Archive
5 February 2021
Vulnerabilities first published on this day (UTC), newest first.
38 results · Feed
-
Unscored —
Mate 30 10.0.0.203(C00E201R7P2) have a buffer overflow vulnerability. After obtaining the root permission, an attacker …
-
Unscored —
Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which …
-
Unscored —
OPPO Android Phone with MTK chipset and Android 8.1/9/10/11 versions have an information leak vulnerability. The “adb s…
-
Unscored —
A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versio…
-
Medium 5.9
Injection attack in Helm
Helm is open-source software which is essentially "The Kubernetes Package Manager". Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. In Helm from version 3.0 and before version 3.5.2, there a few cases where data…
-
Unscored —
Denial of service in ASUSWRT ASUS RT-AX3000 firmware versions 3.0.0.4.384_10177 and earlier versions allows an attacker…
-
Medium 6.0
NVIDIA GeForce Experience, all versions prior to 3.21, contains a vulnerability in GameStream (rxdiag.dll) where an arb…
-
Unscored —
An issue was discovered in New Media Smarty before 9.10. Passwords are stored in the database in an obfuscated format t…
-
Unscored —
An issue was discovered in Psyprax before 3.2.2. The Firebird database is accessible with the default user sysdba and p…
-
Unscored —
An issue was discovered in Psyprax before 3.2.2. The file %PROGRAMDATA%\Psyprax32\PPScreen.ini contains a hash for the …
-
Unscored —
An issue was discovered in Psyprax beforee 3.2.2. Passwords used to encrypt the data are stored in the database in an o…
-
Unscored —
Zulip Desktop before 5.0.0 improperly uses shell.openExternal and shell.openItem with untrusted content, leading to rem…
-
Unscored —
Zulip Desktop before 5.0.0 allows attackers to perform recording via the webcam and microphone due to a missing permiss…
-
Unscored —
In Epson iProjection v2.30, the driver file EMP_MPAU.sys allows local users to cause a denial of service (BSOD) or poss…
-
Unscored —
In Max Secure Max Spyware Detector 1.0.0.044, the driver file (MaxProc64.sys) allows local users to cause a denial of s…
-
Unscored —
The AscRegistryFilter.sys kernel driver in IObit Advanced SystemCare 13.2 allows an unprivileged user to send an IOCTL …
-
Unscored —
In Epson iProjection v2.30, the driver file (EMP_NSAU.sys) allows local users to cause a denial of service (BSOD) via c…
-
Unscored —
Buffer overflow in pdf2json 0.69 allows local users to execute arbitrary code by converting a crafted PDF file.
-
Medium 6.1
LinkedIn Oncall vulnerable to Cross-Site Scripting
LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar.
-
Unscored —
Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting (XSS), which may lead to arbitrary rem…
-
Unscored —
An issue was discovered in Typora 0.9.67. There is an XSS vulnerability that causes Remote Code Execution.
-
High 7.0
Buffer Overflow in gitea
Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors related to a file path.
-
Medium 6.2
IBM PowerHA 7.2 could allow a local attacker to obtain sensitive information from temporary directories after a discove…
-
Unscored —
Opmantek Open-AudIT 4.0.1 is affected by cross-site scripting (XSS). When outputting SQL statements for debugging, a ma…
-
Unscored —
Video Insight VMS versions prior to 7.8 allows a remote attacker to execute arbitrary code with the system user privile…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack …
-
Unscored —
An issue was discovered in Epikur before 20.1.1. The Epikur server contains the checkPasswort() function that, upon use…
-
Unscored —
An issue was discovered in Epikur before 20.1.1. It stores the secret passwords of the users as MD5 hashes in the datab…
-
Unscored —
An issue was discovered in Epikur before 20.1.1. A Glassfish 4.1 server with a default configuration is running on TCP …
-
Unscored —
In Electric Coin Company Zcashd before 2.1.1-1, the time offset between messages could be leveraged to obtain sensitive…
-
Unscored —
Electric Coin Company Zcashd before 2.1.1-1 allows attackers to trigger consensus failure and double spending. A valid …
-
Unscored —CVE-2020-35765 EPSS 27%
doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows…
-
Unscored —
A cross-site scripting (XSS) issue in the login panel in Redwood Report2Web 4.3.4.5 and 4.5.3 allows remote attackers t…
-
Unscored —
A frame-injection issue in the online help in Redwood Report2Web 4.3.4.5 allows remote attackers to render an external …
-
Unscored —CVE-2021-26708 Public exploit
A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOC…
-
Unscored —
autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Di…
-
Critical 9.8
October CMS Session ID not invalidated after logout
An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant…
-
Unscored —
A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submi…