Archive
February 2021
Vulnerabilities first published in this month (UTC), newest first.
92 results · Clear filters · Feed
-
Unscored —CVE-2021-26929 Public exploit
An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library befo…
-
Unscored —CVE-2021-27188 Public exploit
The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service (acce…
-
Unscored —CVE-2021-27187 Public exploit
The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 stores authentication credentials in cleartext in l…
-
Unscored —CVE-2021-27190 Public exploit
A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly av…
-
High 7.2
SSRF in adminer
Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is …
KEV Sep 29, 2025 -
Critical 9.1CVE-2021-21014 Public exploit
Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console i…
-
Medium 6.5
Acrobat Reader DC Out-Of-Bounds Read Information Disclosure Vulnerability
Acrobat Reader DC versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an Out-of-bounds Read vulnerability that could lead to arbitrary disclosure of information in the memory stack. An attacker …
-
High 8.8
Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achiev…
KEV Nov 3, 2021 -
High 8.6
Remote Code Exploit in Lucee Admin
Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.…
-
High 7.5CVE-2021-22880 Public exploit
Active Record subject to Regular Expression Denial-of-Service (ReDoS)
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active …
-
Unscored —
Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow …
-
High 7.5CVE-2020-35498 Public exploit
A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a ma…
-
Unscored —
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to bypass authentication by sending…
-
Unscored —CVE-2021-0325 Public exploit
In ih264d_parse_pslice of ih264d_parse_pslice.c, there is a possible out of bounds write due to a heap buffer overflow.…
-
Unscored —CVE-2021-0326 Public exploit
In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lea…
-
Unscored —CVE-2021-0327 Public exploit
In getContentProviderImpl of ActivityManagerService.java, there is a possible permission bypass due to non-restored bin…
-
Unscored —CVE-2021-0328 Public exploit
In onBatchScanReports and deliverBatchScan of GattService.java, there is a possible way to retrieve Bluetooth scan resu…
-
Unscored —CVE-2021-0329 Public exploit
In several native functions called by AdvertiseManager.java, there is a possible out of bounds write due to a missing b…
-
Unscored —CVE-2021-0314 Public exploit
In onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed user consent due to a …
-
Unscored —CVE-2021-0330 Public exploit
In add_user_ce and remove_user_ce of storaged.cpp, there is a possible use-after-free due to improper locking. This cou…
-
Unscored —CVE-2021-0331 Public exploit
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible overlay attack due to an insecure defau…
-
Unscored —CVE-2021-0332 Public exploit
In bootFinished of SurfaceFlinger.cpp, there is a possible memory corruption due to a use after free. This could lead t…
-
Unscored —CVE-2021-0333 Public exploit
In onCreate of BluetoothPermissionActivity.java, there is a possible permissions bypass due to a tapjacking overlay tha…
-
Unscored —CVE-2021-0334 Public exploit
In onTargetSelected of ResolverActivity.java, there is a possible settings bypass allowing an app to become the default…
-
Unscored —CVE-2021-0336 Public exploit
In onReceive of BluetoothPermissionRequest.java, there is a possible permissions bypass due to a mutable PendingIntent.…
-
Unscored —CVE-2021-0337 Public exploit
In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lea…
-
Unscored —CVE-2021-0302 Public exploit
In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local e…
-
Unscored —CVE-2021-0339 Public exploit
In loadAnimation of WindowContainer.java, there is a possible way to keep displaying a malicious app while a target app…
-
Unscored —CVE-2021-0340 Public exploit
In parseNextBox of IsoInterface.java, there is a possible leak of unredacted location information due to improper input…
-
Unscored —
Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the …
-
High 8.8
Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit hea…
KEV Nov 3, 2021 -
Unscored —CVE-2021-3394 Public exploit
Millennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1 has insecure folder pe…
-
Unscored —
Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to byp…
-
Unscored —CVE-2020-22841 Public exploit
Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious JavaScript code executio…
-
Critical 9.8CVE-2020-14343 Public exploit
Improper Input Validation in PyYAML
A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the libra…
-
Unscored —CVE-2021-3294 Public exploit
CASAP Automated Enrollment System 1.0 is affected by cross-site scripting (XSS) in users.php. An attacker can steal a c…
-
Critical 9.8
Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. Th…
KEV Nov 3, 2021 -
Unscored —
NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code…
-
Unscored —CVE-2021-25837 Public exploit
Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. Due to the inconsist…
-
Unscored —
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (wi…