Archive
January 2021
Vulnerabilities first published in this month (UTC), newest first.
1,527 results · Feed
-
Unscored —
Uninitialized pointers accessed during music play back with incorrect bit stream due to an uninitialized heap memory re…
-
Unscored —
Integer multiplication overflow resulting in lower buffer size allocation than expected causes memory access out of bou…
-
Unscored —
Buffer over-read can happen when the buffer length received from response handlers is more than the size of the payload…
-
Unscored —
Buffer Over-read in audio driver while using malloc management function due to not returning NULL for zero sized memory…
-
Unscored —
bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin d…
-
Critical 9.8
OS Command Injection in async-git
The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag.
-
Unscored —
phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports.
-
Unscored —CVE-2021-3164 Public exploit
ChurchRota 2.6.4 is vulnerable to authenticated remote code execution. The user does not need to have file upload permi…
-
Unscored —
In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtu…
-
Unscored —
IBM InfoSphere Information Server 8.5.0.0 is affected by deserialization of untrusted data which could allow remote una…
-
High 8.8
CakePHP allows method override parameters to bypass CSRF checks
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request method…
-
Unscored —
openMAINT before 1.1-2.4.2 allows remote authenticated users to run arbitrary JSP code on the underlying web server.
-
Unscored —CVE-2020-27735 Scanner template
An XSS issue was discovered in Wing FTP 6.4.4. An arbitrary IFRAME element can be included in the help pages via a craf…
-
Unscored —
NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the NVHost function, which may lead to abnor…
-
Unscored —
NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the implementation of the RPMB command statu…
-
Unscored —
NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the NVDEC component, in which an attacker ca…
-
Medium 5.8
Weave Net Pods running in host PID namespace can be used to escalate other Kubernetes vulnerabilities
Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. Weave Net before version 2.8.0 has a vulnerability in which can allow an attacker to take over any h…
-
High 8.7
Layout XML RCE Vulnerability in OpenMage
OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to …
-
Unscored —
A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetH…
-
Medium 4.6
Cisco Data Center Network Manager REST API Vulnerabilities
Multiple vulnerabilities in the REST API endpoint of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to view, modify, and delete data without proper authorization. For more information about these vulnerabilities, see th…
-
Critical 9.8
Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities
Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the Detail…
-
Critical 9.8
Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities
Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the Detail…
-
Critical 9.8
Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities
Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the Detail…
-
Critical 9.8
Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities
Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the Detail…
-
Critical 9.8
Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities
Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the Detail…
-
Medium 4.6
Cisco Smart Software Manager Satellite Open Redirect Vulnerability
A vulnerability in the web management interface of Cisco Smart Software Manager satellite could allow an authenticated, remote attacker to redirect a user to an undesired web page. The vulnerability is due to improper input validation of the URL parameters in…
-
High 7.8
Cisco Smart Software Manager Satellite Static Credential Vulnerability
A vulnerability in Cisco Smart Software Manager Satellite could allow an authenticated, local attacker to access sensitive information on an affected system. The vulnerability is due to insufficient protection of static credentials in the affected software. A…
-
Medium 6.8
Cisco Smart Software Manager Satellite SQL Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Smart Software Manager Satellite could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management int…
-
Medium 6.5
Cisco SD-WAN vManage SQL Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities exist because the web-based managemen…
-
Medium 6.5
Cisco Data Center Network Manager Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow a remote attacker with network-operator privileges to conduct a cross-site scripting (XSS) attack or a reflected file download (RFD) attack …
-
Medium 6.5
Cisco Data Center Network Manager Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow a remote attacker with network-operator privileges to conduct a cross-site scripting (XSS) attack or a reflected file download (RFD) attack …
-
High 8.8
Cisco Data Center Network Manager SQL Injection Vulnerabilities
Multiple vulnerabilities in certain REST API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. For more information about these vulnerabilities, see the…
-
High 8.8
Cisco Data Center Network Manager SQL Injection Vulnerabilities
Multiple vulnerabilities in certain REST API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. For more information about these vulnerabilities, see the…
-
High 8.6
Cisco SD-WAN Denial of Service Vulnerabilities
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
-
Medium 5.5
Cisco SD-WAN vManage Information Disclosure Vulnerability
A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to read sensitive database files on an affected system. The vulnerability is due to insufficient user authorization. An attacker could exploit this vulner…
-
Medium 4.4
Cisco SD-WAN Information Disclosure Vulnerability
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information on an affected device. The vulnerability is due to insufficient input validation of requests that are sent to the iperf tool. An a…
-
Medium 6.5
Cisco Data Center Network Manager Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow a remote attacker with network-operator privileges to conduct a cross-site scripting (XSS) attack or a reflected file download (RFD) attack …
-
High 8.8
Cisco SD-WAN vManage Authorization Bypass Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization and modify the configuration of an affected system, gain access to sensitive information, and…
-
Medium 5.3
Cisco Elastic Services Controller Denial of Service Vulnerability
A vulnerability in the system resource management of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) to the health monitor API on an affected device. The vulnerability is due to inadeq…
-
Medium 6.5
Cisco SD-WAN vManage Cypher Query Language Injection Vulnerability
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query language injection attacks on an affected system. The vulnerability is due to insufficient input valid…