Archive
January 2021
Vulnerabilities first published in this month (UTC), newest first.
1,527 results · Feed
-
Unscored —
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementat…
-
Unscored —
A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perfo…
-
Unscored —
Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code ('Code Injection') by…
-
Unscored —
Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to r…
-
Unscored —
A missing file type check in Nextcloud Contacts 3.3.0 allows a malicious user to upload malicious SVG files to perform …
-
Unscored —
oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw …
-
Unscored —
A misconfiguration in Web-Sesame 2020.1.1.3375 allows an unauthenticated attacker to download the source code of the ap…
-
Low —
Regex denial of service vulnerability in codesample plugin
### Impact A regex denial of service (ReDoS) vulnerability was discovered in a dependency of the `codesample` plugin. The vulnerability allowed poorly formed ruby code samples to lock up the browser while performing syntax highlighting. This impacts users of …
-
Medium 5.7
Regular Expression Denial of Service in CairoSVG
CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular …
-
Unscored —
Zoho ManageEngine Desktop Central 10.0.430 allows HTML injection via a modified Report Name in a New Custom Report.
-
Unscored —
SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket.
-
Unscored —
RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds write for certain relationships between …
-
Medium 5.3
An attacker could send a specially crafted message to Crimson 3.1 (Build versions prior to 3119.001) that could leak ar…
-
High 7.5
A NULL pointer deference vulnerability has been identified in the protocol converter. An attacker could send a speciall…
-
Medium 6.5
The default configuration of Crimson 3.1 (Build versions prior to 3119.001) allows a user to be able to read and modify…
-
High 8.8
An exploitable signed conversion vulnerability exists in the TextMaker document parsing functionality of SoftMaker Offi…
-
High 8.8
An exploitable sign extension vulnerability exists in the TextMaker document parsing functionality of SoftMaker Office …
-
Unscored —
The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password re…
-
Unscored —
The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make…
-
Unscored —
The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.
-
Unscored —
The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.
-
Unscored —
The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.
-
Unscored —
The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, …
-
Unscored —
The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads.
-
Unscored —
MendixSSO <= 2.1.1 contains endpoints that make use of the openid handler, which is suffering from a Cross-Site Scripti…
-
Unscored —
The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms.
-
Unscored —
rcdsvc in the Proofpoint Insider Threat Management Windows Agent (formerly ObserveIT Windows Agent) before 7.9 allows r…
-
Unscored —
The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in th…
-
Unscored —
The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in th…
-
Unscored —
The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in th…
-
Unscored —
The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in th…
-
Low 3.7
IBM WebSphere eXtreme Scale 8.6.1 stores sensitive information in URL parameters. This may lead to information disclosu…
-
Critical 9.8
Arbitrary code execution in clickhouse-driver
clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, due to a buffer overflow.
-
Medium 5.7
Infinite loop in parsing PNG files in
kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::read_from_container can cause an infinite loop when a crafted PNG file is given. This is…
-
Critical 9.3
An issue was discovered in Veritas System Recovery before 21.2. On start-up, it loads the OpenSSL library from \usr\loc…
-
Unscored —
An issue was discovered in Veritas APTARE 10.4 before 10.4P9 and 10.5 before 10.5P3. By default, on Windows systems, us…
-
Critical 9.3
An issue was discovered in Veritas CloudPoint before 8.3.0.1+hotfix. The CloudPoint Windows Agent leverages OpenSSL. Th…
-
Critical 9.3
An issue was discovered in Veritas NetBackup and OpsCenter through 8.3.0.1. NetBackup processes using Strawberry Perl a…
-
Critical 9.3
An issue was discovered in Veritas Enterprise Vault through 14.0. On start-up, it loads the OpenSSL library. The OpenSS…
-
Critical 9.3
An issue was discovered in Veritas Desktop and Laptop Option (DLO) before 9.4. On start-up, it loads the OpenSSL librar…