Archive
February 2021
Vulnerabilities first published in this month (UTC), newest first.
1,464 results · Feed
-
High 8.6
Cross-site Scripting (XSS)
This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTML code on the main page is sanitized, b…
-
High 7.9
Dell EMC PowerProtect Cyber Recovery, version 19.7.0.1, contains an Information Disclosure vulnerability. A locally aut…
-
Unscored —
Buffer overflow in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version …
-
Medium 6.1
A CWE-352: Cross-Site Request Forgery vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8…
-
Medium 5.9
A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx…
-
Medium 5.9
A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION7700…
-
Unscored —
SSRF in the document conversion component of Webware Webdesktop 5.1.15 allows an attacker to read all files from the se…
-
Unscored —
components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound <= 4.0.1 allows remote attackers to execute arbitra…
-
High —
Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces
In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is poss…
-
Unscored —
ModernFlow before 1.3.00.208 does not constrain web-page access to members of a security group, as demonstrated by the …
-
Low 3.9
The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a ba…
-
Unscored —
The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares.
-
Medium 6.1
In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system…
-
Low 3.5
ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remov…
-
Medium 6.8
ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version …
-
Unscored —
An issue was discovered in ownCloud before 10.4. Because of an SSRF issue (via the apps/files_sharing/external remote p…
-
Unscored —
An issue was discovered in ownCloud before 10.4. An attacker can bypass authentication on a password-protected image by…
-
Unscored —
Open OnDemand before 1.5.7 and 1.6.x before 1.6.22 allows CSRF.
-
Unscored —
Checkmk before 1.6.0p17 allows local users to obtain SYSTEM privileges via a Trojan horse shell script in the %PROGRAMD…
-
Unscored —
Amaze File Manager before 3.5.1 allows attackers to obtain root privileges via shell metacharacters in a symbolic link.
-
Unscored —
Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI.
-
Medium 4.3
Regular expression Denial of Service in @progfay/scrapbox-parser
A ReDoS (regular expression denial of service) flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for Node.js.
-
Unscored —CVE-2021-27403 Public exploit
Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow cgi-bin/te_acceso_router.cgi curWebPage XSS.
-
Unscored —CVE-2021-27404 Public exploit
Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow injection of a Host HTTP header.
-
Unscored —
OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax_s…
-
Unscored —
Buffer overflow in FinalWire Ltd AIDA64 Engineer 6.00.5100 allows attackers to execute arbitrary code by creating a cra…
-
Unscored —CVE-2021-26747 EPSS 55%
Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading …
-
Unscored —
Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk…
-
Unscored —
A buffer overflow in res_pjsip_diversion.c in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 allows rem…
-
Unscored —
An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0…
-
Unscored —
An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certifi…
-
Unscored —
Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitr…
-
Unscored —
Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The application does not generate a new session cookie after the u…
-
Unscored —
KollectApps before 4.8.16c is affected by insecure Java deserialization, leading to Remote Code Execution via a ysoseri…
-
Unscored —
Friendica 2021.01 allows SSRF via parse_url?binurl= for DNS lookups or HTTP requests to arbitrary domain names.
-
Medium 5.4
Removing access may not effect published series
Opencast is a free, open-source platform to support the management of educational audio and video content. In Opencast before version 9.2 there is a vulnerability in which publishing an episode with strict access rules will overwrite the currently set series …
-
High 7.3
Prototype Pollution
All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .
-
High 7.5
Regular Expression Denial of Service (ReDoS)
The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components.
-
Medium 6.5
Server-side Request Forgery (SSRF)
All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the l…
-
High 7.5
Denial of Service (DoS)
This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.