Skip to content
OpenAdvisories

Archive

23 February 2021

Vulnerabilities first published on this day (UTC), newest first.

← January 2021 2021 / February /23 March 2021 →
  1. 149
  2. 254
  3. 363
  4. 4117
  5. 538
  6. 616
  7. 76
  8. 878
  9. 9145
  10. 10114
  11. 1196
  12. 1249
  13. 132
  14. 147
  15. 1540
  16. 1655
  17. 17112
  18. 1838
  19. 1944
  20. 201
  21. 215
  22. 2266
  23. 2362
  24. 2441
  25. 2574
  26. 2674
  27. 2717
  28. 281
All Critical High Medium Low Exploited only Public exploit

62 results · Feed

  • Unscored —
    CVE-2020-16243 EPSS 12%

    Multiple buffer overflow vulnerabilities exist when LeviStudioU (Version 2019-09-21 and prior) processes project files.…

  • Unscored —
    CVE-2020-25161

    The WADashboard component of WebAccess/SCADA Versions 9.0 and prior may allow an attacker to control or influence a pat…

  • Medium —
    CVE-2021-22113

    Incorrect Authorization in Spring Cloud Netflix Zuul

    Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs. Applications that use Spr…

    org.springframework.cloud:spring-cloud-netflix-zuul Maven
  • High 7.4
    CVE-2020-7847

    The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can …

    EFM ipTIME NAS
  • Unscored —
    CVE-2021-25630

    "loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. Before doing …

    The Document Foundation Collabora Productivity Collabora Online LibreOffice Online
  • Medium 4.3
    CVE-2020-4953

    IBM Planning Analytics 2.0 could allow a remote authenticated attacker to obtain information about an organization's in…

    IBM Planning Analytics
  • High 7.3
    CVE-2020-28429 Scanner template EPSS 63%

    Command Injection

    All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})

    geojson2kml npm
  • Unscored —
    CVE-2021-27550

    Polaris Office v9.102.66 is affected by a divide-by-zero error in PolarisOffice.exe and EngineDLL.dll that may cause a …

  • Unscored —
    CVE-2021-3252

    KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned i…

  • High 7.3
    CVE-2020-14359

    Keycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers

    A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) an attacker can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection …

    github.com/keycloak/keycloak-gatekeeper Go
  • Low 3.5
    CVE-2020-8902

    SSRF in Rendertron

    Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery (SSRF) attack. An attacker can use a specially crafted webpage to force a rendertron headless chrome process to render internal sites it has access to, and display it as a…

    Google Rendertron rendertron npm
  • Medium —
    CVE-2020-13697

    NanoHTTPD Cross-site Scripting vulnerability

    An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler …

    org.nanohttpd:nanohttpd-nanolets Maven
  • Unscored —
    CVE-2020-25690

    An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certa…

    fontforge Ubuntu
  • Unscored —
    CVE-2020-27819

    An issue was discovered in libxls before and including 1.6.1 when reading Microsoft Excel files. A NULL pointer derefer…

    r-cran-readxl Ubuntu
  • High 7.1
    CVE-2020-29075

    PDF Injection BlackHat Talk

    Acrobat Reader DC versions 2020.013.20066 (and earlier), 2020.001.30010 (and earlier) and 2017.011.30180 (and earlier) are affected by an information exposure vulnerability, that could enable an attacker to get a DNS interaction and track if the user has open…

    Adobe Acrobat Reader DC
  • Unscored —
    CVE-2021-22647

    Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering v…

  • Unscored —
    CVE-2021-22643

    Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering v…

  • Unscored —
    CVE-2021-22645

    Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering v…

  • Unscored —
    CVE-2021-22649

    Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering v…

  • Medium 5.9
    CVE-2021-27568 Public exploit

    Improper Check for Unusual or Exceptional Conditions in json-smart

    An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the l…

    net.minidev:json-smart net.minidev:json-smart-mini Maven
  • Unscored —
    CVE-2020-35852

    Chatbox is affected by cross-site scripting (XSS). An attacker has to upload any XSS payload with SVG, XML file in Chat…

  • Unscored —
    CVE-2020-27768

    In ImageMagick, there is an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-priv…

    imagemagick imagemagick Debian Ubuntu