Archive
16 February 2021
Vulnerabilities first published on this day (UTC), newest first.
55 results · Feed
-
Critical 9.8
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endp…
KEV Nov 3, 2021 -
Critical 9.8
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed ver…
KEV Nov 3, 2021 -
High 7.8CVE-2021-27102 Exploited · Ransomware
Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version …
KEV Nov 3, 2021 -
Critical 9.8
Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root…
KEV Nov 3, 2021 -
Medium 5.3
DualShield 5.9.8.0821 allows username enumeration on its login form. A valid username results in prompting for the pass…
-
Unscored —
In Dekart Private Disk 2.15, invalid use of the Type3 user buffer for IOCTL codes using METHOD_NEITHER results in arbit…
-
Unscored —
JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious w…
-
Unscored —
Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to arbitrarily access and delete files via an…
-
Unscored —
Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via …
-
Unscored —
Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via …
-
Unscored —
Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for privilege escalation via configd.
-
Unscored —
Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows users to escape the provided command line interface and…
-
Unscored —
Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for cross-site request forgeries.
-
Unscored —
Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scripting attacks via t…
-
Unscored —
Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scripting attacks via t…
-
Unscored —
Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to view sensitive syslog events without authe…
-
Unscored —
The Zscaler Client Connector prior to 3.1.0 did not sufficiently validate RPC clients, which allows a local adversary t…
-
Medium 4.4
Improper Certificate Validation in OPCFoundation.NetStandard.Opc.Ua.Core
A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connection.
-
Unscored —
The admin panel in BlackCat CMS 1.3.6 allows stored XSS (by an admin) via the Display Name field to backend/preferences…
-
Medium 5.3
Denial of Service in uap-core
uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture group…
-
Medium 6.3
Arbitrary code execution in less-openui5
less-openui5 is an npm package which enables building OpenUI5 themes with Less.js. In less-openui5 before version 0.10., when processing theming resources (i.e. `*.less` files) with less-openui5 that originate from an untrusted source, those resources might c…
-
High 7.1
Command Injection Vulnerability
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerabili…
KEV Jan 18, 2022 -
High 7.5
Integer overflow in CipherUpdate
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the …
-
Medium 5.9CVE-2021-23841 Public exploit
Null pointer deref in X509_issuer_and_serial_hash()
The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing …
-
Unscored —
Incorrect SSLv2 rollback protection
OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versions then a check is made for a version rollback attack when unpadding an RSA signature. Clients that …
-
High 8.6
Hilscher: EtherNet/IP stack crash for specific CIP service
A denial of service and memory corruption vulnerability was found in Hilscher EtherNet/IP Core V2 prior to V2.13.0.21that may lead to code injection through network or make devices crash without recovery.
-
High 7.5
Hilscher: Denial of Service vulnerability in PROFINET IO Device
A Denial of Service vulnerability was found in Hilscher PROFINET IO Device V3 in versions prior to V3.14.0.7. This may lead to unexpected loss of cyclic communication or interruption of acyclic communication.
-
Medium 5.3
SSRF in variuos products of MB connect line and Helmholz
An issue was discovered MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. There is an SSRF in the HA module allowing an unauthenticated attacker to scan for open ports.
-
Medium 5.4
Reflected Cross Site Scripting
Cross-site Scripting (XSS) vulnerability in GUI of Secomea SiteManager could allow an attacker to cause an XSS Attack. This issue affects: Secomea SiteManager all versions prior to 9.3.
-
Unscored —
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login pages bruteforce dete…
-
Unscored —
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The software uses a secure pass…
-
Medium 5.4
DOM-based Javascript injection
A vulnerability in SiteManager-Embedded (SM-E) Web server which may allow attacker to construct a URL that if visited by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that …
-
Medium 4.3
Sensitive Information Exposure in products of MB connect line and Helmholz
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An incomplete filter applied to a database response allows an authenticated attacker to gain non-public information…
-
Unscored —
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unused function tha…
-
Medium 5.3
Local file inclusion vulnerability in products of MB connect line and Helmholz
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An attacker can read arbitrary JSON files via Local File Inclusion.
-
Unscored —
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is a self XSS issue with …
-
Unscored —
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an outdated and unused…
-
Unscored —
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an incomplete XSS filt…
-
Unscored —
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unauthenticated ope…
-
High 7.5
SSRF in products of MB connect line and Helmholz
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. There is an SSRF in the in the MySQL access check, allowing an attacker to scan for open ports and gain some information about possi…