Skip to content
OpenAdvisories

Archive

16 February 2021

Vulnerabilities first published on this day (UTC), newest first.

← January 2021 2021 / February /16 March 2021 →
  1. 149
  2. 254
  3. 363
  4. 4117
  5. 538
  6. 616
  7. 76
  8. 878
  9. 9145
  10. 10114
  11. 1196
  12. 1249
  13. 132
  14. 147
  15. 1540
  16. 1655
  17. 17112
  18. 1838
  19. 1944
  20. 201
  21. 215
  22. 2266
  23. 2362
  24. 2441
  25. 2574
  26. 2674
  27. 2717
  28. 281
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium 5.3
    CVE-2020-28918

    DualShield 5.9.8.0821 allows username enumeration on its login form. A valid username results in prompting for the pass…

  • Medium 4.4
    CVE-2020-29457

    Improper Certificate Validation in OPCFoundation.NetStandard.Opc.Ua.Core

    A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connection.

    OPCFoundation.NetStandard.Opc.Ua.Core NuGet
  • Medium 5.3
    CVE-2021-21317

    Denial of Service in uap-core

    uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture group…

    ua-parser uap-core uap-core uap-core Ubuntu npm
  • Medium 6.3
    CVE-2021-21316

    Arbitrary code execution in less-openui5

    less-openui5 is an npm package which enables building OpenUI5 themes with Less.js. In less-openui5 before version 0.10., when processing theming resources (i.e. `*.less` files) with less-openui5 that originate from an untrusted source, those resources might c…

    SAP less-openui5 less-openui5 npm
  • Medium 5.9
    CVE-2021-23841 Public exploit

    Null pointer deref in X509_issuer_and_serial_hash()

    The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine crates.io
  • Medium 5.3
    CVE-2020-35561

    SSRF in variuos products of MB connect line and Helmholz

    An issue was discovered MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. There is an SSRF in the HA module allowing an unauthenticated attacker to scan for open ports.

  • Medium 5.4
    CVE-2020-29027

    Reflected Cross Site Scripting

    Cross-site Scripting (XSS) vulnerability in GUI of Secomea SiteManager could allow an attacker to cause an XSS Attack. This issue affects: Secomea SiteManager all versions prior to 9.3.

    Secomea SiteManager
  • Medium 5.4
    CVE-2020-29025

    DOM-based Javascript injection

    A vulnerability in SiteManager-Embedded (SM-E) Web server which may allow attacker to construct a URL that if visited by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that …

    Secomea SiteManager Embedded (SM-E)
  • Medium 4.3
    CVE-2020-35568

    Sensitive Information Exposure in products of MB connect line and Helmholz

    An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An incomplete filter applied to a database response allows an authenticated attacker to gain non-public information…

  • Medium 5.3
    CVE-2020-35566

    Local file inclusion vulnerability in products of MB connect line and Helmholz

    An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An attacker can read arbitrary JSON files via Local File Inclusion.

  • Medium 5.3
    CVE-2020-35570

    Foreced Browsing vulnerability in products of MB connect line and Helmholz

    An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. An unauthenticated attacker is able to access files (that should have been restricted) via forceful browsing.

  • Medium 6.5
    CVE-2020-35557

    Improper Access Validation in products of MB connect line and Helmholz

    An issue in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 allows a logged in user to see devices in the account he should not have access to due to improper use of access validation.

  • Medium 5.3
    CVE-2020-29022

    Host Header Injection allowing web cache poisoning attacks

    Failure to Sanitize host header value on output in the GateManager Web server could allow an attacker to conduct web cache poisoning attacks. This issue affects Secomea GateManager all versions prior to 9.3

    Secomea GateManager
  • Medium 5.3
    CVE-2020-29024

    Missing HtppOnly and Secure flags

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in (GTA) GoToAppliance of Secomea GateManager could allow an attacker to gain access to sensitive cookies. This issue affects: Secomea GateManager all versions prior to 9.3.

    Secomea GateManager
  • Medium 5.5
    CVE-2020-25340

    NFStream Local Denial of Service (DoS)

    An issue was discovered in NFStream 5.2.0. Because some allocated modules are not correctly freed, if the nfstream object is directly destroyed without being used after it is created, it will cause a memory leak that may result in a local denial of service (D…

    nfstream PyPI