Archive
February 2021
Vulnerabilities first published in this month (UTC), newest first.
1,464 results · Feed
-
Medium 4.4
IBM Case Manager 5.2 and 5.3 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scr…
-
High 7.5
Denial of Service in get-ip-range
The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service (DoS) if the range is untrusted input. An attacker could send a large range (such as 128.0.0.0/1) that causes resource exhaustion.
-
Medium 6.1
Actionpack Open Redirect Vulnerability
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pac…
-
High 7.5CVE-2021-22880 Public exploit
Active Record subject to Regular Expression Denial-of-Service (ReDoS)
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active …
-
High 7.3
openldap uses fixed paths in /tmp
A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to overwrite arbitrary files and gain access to the openldap2 …
-
Unscored —
Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow …
-
Unscored —
Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to re…
-
Unscored —CVE-2021-22658 EPSS 13%
Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escala…
-
Unscored —CVE-2021-22654 EPSS 12%
Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an unauthorized attac…
-
Low 3.6
skuba: Insecure /tmp usage when joining node to cluster
A Insecure Temporary File vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to leak the bootstrapToken or modify the configuration file before it is processed, leading to arbitrary modifications of the machine/cluster.
-
Low 2.9
skuba: Insecure handling of private key
A Incorrect Permission Assignment for Critical Resource vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to gain access to the kublet key. This issue affects: SUSE CaaS Platform 4.5 skuba versions prior to https://github.com/SUSE/skuba/…
-
High 7.0
Improper Authorization in github.com/containers/libpod
A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if …
-
Low 3.3
OIDC Logout redirect in keycloak
A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable.
-
Low 2.7
Generation of Error Message Containing Sensitive Information in Keycloak
A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.
-
Unscored —
Under certain conditions, Teradici PCoIP Agents for Windows prior to version 20.10.0 and Teradici PCoIP Agents for Linu…
-
Unscored —
An out of bounds write in Teradici PCoIP soft client versions prior to version 20.10.1 could allow an attacker to remot…
-
Unscored —
A null pointer dereference in Teradici PCoIP Soft Client versions prior to 20.07.3 could allow an attacker to crash the…
-
Unscored —
An Anti CSRF mechanism was discovered missing in the Teradici Cloud Access Connector v31 and earlier in a specific web …
-
Unscored —
Certain web application pages in the authenticated section of the Teradici Cloud Access Connector prior to v18 were acc…
-
Medium 6.3
obs: Stored XSS
A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Open Build Service allows remote attackers to store JS code in markdown that is not properly escaped, impacting confidentiality and integrity. This issue a…
-
High 7.5
LDAP Injection
All versions of package is-user-valid are vulnerable to LDAP Injection which can lead to either authentication bypass or information exposure.
-
Medium 6.7
SSL may be unexpectedly disabled during upgrade of multiple-server MongoDB Ops Manager
For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager versions prior to and including 4.4.12 triggers a bug where Automation…
-
Unscored —
Pelco Digital Sentry Server 7.18.72.11464 has an XML External Entity vulnerability (exploitable via the DTD parameter e…
-
High 7.5CVE-2020-35498 Public exploit
A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a ma…
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent WeChat 7.0.18…
-
High 7.2CVE-2020-27871 EPSS 91%
This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Plat…
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Or…
-
Unscored —
The Trend Micro Security 2020 and 2021 families of consumer products are vulnerable to a code injection vulnerability w…
-
Unscored —
PNPSCADA 2.200816204020 allows cross-site scripting (XSS), which can execute arbitrary JavaScript in the victim's brows…
-
High 8.8
An out-of-bounds write vulnerability exists in the Obj.cpp load_obj() functionality of Prusa Research PrusaSlicer 2.2.0…
-
High 8.8
A stack-based buffer overflow vulnerability exists in the Objparser::objparse() functionality of Prusa Research PrusaSl…
-
Critical 9.8
A heap overflow vulnerability exists in the way the GIF parser decodes LZW compressed streams in Accusoft ImageGear 19.…
-
Critical 9.8
An out-of-bounds write vulnerability exists in the TIFF parser of Accusoft ImageGear 19.8. A specially crafted malforme…
-
Critical 9.8
An out-of-bounds write vulnerability exists in the SGI RLE decompression functionality of Accusoft ImageGear 19.8. A sp…
-
Critical 9.8
An out-of-bounds write vulnerability exists in the PSD Header processing functionality of Accusoft ImageGear 19.8. A sp…
-
High 8.8
In SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014), a specially crafted document can cause the …
-
High 8.6
A denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01.00. A specially craft…
-
High 8.8
In SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014), a specially crafted document can cause the …
-
Unscored —
Fluent Bit 1.6.10 has a NULL pointer dereference when an flb_malloc return value is not validated by flb_avro.c or http…
-
Medium 4.9
An internal product security audit of Lenovo XClarity Administrator (LXCA) prior to version 3.1.0 discovered the Window…