Archive
February 2021
Vulnerabilities first published in this month (UTC), newest first.
1,464 results · Feed
-
Medium 6.8
An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. By sending a set_params.cgi?telnetd=1&save=1&…
-
Unscored —
wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=get_wdtable orde…
-
Unscored —
In OpenWrt 19.07.x before 19.07.7, when IPv6 is used, a routing loop can occur that generates excessive network traffic…
-
Unscored —
An issue was discovered in sthttpd through 2.27.1. On systems where the strcpy function is implemented with memcpy, the…
-
Unscored —CVE-2020-36243 EPSS 64%
The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php. T…
-
Critical 9.1
PyCA Cryptography symmetrically encrypting large values can lead to integer overflow
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.
-
Unscored —
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (wi…
-
Unscored —
Jenzabar 9.2.x through 9.2.2 allows /ics?tool=search&query= XSS.
-
Unscored —
There is a buffer overflow vulnerability in Mate 30 10.1.0.126(C00E125R5P3). A module does not verify the some input wh…
-
Unscored —
There is a use after free vulnerability in Taurus-AL00A 10.0.0.1(C00E1R1P1). A module may refer to some memory after it…
-
Unscored —
Some Huawei products have an inconsistent interpretation of HTTP requests vulnerability. Attackers can exploit this vul…
-
Unscored —
There is a denial of service (DoS) vulnerability in eCNS280 versions V100R005C00, V100R005C10. Due to a design defect, …
-
Unscored —
There is an out-of-bound read vulnerability in Taurus-AL00A 10.0.0.1(C00E1R1P1). A module does not verify the some inpu…
-
Unscored —
There is a local privilege escalation vulnerability in some Huawei products. A local, authenticated attacker could craf…
-
Unscored —
There has a CSV injection vulnerability in ManageOne 8.0.1. An attacker with common privilege may exploit this vulnerab…
-
Unscored —
There is a logic vulnerability in Huawei Gauss100 OLTP Product. An attacker with certain permissions could perform spec…
-
Unscored —
There is an insufficient integrity check vulnerability in Huawei Sound X Product. The system does not check certain sof…
-
Unscored —
Cross Site Request Forgery vulnerability in Micro Focus Application Performance Management product, affecting versions …
-
Unscored —
Persistent Cross-Site scripting vulnerability in Micro Focus Application Performance Management product, affecting vers…
-
Unscored —
There is an out-of-bound read vulnerability in Mate 30 10.0.0.182(C00E180R6P2). A module does not verify the some input…
-
Unscored —
There is an information leak vulnerability in eCNS280_TD versions V100R005C00 and V100R005C10. A command does not have …
-
Unscored —
There is a pointer double free vulnerability in Taurus-AL00A 10.0.0.1(C00E1R1P1). There is a lack of muti-thread protec…
-
Unscored —
There is a weak algorithm vulnerability in Mate 3010.0.0.203(C00E201R7P2). The protection is insufficient for the modul…
-
Unscored —
Mate 30 10.0.0.203(C00E201R7P2) have a buffer overflow vulnerability. After obtaining the root permission, an attacker …
-
Unscored —
Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which …
-
Unscored —
OPPO Android Phone with MTK chipset and Android 8.1/9/10/11 versions have an information leak vulnerability. The “adb s…
-
Unscored —
A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versio…
-
Medium 5.9
Injection attack in Helm
Helm is open-source software which is essentially "The Kubernetes Package Manager". Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. In Helm from version 3.0 and before version 3.5.2, there a few cases where data…
-
Unscored —
Denial of service in ASUSWRT ASUS RT-AX3000 firmware versions 3.0.0.4.384_10177 and earlier versions allows an attacker…
-
Medium 6.0
NVIDIA GeForce Experience, all versions prior to 3.21, contains a vulnerability in GameStream (rxdiag.dll) where an arb…
-
Unscored —
An issue was discovered in New Media Smarty before 9.10. Passwords are stored in the database in an obfuscated format t…
-
Unscored —
An issue was discovered in Psyprax before 3.2.2. The Firebird database is accessible with the default user sysdba and p…
-
Unscored —
An issue was discovered in Psyprax before 3.2.2. The file %PROGRAMDATA%\Psyprax32\PPScreen.ini contains a hash for the …
-
Unscored —
An issue was discovered in Psyprax beforee 3.2.2. Passwords used to encrypt the data are stored in the database in an o…
-
Unscored —
Zulip Desktop before 5.0.0 improperly uses shell.openExternal and shell.openItem with untrusted content, leading to rem…
-
Unscored —
Zulip Desktop before 5.0.0 allows attackers to perform recording via the webcam and microphone due to a missing permiss…
-
Unscored —
In Epson iProjection v2.30, the driver file EMP_MPAU.sys allows local users to cause a denial of service (BSOD) or poss…
-
Unscored —
In Max Secure Max Spyware Detector 1.0.0.044, the driver file (MaxProc64.sys) allows local users to cause a denial of s…
-
Unscored —
The AscRegistryFilter.sys kernel driver in IObit Advanced SystemCare 13.2 allows an unprivileged user to send an IOCTL …
-
Unscored —
In Epson iProjection v2.30, the driver file (EMP_NSAU.sys) allows local users to cause a denial of service (BSOD) via c…