Archive
January 2021
Vulnerabilities first published in this month (UTC), newest first.
1,527 results · Feed
-
Unscored —
Delta Electronics DOPSoft Version 4.0.8.21 and prior is vulnerable to an out-of-bounds write while processing project f…
-
Unscored —
Delta Electronics DOPSoft Version 4.0.8.21 and prior has a null pointer dereference issue while processing project file…
-
High 8.8
In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authenti…
-
Unscored —
AnyDesk before 6.1.0 on Windows, when run in portable mode on a system where the attacker has write access to the appli…
-
High 7.2
Command Injection Vulnerability in QTS and QuTS hero
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions…
-
Unscored —
A blind SQL injection vulnerability exists in zzcms ver201910 based on time (cookie injection).
-
Medium 6.1
Cross-site Scripting in jsoneditor
Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.
-
Unscored —
XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg={XSS] to Home/c/ErrorController.php.
-
Unscored —
XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr={XSS] to Home/c/WechatController.php.
-
Unscored —
A stack overflow vulnerability in Aleth Ethereum C++ client version <= 1.8.0 using a specially crafted a config.json fi…
-
Unscored —
ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or…
-
Unscored —
The ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please upgrade. Apache Traffic …
-
Critical 9.8
Apache Dubbo default deserialization protocol Hessian2 cause CRE
A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object…
-
Medium 6.5
Apache DolphinScheduler (incubating) Permission vulnerability
Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.
-
High 8.6
Improper Input Validation in GoGo Protobuf
An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.
-
Unscored —
EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has multiple SQL Injection issues in the login form and the passw…
-
High 7.5
Logic error in authentication in proxy.py
before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).
-
Unscored —
Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via…
-
Unscored —
Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via…
-
Unscored —
Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via…
-
Unscored —
Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via…
-
Unscored —
Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via…
-
Unscored —
CSRF in Web Compliance Manager in Quest Policy Authority 8.1.2.200 allows remote attackers to force user modification/c…
-
Unscored —
Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via…
-
Unscored —
Stored XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to store malicious code in multiple fields (firs…
-
Unscored —
Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via…
-
Unscored —
Reflected XSS in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser vi…
-
Unscored —
Server Side Request Forgery (SSRF) in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attacke…
-
Unscored —
Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject maliciou…
-
Unscored —
Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject maliciou…
-
Medium 6.8
Injection in Redcarpet
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This …
-
Unscored —CVE-2020-5147 Public exploit
SonicWall NetExtender Windows client vulnerable to unquoted service path vulnerability, this allows a local attacker to…
-
Unscored —
A vulnerability in SonicWall SMA100 appliance allow an authenticated management-user to perform OS command injection us…
-
Medium 5.4
IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Medium 5.4
IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Medium 4.3
IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical er…
-
Medium 4.6
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Medium 4.3
IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical er…
-
Medium 5.3
IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which c…
-
Medium 4.0
IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a …