Archive
1 February 2021
Vulnerabilities first published on this day (UTC), newest first.
49 results · Feed
-
Unscored —
Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information D…
-
Unscored —
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they s…
-
Unscored —
FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUp…
-
Unscored —
A cross-site scripting (XSS) vulnerability in many forms of Wikindx before 5.7.0 and 6.x through 6.4.0 allows remote at…
-
Unscored —
An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It has unnecessary perm…
-
Medium 6.8
An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. Any SIM card used with the device cann…
-
High 7.8
An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. When using the device at initial setup…
-
High 7.5
An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It performs actions based on certain S…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. T…
-
Unscored —
Unrestricted file upload vulnerability in the yccms 3.3 project. The xhUp function's improper judgment of the request p…
-
Unscored —
Sql injection vulnerability in the yccms 3.3 project. The no_top function's improper judgment of the request parameters…
-
Unscored —
Directory traversal vulnerability in the yccms 3.3 project. The delete, deletesite, and deleteAll functions' improper j…
-
Unscored —
An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance par…
-
Unscored —
An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail parame…
-
Unscored —
An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicio…
-
Unscored —
Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the n…
-
Unscored —
Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the n…
-
Critical 9.8
SQL Injection in thinkjs
SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter.
-
High 7.7CVE-2021-21287 EPSS 24%
Server-Side Request Forgery in MinIO Browser API
MinIO is a High Performance Object Storage released under Apache License v2.0. In MinIO before version RELEASE.2021-01-30T00-20-58Z there is a server-side request forgery vulnerability. The target application may have functionality for importing data from a U…
-
Unscored —
HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invali…
-
Unscored —
HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP req…
-
High 7.5
Improper Authentication in HashiCorp Vault
HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.
-
High 7.5
Improper Privilege Management in HashiCorp Nomad
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
-
High 7.3
Command Injection
All versions of package kill-process-on-port are vulnerable to Command Injection via a.getProcessPortId.
-
High 7.7
Authorization Bypass in AVideo Platform
AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in ver…
-
Critical 9.6CVE-2020-13564 EPSS 76%
A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP re…
-
Critical 9.6CVE-2020-13563 EPSS 76%
A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP re…
-
High 8.5
Angular Expressions - Remote Code Execution
angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call "expressions.compile(userControlledIn…
-
Critical 9.6CVE-2020-13562 EPSS 78%
A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP re…
-
Critical 9.8
Command Injection
All versions of package launchpad are vulnerable to Command Injection via stop.
-
Medium 6.4
XXE vulnerability in OpenHAB
openHAB is a vendor and technology agnostic open source automation software for your home. In openHAB before versions 2.5.12 and 3.0.1 the XML external entity (XXE) attack allows attackers in the same network as the openHAB instance to retrieve internal infor…
-
Unscored —
A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/rbacuser/i…
-
Unscored —CVE-2020-36109 Public exploit
ASUS RT-AX86U router firmware below version under 9.0.0.4_386 has a buffer overflow in the blocking_request.cgi functio…
-
Unscored —
Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length fi…
-
Unscored —
deleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason parameter.
-
Unscored —
GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted k…
-
Unscored —
nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could…
-
Unscored —
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. They contain two undocumented…
-
Unscored —
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function passes untruste…
-
Unscored —
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function contains undocu…