Skip to content
OpenAdvisories

Archive

2 February 2021

Vulnerabilities first published on this day (UTC), newest first.

← January 2021 2021 / February /2 March 2021 →
  1. 149
  2. 254
  3. 363
  4. 4117
  5. 538
  6. 616
  7. 76
  8. 878
  9. 9145
  10. 10114
  11. 1196
  12. 1249
  13. 132
  14. 147
  15. 1540
  16. 1655
  17. 17112
  18. 1838
  19. 1944
  20. 201
  21. 215
  22. 2266
  23. 2362
  24. 2441
  25. 2574
  26. 2674
  27. 2717
  28. 281
All Critical High Medium Low Exploited only Public exploit

54 results · Feed

  • High 7.2
    GHSA-x7p5-p2c9-phvg

    Unexpected database bindings

    This is a follow-up to the previous security advisory (GHSA-3p32-j457-pg5x) which addresses a few additional edge cases. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expec…

    laravel/framework illuminate/database Packagist
  • Medium 4.3
    CVE-2020-4934

    IBM Content Navigator 3.0.CD could allow a remote attacker to traverse directories on the system. An attacker could sen…

    IBM Content Navigator
  • Unscored —
    CVE-2021-25310

    The administration web interface on Belkin Linksys WRT160NL 1.0.04.002_US_20130619 devices allows remote authenticated …

  • Unscored —
    CVE-2020-18568 EPSS 15%

    The D-Link DSR-250 (3.14) DSR-1000N (2.11B201) UPnP service contains a command injection vulnerability, which can cause…

  • Critical 9.8
    CVE-2020-25506 Exploited Scanner template EPSS 100%

    D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead…

    KEV Nov 3, 2021
  • Medium 6.9
    CVE-2020-8101

    Command execution due to unsanitized input in LifeShield DIY HD Video Doorbell

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in HTTP interface of ADT LifeShield DIY HD Video Doorbell allows an attacker on the same network to execute commands on the device. This issue affects: ADT LifeS…

    ADT LifeShield DIY HD Video Doorbell
  • High 8.6
    CVE-2020-28494

    Command Injection

    This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is cal…

    total.js npm
  • High 7.3
    CVE-2020-28495

    Prototype Pollution

    This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact de…

    total.js npm
  • Unscored —
    CVE-2020-1896

    A stack overflow vulnerability in Facebook Hermes 'builtin apply' prior to commit 86543ac47e59c522976b5632b8bf9a2a4583c…

    Facebook Hermes
  • Medium 5.3
    CVE-2021-3281 Public exploit

    Django Directory Traversal via archive.extract

    In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with do…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Unscored —
    CVE-2020-24335

    An issue was discovered in uIP through 1.0, as used in Contiki and Contiki-NG. Domain name parsing lacks bounds checks,…

  • Unscored —
    CVE-2020-25035

    UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with root privileges using chroothole_client's PHP call, a…

  • Unscored —
    CVE-2020-25036

    UCOPIA Wi-Fi appliances 6.0.5 allow authenticated remote attackers to escape the restricted administration shell CLI, a…

  • Unscored —
    CVE-2020-25037

    UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with admin user privileges via an escape from a restricted…