Archive
January 2021
Vulnerabilities first published in this month (UTC), newest first.
1,527 results · Feed
-
Medium 4.7
IBM Cloud Pak System 2.3 has insufficient logout controls which could allow an authenticated privileged user to imperso…
-
Low 2.3
IBM Cloud Pak System 2.3 could allow l local privileged user to disclose sensitive information due to an insecure direc…
-
Medium 4.3
IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious…
-
Medium 5.5
IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Java…
-
Medium 4.4
IBM Cloud Pak System 2.3 could reveal credential information in the HTTP response to a local privileged user. IBM X-For…
-
Medium 4.7
IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the user request URL when…
-
Medium 4.8
IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Java…
-
Medium 4.8
IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Java…
-
Unscored —
interfaces2 is unmaintained, use interfaces instead
The `interfaces2` crate is not maintained any more; use [`interfaces`](https://crates.io/crates/interfaces) instead.
-
Critical 9.8
Remote Code Execution (RCE)
This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.
-
High 7.5
Prototype Pollution
The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function.
-
Unscored —
SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field.
-
Unscored —
SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket.
-
Critical 9.8
Remote code execution in zendframework and laminas-http
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.…
-
Unscored —
MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the central/executar_central.php?acao=altsenha_princ UR…
-
Unscored —
MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter. An attacker can leverage this to read…
-
Unscored —
decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when t…
-
Medium 5.9
The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequ…
-
Unscored —
track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing.
-
Unscored —
flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the corre…
-
Unscored —
The sellTokenForLRC function in the vault protocol in the smart contract implementation for Loopring (LRC), an Ethereum…
-
Unscored —
The breed function in the smart contract implementation for Farm in Seal Finance (Seal), an Ethereum token, lacks acces…
-
Unscored —
MyDrivers64.sys in DriverGenius 9.61.3708.3054 allows attackers to cause a system crash via the ioctl command 0x9c40200…
-
Unscored —
login.php in PHPFusion (aka PHP-Fusion) Andromeda 9.x before 2020-12-30 generates error messages that distinguish betwe…
-
Unscored —
MK-AUTH through 19.01 K4.9 allows remote attackers to obtain sensitive information (e.g., a CPF number) via a modified …
-
Unscored —
The _deposit function in the smart contract implementation for Stable Yield Credit (yCREDIT), an Ethereum token, has ce…
-
Unscored —
In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while process…
-
Unscored —
In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- exte…
-
Unscored —CVE-2021-3002 Scanner template
Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter.
-
Unscored —CVE-2020-35717 Public exploit
zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution (because nodeIntegration in we…
-
High 8.8
An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. The pagelayer_settings_page function is vul…
-
Critical 9.9
An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authen…
-
Medium 5.4
An issue was discovered in the All in One SEO Pack plugin before 3.6.2 for WordPress. The SEO Description and Title fie…
-
High 7.4
An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. Nearly all of the AJAX action endpoints lac…
-
Critical 9.9
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated att…
-
Critical 10.0
An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made it possible for unauth…
-
Critical 9.8
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress. It allows CSRF (via almo…
-
Critical 9.9
An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbi…
-
High 7.5
PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticate…
-
High 7.5
PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated att…