Archive
January 2021
Vulnerabilities first published in this month (UTC), newest first.
1,527 results · Feed
-
Unscored —CVE-2020-24577 EPSS 19%
An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The One Touch applicati…
-
Unscored —
Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir para…
-
Unscored —
NVIDIA GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) h…
-
Unscored —
NVIDIA GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) h…
-
High 8.4
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for Dxgk…
-
Unscored —CVE-2021-1056 Public exploit
NVIDIA GPU Display Driver for Linux, all versions, contains a vulnerability in the kernel mode layer (nvidia.ko) in whi…
-
Unscored —
NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvldd…
-
Unscored —
NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvldd…
-
High 7.5
Resource exhaustion in engine.io
Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
-
High 7.5
Resource exhaustion in socket.io-parser
socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
-
Unscored —
A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1 allows an attacker to read any co…
-
Unscored —
A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and…
-
Unscored —
An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to ove…
-
Unscored —
In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg) potentially allow an attacker to…
-
Unscored —
Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro before 3.8 allows Command Injection (issue 1 o…
-
Unscored —
Rock RMS version before 8.6 is vulnerable to account takeover by tampering with the user ID parameter in the profile up…
-
Unscored —
Rock RMS versions before 8.10 and versions 9.0 through 9.3 fails to properly validate files uploaded in the application…
-
Unscored —
PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows atta…
-
Unscored —
MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI …
-
Unscored —
MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server, as demonstrated by the /../..…
-
Unscored —
The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of h…
-
Medium 5.9
IBM Emptoris Strategic Supply Management 10.1.3 uses weaker than expected cryptographic algorithms that could allow an …
-
Medium 5.3
IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attack…
-
Medium 6.5
IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3 is vulnerable to web cache poisoning, caused by improper input validat…
-
Medium 5.9
IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 transmits sensitive information in HTTP GET request…
-
Medium 6.4
IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. This …
-
Medium 5.4
IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
-
Unscored —
The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of h…
-
Unscored —
A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore…
-
High 7.5
A denial-of-service vulnerability exists in the Ethernet/IP server functionality of Rockwell Automation RSLinx Classic …
-
Unscored —
A use after free in the Linux kernel infiniband hfi1 driver in versions prior to 5.10-rc6 was found in the way user cal…
-
Medium 5.8
File parsing Type Confusion Remote code execution vulerability
Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user upload a malformed .E70 file in t…
-
Medium 5.8
File parsing Out-Of-Bounds read remote code execution
The Eaton's easySoft software v7.xx prior to v7.22 are susceptible to Out-of-bounds remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user to upload the malformed .E70 file in the ap…
-
Unscored —
Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can c…
-
Unscored —
Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a race condition that can cause a stack-b…
-
Unscored —
Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCheckLicence race condition that c…
-
Unscored —
Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyPreviewAction race condition that …
-
Unscored —
Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can c…
-
Unscored —
Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCPDFAction race condition that can…
-
Unscored —
Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can c…