Archive
23 February 2021
Vulnerabilities first published on this day (UTC), newest first.
62 results · Feed
-
Medium 4.3
Regression in DNS leakage from Tor windows
Brave is an open source web browser with a focus on privacy and security. In Brave versions 1.17.73-1.20.103, the CNAME adblocking feature added in Brave 1.17.73 accidentally initiated DNS requests that bypassed the Brave Tor proxy. Users with adblocking enab…
-
Unscored —
There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF…
-
Unscored —
A flaw was found in Red Hat Satellite. The BMC interface exposes the password through the API to an authenticated local…
-
Unscored —
A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling o…
-
Unscored —
A flaw was found in libcaca v0.99.beta19. A buffer overflow issue in caca_resize function in libcaca/caca/canvas.c may …
-
High 7.8CVE-2021-3407 EPSS 50%
A flaw was found in mupdf 1.18.0. Double free of object during linearization may lead to memory corruption and other po…
-
Unscored —
A privilege escalation flaw was found in openshift4/ose-docker-builder. The build container runs with high privileges u…
-
Unscored —
A flaw was found in libebml before 1.4.2. A heap overflow bug exists in the implementation of EbmlString::ReadData and …
-
Unscored —
A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program cra…
-
Unscored —
In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP vers…
-
Unscored —
In Directus 8.x through 8.8.1, an attacker can switch to the administrator role (via the PATCH method) without any cont…
-
Unscored —
In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/{id}. For each call, they …
-
Unscored —
In Directus 8.x through 8.8.1, an attacker can discover whether a user is present in the database through the password …
-
High 8.8
Privilege escalation in spring security
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to …
-
Unscored —
A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not…
-
High 7.5
Denial of service in Undertow
A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerabilit…
-
Unscored —
Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference (IDOR) vulnerability that permits users wi…
-
Unscored —
UniFi Protect before v1.17.1 allows an attacker to use spoofed cameras to perform a denial-of-service attack that may c…
-
High 8.8
A specially crafted document can cause the document parser to copy data from a particular record type into a static-siz…
-
Unscored —
A local authenticated buffer overflow vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior …
-
Unscored —
A local authenticated escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s)…
-
Unscored —
A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Pri…
-
Unscored —
A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Pri…
-
Critical 9.1
Autobinding vulnerability in MITREid Connect
org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment (aka Autobinding) vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation d…
-
Unscored —
A remote unauthenticated stored cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manag…
-
Unscored —
When loading a specially crafted file, Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 1…
-
Unscored —
A flaw was found in the OpenShift Installer before version v0.9.0-master.0.20210125200451-95101da940b0. During installa…
-
Unscored —
A flaw was found in jasper before 2.0.25. An out of bounds read issue was found in jp2_decode function whic may lead to…
-
Unscored —
A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to …
-
Unscored —
A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Pri…
-
Medium 4.8
HTTP request smuggling in Undertow
A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker t…
-
Unscored —
A remote reflected cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s)…
-
Unscored —
A remote authenticated command Injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Pri…
-
Unscored —
A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Pri…
-
Unscored —
A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior …
-
Unscored —
Snow Inventory Agent through 6.7.0 on Windows uses CPUID to report on processor types and versions that may be deployed…
-
Unscored —
A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior …
-
Unscored —
fastadmin V1.0.0.20200506_beta contains a cross-site scripting (XSS) vulnerability which may allow an attacker to obtai…
-
Unscored —
A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cau…
-
Unscored —
A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use…