Archive
February 2021
Vulnerabilities first published in this month (UTC), newest first.
45 results · Clear filters · Feed
-
Low 3.1
Open redirects on some federation and push requests
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external…
-
Low 3.5
Path traversal in Node-Red
Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` per…
-
Low 3.5
information disclosure
Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to information disclosure.
-
Low 3.1
Open redirect vulnerability in aiohttp
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different websit…
-
Low 3.1
Support bundles can include user session IDs in Jenkins Support Core Plugin
Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user (basic authentication details only)" information, which can include the session ID of the user creating the support bundle in some configuratio…
-
Low 2.5
The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a req…
-
Low 3.5
SSRF in Rendertron
Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery (SSRF) attack. An attacker can use a specially crafted webpage to force a rendertron headless chrome process to render internal sites it has access to, and display it as a…
-
Low 3.9
The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a ba…
-
Low 3.5
ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remov…
-
Low 3.7
Memory leak in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted c…
-
Low 3.7
Crash in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture…
-
Low 3.5
CSV Formula Injection possible due to improper fields escaping in GateManager
Improper Encoding or Escaping of Output from CSV Report Generator of Secomea GateManager allows an authenticated administrator to generate a CSV file that may run arbitrary commands on a victim's computer when opened in a spreadsheet program (like Excel). Thi…
-
Low 2.2
IBM Security Verify Information Queue information disclosure
IBM Security Verify Information Queue 1.0.6 and 1.0.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 196184.
-
Low 3.3
Acrobat Pro DC Use-After-Free Vulnerability Could Lead to Information Disclosure
Acrobat Pro DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Use-after-free vulnerability when parsing a specially crafted PDF file. An unauthenticated attacker could leverage t…
-
Low 3.3
Acrobat Reader DC Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to cause an appli…
-
Low 2.6
Video feed was captured while user has disabled video
Wire is an open-source collaboration platform. In Wire for iOS (iPhone and iPad) before version 3.75 there is a vulnerability where the video capture isn't stopped in a scenario where a user first has their camera enabled and then disables it. It's a privacy …
-
Low 3.1
IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user to perform unauthorized activities due to impr…
-
Low 3.1
IBM Security Verify Information Queue 1.0.6 and 1.0.7 is vulnerable to cross-site request forgery which could allow an …
-
Low 2.6
IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user on the network to cause a denial of service du…
-
Low 2.7
IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information whe…
-
Low 3.6
skuba: Insecure /tmp usage when joining node to cluster
A Insecure Temporary File vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to leak the bootstrapToken or modify the configuration file before it is processed, leading to arbitrary modifications of the machine/cluster.
-
Low 2.9
skuba: Insecure handling of private key
A Incorrect Permission Assignment for Critical Resource vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to gain access to the kublet key. This issue affects: SUSE CaaS Platform 4.5 skuba versions prior to https://github.com/SUSE/skuba/…
-
Low 3.3
OIDC Logout redirect in keycloak
A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable.
-
Low 2.7
Generation of Error Message Containing Sensitive Information in Keycloak
A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.
-
Low 2.7
Denial-of-service in Fleet
Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes the Fleet server to exit, resulting in denial of service. This is possible only while a live query is…
-
Low 2.4
Information Disclosure in go.elastic.co/apm
The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM …
-
Low —
Generation of fake documents via public GET-call
### Impact Generation of fake documents via public GET-call ### Patches We recommend to update to the current version 6.3.5.1. You can get the update to 6.3.5.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio …
-
Low 3.5
Scripting tag chars < > not filtered in input fields could cause Cross-Site Scripting (XSS)
A vulnerability in web UI input field of GateManager allows authenticated attacker to enter script tags that could cause XSS. This issue affects: GateManager all versions prior to 9.3.
-
Low —
Key Caching behavior in the DynamoDB Encryption Client.
### Impact This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified. When key usage permissions were changed at the key provider…