Skip to content
OpenAdvisories

Archive

27 February 2021

Vulnerabilities first published on this day (UTC), newest first.

← January 2021 2021 / February /27 March 2021 →
  1. 149
  2. 254
  3. 363
  4. 4117
  5. 538
  6. 616
  7. 76
  8. 878
  9. 9145
  10. 10114
  11. 1196
  12. 1249
  13. 132
  14. 147
  15. 1540
  16. 1655
  17. 17112
  18. 1838
  19. 1944
  20. 201
  21. 215
  22. 2266
  23. 2362
  24. 2441
  25. 2574
  26. 2674
  27. 2717
  28. 281
All Critical High Medium Low Exploited only Public exploit

17 results · Feed

  • Unscored —
    CVE-2021-27132 EPSS 16%

    SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function vi…

  • Unscored —
    CVE-2019-25020

    An issue was discovered in Scytl sVote 2.1. Because the sdm-ws-rest API does not require authentication, an attacker ca…

  • Unscored —
    CVE-2019-25021

    An issue was discovered in Scytl sVote 2.1. Due to the implementation of the database manager, an attacker can access t…

  • Unscored —
    CVE-2019-25023

    An issue was discovered in Scytl sVote 2.1. Because the IP address from an X-Forwarded-For header (which can be manipul…

  • Unscored —
    CVE-2019-25022

    An issue was discovered in Scytl sVote 2.1. An attacker can inject code that gets executed by creating an election-even…

  • Unscored —
    CVE-2021-3151

    i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated atta…

  • Unscored —
    OSV-2021-449

    UNKNOWN READ in std::pair<absl::lts_NUMBER_02_25::container_internal::raw_hash_set<absl::lts_NUM

    OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31393 ``` Crash type: UNKNOWN READ Crash state: std::pair<absl::lts_NUMBER_02_25::container_internal::raw_hash_set<absl::lts_NUM tensorflow::SparseCount<long, long>::Compute tensorflow::Ke…

    tensorflow PyPI
  • High 7.4
    CVE-2020-35662

    SaltStack Salt Improper SSL Certificate Validation

    In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated.

    salt salt Ubuntu PyPI
  • High 7.8
    CVE-2020-28243 Public exploit

    SaltStack Salt command injection via a crafted process name

    An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blackliste…

    salt salt Ubuntu PyPI
  • Medium 5.9
    CVE-2020-28972

    SaltStack Salt Improper Certificate Validation

    In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate.

    salt salt Ubuntu PyPI
  • Critical 9.8
    CVE-2021-3197 EPSS 72%

    SaltStack Salt is vulnerable to shell injection via ProxyCommand argument

    An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.1
    CVE-2021-3144

    SaltStack Salt eauth tokens can be used once after expiration

    In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)

    salt salt Alpine PyPI
  • Critical 9.8
    CVE-2021-3148

    SaltStack Salt command injection in the Salt-API when using the Salt-SSH client

    An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.p…

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2021-25283 EPSS 10%

    SaltStack Salt Server Side Template Injection

    An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.

    salt salt salt Ubuntu Alpine PyPI
  • Medium 4.4
    CVE-2021-25284

    SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod

    An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2021-25281 Public exploit EPSS 73%

    SaltStack Salt Improper Authentication vulnerability

    An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.1
    CVE-2021-25282 Public exploit EPSS 93%

    SaltStack Salt Directory Traversal vulnerability

    An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.

    salt salt salt Ubuntu Alpine PyPI