Archive
15 February 2021
Vulnerabilities first published on this day (UTC), newest first.
40 results · Feed
-
High 8.1
Dell EMC Avamar Server, versions 19.3 and 19.4 contain an Improper Authorization vulnerability in the web UI. A remote …
-
Unscored —
Teachers Record Management System 1.0 is affected by a SQL injection vulnerability in 'searchteacher' POST parameter in…
-
Unscored —
Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution…
-
Unscored —
The Login Panel of CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection authentication bypass. An attac…
-
Unscored —
The user area for Library System 1.0 is vulnerable to SQL injection where a user can bypass the authentication and logi…
-
Unscored —CVE-2021-3239 EPSS 19%
E-Learning System 1.0 suffers from an unauthenticated SQL injection vulnerability, which allows remote attackers to exe…
-
Unscored —
A SQL injection vulnerability in interface/reports/non_reported.php in OpenEMR before 5.0.2.5 allows a remote authentic…
-
Unscored —
A SQL injection vulnerability in interface/main/finder/patient_select.php from library/patient.inc in OpenEMR before 5.…
-
Unscored —
A SQL injection vulnerability in interface/reports/immunization_report.php in OpenEMR before 5.0.2.5 allows a remote au…
-
Unscored —
A SQL injection vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.5 allows a remote auth…
-
High 7.2
Zip slip in Microweber
A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an adminis…
-
Unscored —CVE-2021-27211 Public exploit
steghide 0.5.1 relies on a certain 32-bit seed value, which makes it easier for attackers to detect hidden data.
-
Unscored —
Endian Firewall Community (aka EFW) 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell …
-
Unscored —
ActivePresenter 6.1.6 is affected by a memory corruption vulnerability that may result in a denial of service (DoS) or …
-
Unscored —CVE-2020-24899 EPSS 17%
Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user can inject additional…
-
Unscored —CVE-2020-22427 EPSS 15%
NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability. An authenticated nagiosadmin user can injec…
-
Unscored —
Centreon 19.10-3.el7 is affected by a SQL injection vulnerability, where an authorized user is able to inject additiona…
-
Unscored —
An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer o…
-
Unscored —
An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called wit…
-
Unscored —
A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-…
-
High 7.1
Insecure Direct Object Reference in GateManager WebUI can cause privilege escalation
An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any user in its domain or any sub-domain, via escalation of privileges. This issue affects all GateManage…
-
Medium 6.6
Deserialization of Untrusted Data
This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function.
-
Critical 9.0
A directory traversal vulnerability exists in the file upload function of the GateManager that allows an authenticated …
-
Medium 4.8
IBM Spectrum Protect Operations Center 7.1 and 8.1 is vulnerable to a denial of service, caused by a RPC that allows ce…
-
High 8.0
IBM Spectrum Protect Operations Center 7.1 and 8.1could allow a remote attacker to execute arbitrary code on the system…
-
Medium 4.2
IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions,…
-
Unscored —
CITSmart before 9.1.2.23 allows LDAP Injection.
-
Unscored —CVE-2021-25299 EPSS 98%
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/n…
-
Medium 5.9CVE-2021-23336 EPSS 41%
Web Cache Poisoning
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called par…
-
High 7.2
Command Injection
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
-
Unscored —
crate has been renamed to `qjsonrpc`
This crate has been renamed from `jsonrpc-quic` to `qjsonrpc`. The new repository location is: <https://github.com/maidsafe/sn_api>
-
Unscored —
crate has been renamed to `sn_api`
This crate has been renamed from `safe-api` to `sn_api`. The new repository location is: <https://github.com/maidsafe/sn_api>
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
-
Medium 5.3
FILTER_VALIDATE_URL accepts URLs with invalid userinfo
In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid…
-
Medium 5.3
Null Dereference in SoapClient
In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus c…
-
Unscored —
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Inf…
-
Unscored —
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScrip…
-
High 8.8
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosx…
KEV Jan 18, 2022 -
High 8.8
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosx…
KEV Jan 18, 2022 -
High 8.8
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosx…
KEV Jan 18, 2022