Archive
19 February 2021
Vulnerabilities first published on this day (UTC), newest first.
10 results · Clear filters · Feed
-
Medium 5.9
Improper Certificate Validation in TweetStream
TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.
-
Medium 5.9
Improper Certificate Validation in twitter-stream
In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library (because eventmachine is misused).
-
Medium 6.5
Unauthorized access to Class instance in Jinjava
Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure.
-
Medium 6.1
Open redirect in Slashify
The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring.
-
Medium 6.1
A CWE-352: Cross-Site Request Forgery vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8…
-
Medium 5.9
A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx…
-
Medium 5.9
A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION7700…
-
Medium 6.1
In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system…
-
Medium 6.8
ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version …
-
Medium 4.3
Regular expression Denial of Service in @progfay/scrapbox-parser
A ReDoS (regular expression denial of service) flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for Node.js.