Archive
February 2021
Vulnerabilities first published in this month (UTC), newest first.
1,464 results · Feed
-
Unscored —CVE-2021-27171 EPSS 18%
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to start a Linux telnetd as root on…
-
Unscored —CVE-2021-27172 EPSS 20%
An issue was discovered on FiberHome HG6245D devices through RP2613. A hardcoded GEPON password for root is defined ins…
-
Unscored —CVE-2021-27173 EPSS 13%
An issue was discovered on FiberHome HG6245D devices through RP2613. There is a telnet?enable=0&key=calculated(BR0_MAC)…
-
Unscored —CVE-2021-27174 EPSS 19%
An issue was discovered on FiberHome HG6245D devices through RP2613. wifi_custom.cfg has cleartext passwords and 0644 p…
-
Unscored —CVE-2021-27175 EPSS 18%
An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_2g.cfg has cleartext passwords and 0644 pe…
-
Unscored —CVE-2021-27176 EPSS 19%
An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_5g.cfg has cleartext passwords and 0644 pe…
-
Unscored —
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to bypass authentication by sending…
-
Unscored —CVE-2021-27178 EPSS 18%
An issue was discovered on FiberHome HG6245D devices through RP2613. Some passwords are stored in cleartext in nvram.
-
Unscored —CVE-2021-27179 EPSS 14%
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to crash the telnet daemon by sendi…
-
Medium 6.3
File System Bounds Escape
ftp-srv is an open-source FTP server designed to be simple yet configurable. In ftp-srv before version 4.4.0 there is a path-traversal vulnerability. Clients of FTP servers utilizing ftp-srv hosted on Windows machines can escape the FTP user's defined root fo…
-
Unscored —
An information disclosure issue exists in henriquedornas 5.2.17 because an attacker can dump phpMyAdmin SQL content. NO…
-
Unscored —
A stored XSS issue exists in henriquedornas 5.2.17 via online live chat. NOTE: Third parties report that no such produc…
-
Unscored —
The replay-sorcery program in ReplaySorcery 0.4.0 through 0.5.0, when using the default setuid-root configuration, allo…
-
Critical 9.1
Prisma Cloud Compute: SAML Authentication Bypass Vulnerability in Console
An improper verification of cryptographic signature vulnerability exists in the Palo Alto Networks Prisma Cloud Compute console. This vulnerability enables an attacker to bypass signature validation during SAML authentication by logging in to the Prisma Cloud…
-
High 8.2
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack …
-
High 7.5
IBM Spectrum Protect Plus 10.1.0 through 10.1.7 could allow a remote user to inject arbitrary data iwhich could cause t…
-
High 8.8
In SoftMaker Software GmbH SoftMaker Office TextMaker 2021 (revision 1014), a specially crafted document can cause the …
-
Unscored —CVE-2021-0325 Public exploit
In ih264d_parse_pslice of ih264d_parse_pslice.c, there is a possible out of bounds write due to a heap buffer overflow.…
-
Unscored —CVE-2021-0326 Public exploit
In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lea…
-
Unscored —CVE-2021-0327 Public exploit
In getContentProviderImpl of ActivityManagerService.java, there is a possible permission bypass due to non-restored bin…
-
Unscored —CVE-2021-0328 Public exploit
In onBatchScanReports and deliverBatchScan of GattService.java, there is a possible way to retrieve Bluetooth scan resu…
-
High 7.5
Square OkHttp can accept the wrong certificate
In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction…
-
Unscored —CVE-2021-0329 Public exploit
In several native functions called by AdvertiseManager.java, there is a possible out of bounds write due to a missing b…
-
Unscored —CVE-2021-0314 Public exploit
In onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed user consent due to a …
-
Unscored —CVE-2021-0330 Public exploit
In add_user_ce and remove_user_ce of storaged.cpp, there is a possible use-after-free due to improper locking. This cou…
-
Unscored —CVE-2021-0331 Public exploit
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible overlay attack due to an insecure defau…
-
Unscored —CVE-2021-0332 Public exploit
In bootFinished of SurfaceFlinger.cpp, there is a possible memory corruption due to a use after free. This could lead t…
-
Unscored —CVE-2021-0333 Public exploit
In onCreate of BluetoothPermissionActivity.java, there is a possible permissions bypass due to a tapjacking overlay tha…
-
Unscored —CVE-2021-0334 Public exploit
In onTargetSelected of ResolverActivity.java, there is a possible settings bypass allowing an app to become the default…
-
Unscored —
In process of C2SoftHevcDec.cpp, there is a possible out of bounds write due to a use after free. This could lead to re…
-
Unscored —CVE-2021-0336 Public exploit
In onReceive of BluetoothPermissionRequest.java, there is a possible permissions bypass due to a mutable PendingIntent.…
-
Unscored —CVE-2021-0337 Public exploit
In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lea…
-
Unscored —
In SystemSettingsValidators, there is a possible permanent denial of service due to missing bounds checks on UI setting…
-
Unscored —CVE-2021-0302 Public exploit
In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local e…
-
Unscored —
In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local e…
-
Unscored —CVE-2021-0339 Public exploit
In loadAnimation of WindowContainer.java, there is a possible way to keep displaying a malicious app while a target app…
-
Unscored —CVE-2021-0340 Public exploit
In parseNextBox of IsoInterface.java, there is a possible leak of unredacted location information due to improper input…
-
Unscored —
xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fa…
-
Unscored —
An integer overflow has been found in the the latest version of Issuer. The total issuedCount can be zero if the parame…
-
Unscored —
An integer underflow has been found in the latest version of ZCFees. The variables 'currPeriodIdx' and 'lastPeriodExecI…