Archive
3 February 2021
Vulnerabilities first published on this day (UTC), newest first.
63 results · Feed
-
Unscored —CVE-2021-26024 EPSS 19%
The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to Insecure Direct Object Reference: it is possi…
-
Unscored —CVE-2021-26023 EPSS 25%
The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS.
-
Critical 9.8
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perfor…
KEV Nov 3, 2021 -
Unscored —
A username enumeration issue was discovered in SquaredUp before version 4.6.0. The login functionality was implemented …
-
Medium 4.4
Insecure Temporary File
This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between user…
-
Unscored —
Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Admin…
-
Unscored —
Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthori…
-
Unscored —
Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthori…
-
Unscored —CVE-2020-18724 Public exploit
Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 1…
-
Unscored —CVE-2020-18723 Public exploit
Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code…
-
Unscored —
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pa…
-
Critical 9.8
Authentication bypass in Apache Shiro
Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
-
Unscored —CVE-2021-25274 EPSS 36%
The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set …
-
Unscored —
The function CheckMic() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and exclud…
-
Unscored —
The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and …
-
Unscored —
SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backe…
-
Unscored —
The function AES_UnWRAP() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excl…
-
Unscored —
The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and …
-
Unscored —
The function ClientEAPOLKeyRecvd() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to…
-
Unscored —
A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack us…
-
High 7.5
Authentication Bypass in Apache Cassandra
Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user ca…
-
Unscored —
Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution …
-
Unscored —
SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS.
-
Unscored —
SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal.
-
High 7.3CVE-2020-2506 Exploited
improper access control vulnerability in Helpdesk
The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This iss…
KEV Mar 25, 2022 -
Unscored —CVE-2020-35667 Public exploit
JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials.
-
Critical 9.8
command injection vulnerability in Helpdesk
The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.
-
Unscored —
In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.
-
Unscored —
In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.
-
Unscored —
SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS.
-
Unscored —
SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection.
-
Unscored —
In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails,…
-
Unscored —
In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users.
-
Unscored —
In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user.
-
Unscored —
In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.
-
Unscored —
In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration.
-
Unscored —
JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.
-
Unscored —
In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed.
-
Unscored —
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code …
-
Unscored —
In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments.