Skip to content
OpenAdvisories

Archive

16 February 2021

Vulnerabilities first published on this day (UTC), newest first.

← January 2021 2021 / February /16 March 2021 →
  1. 149
  2. 254
  3. 363
  4. 4117
  5. 538
  6. 616
  7. 76
  8. 878
  9. 9145
  10. 10114
  11. 1196
  12. 1249
  13. 132
  14. 147
  15. 1540
  16. 1655
  17. 17112
  18. 1838
  19. 1944
  20. 201
  21. 215
  22. 2266
  23. 2362
  24. 2441
  25. 2574
  26. 2674
  27. 2717
  28. 281
All Critical High Medium Low Exploited only Public exploit

55 results · Feed

  • Medium 5.3
    CVE-2020-35570

    Foreced Browsing vulnerability in products of MB connect line and Helmholz

    An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. An unauthenticated attacker is able to access files (that should have been restricted) via forceful browsing.

  • Medium 6.5
    CVE-2020-35557

    Improper Access Validation in products of MB connect line and Helmholz

    An issue in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 allows a logged in user to see devices in the account he should not have access to due to improper use of access validation.

  • Low 3.5
    CVE-2020-29023

    CSV Formula Injection possible due to improper fields escaping in GateManager

    Improper Encoding or Escaping of Output from CSV Report Generator of Secomea GateManager allows an authenticated administrator to generate a CSV file that may run arbitrary commands on a victim's computer when opened in a spreadsheet program (like Excel). Thi…

    Secomea GateManager
  • Medium 5.3
    CVE-2020-29022

    Host Header Injection allowing web cache poisoning attacks

    Failure to Sanitize host header value on output in the GateManager Web server could allow an attacker to conduct web cache poisoning attacks. This issue affects Secomea GateManager all versions prior to 9.3

    Secomea GateManager
  • Medium 5.3
    CVE-2020-29024

    Missing HtppOnly and Secure flags

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in (GTA) GoToAppliance of Secomea GateManager could allow an attacker to gain access to sensitive cookies. This issue affects: Secomea GateManager all versions prior to 9.3.

    Secomea GateManager
  • Unscored —
    CVE-2021-25648

    Mobile application "Testes de Codigo" 11.4 and prior allows an attacker to gain access to the administrative interface …

  • Unscored —
    CVE-2021-27232

    The RTSPLive555.dll ActiveX control in Pelco Digital Sentry Server 7.18.72.11464 has a SetCameraConnectionParameter sta…

  • Medium 5.5
    CVE-2020-25340

    NFStream Local Denial of Service (DoS)

    An issue was discovered in NFStream 5.2.0. Because some allocated modules are not correctly freed, if the nfstream object is directly destroyed without being used after it is created, it will cause a memory leak that may result in a local denial of service (D…

    nfstream PyPI
  • Unscored —
    CVE-2020-24841

    PNPSCADA 2.200816204020 allows SQL injection via parameter 'interf' in /browse.jsp. Exploiting this issue could allow a…

  • Unscored —
    CVE-2021-27233

    An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. On the admin portal of the web application, password in…

  • Unscored —
    CVE-2021-27234

    An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. The web application suffers from SQL injection on Admin…

  • Unscored —
    CVE-2021-27235

    An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. On the admin portal of the web application, there is a …

  • Unscored —
    CVE-2021-27236

    An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. getfile.asp allows Unauthenticated Local File Inclusion…

  • Unscored —
    CVE-2021-27231

    Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to c…

  • Unscored —
    CVE-2021-27229

    Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on …

    mumble mumble mumble Debian Ubuntu Alpine