3
SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend …
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SGI file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted source…
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted source…
-
Medium 6.5
In CLA-Assistant, versions before 2.8.5, due to improper access control an authenticated user could access API endpoint…
-
Medium 5.4
Pillow Out-of-bounds Read
In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.
-
Medium 5.9
A denial-of-service vulnerability exists in the traffic-logging functionality of FreyrSCADA IEC-60879-5-104 Server Simu…
-
Medium 5.3
Improper Certificate Validation in node-sass
Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path.
-
Medium 5.3
IBM MQ Appliance 9.2 CD and 9.2 LTS is vulnerable to a denial of service, caused by a buffer overflow. A remote attacke…
-
Medium 5.9
RSA decryption vulnerable to Bleichenbacher timing vulnerability
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.
-
Medium 6.1
Cross-site Scripting in jsoneditor
Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.
-
Medium 6.5
Apache DolphinScheduler (incubating) Permission vulnerability
Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.
-
Medium 6.8
Injection in Redcarpet
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This …
-
Medium 5.4
IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Medium 5.4
IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…