Archive
26 February 2021
Vulnerabilities first published on this day (UTC), newest first.
74 results · Feed
-
Unscored —
There are multiple persistent cross-site scripting (XSS) vulnerabilities in the web interface of OpenText Content Serve…
-
Unscored —
A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of thei…
-
Medium 6.1
XML External Entity processing
Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) on certain operations.
-
Medium 5.5
Stored cross site scripting
Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to stored XSS. The application reflects previously stored user input without encoding.
-
Medium 4.9
Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS.
-
High 7.3
privilege escalation
Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to privilege escalation vulnerability.
-
Low 3.5
information disclosure
Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to information disclosure.
-
Medium 4.8
Session fixation
Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to session fixation.
-
Unscored —
Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation…
-
Unscored —
A ZTE product has a memory leak vulnerability. Due to the product's improper handling of memory release in certain scen…
-
Low 3.1
Open redirect vulnerability in aiohttp
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different websit…
-
Unscored —
Firefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a malicious application to rea…
-
Unscored —
When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user i…
-
Unscored —
If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin informati…
-
Unscored —
Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading…
-
Unscored —
The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to …
-
Unscored —
An ambiguous file picker design could have confused users who intended to select and upload a single file into uploadin…
-
Unscored —
Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox. Note: Th…
-
Unscored —
The browser could have been confused into transferring a screen sharing state into another tab, which would leak uninte…
-
Unscored —
An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the addr…
-
Unscored —
Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially ex…
-
Unscored —
Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an i…
-
Unscored —
Incorrect use of the '<RowCountChanged>' method could have led to a user-after-poison and a potentially exploitable cra…
-
Unscored —
If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reporte…
-
Unscored —
As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure th…
-
Unscored —
Context-specific code was included in a shared jump table; resulting in assertions being triggered in multithreaded was…
-
Unscored —
When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's Referrer-Polic…
-
Unscored —
One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://www.phishingtarget.com@evil.co…
-
Unscored —
When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the conte…
-
Unscored —
The DOMParser API did not properly process '<noscript>' elements for escaping. This could be used as an mXSS vector to …
-
Unscored —
The developer page about:memory has a Measure function for exploring what object types the browser has allocated and th…
-
Unscored —
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file…
-
Medium 5.3
Denial of Service
Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the attack vector: 1. send unlimited requests against a vapor instance with differe…
-
Medium 5.5
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input…