Archive
February 2021
Vulnerabilities first published in this month (UTC), newest first.
1,464 results · Feed
-
Unscored —
Buffer overflow in pdf2json 0.69 allows local users to execute arbitrary code by converting a crafted PDF file.
-
Medium 6.1
LinkedIn Oncall vulnerable to Cross-Site Scripting
LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar.
-
Unscored —
Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting (XSS), which may lead to arbitrary rem…
-
Unscored —
An issue was discovered in Typora 0.9.67. There is an XSS vulnerability that causes Remote Code Execution.
-
High 7.0
Buffer Overflow in gitea
Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors related to a file path.
-
Medium 6.2
IBM PowerHA 7.2 could allow a local attacker to obtain sensitive information from temporary directories after a discove…
-
Unscored —
Opmantek Open-AudIT 4.0.1 is affected by cross-site scripting (XSS). When outputting SQL statements for debugging, a ma…
-
Unscored —
Video Insight VMS versions prior to 7.8 allows a remote attacker to execute arbitrary code with the system user privile…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack …
-
Unscored —
An issue was discovered in Epikur before 20.1.1. The Epikur server contains the checkPasswort() function that, upon use…
-
Unscored —
An issue was discovered in Epikur before 20.1.1. It stores the secret passwords of the users as MD5 hashes in the datab…
-
Unscored —
An issue was discovered in Epikur before 20.1.1. A Glassfish 4.1 server with a default configuration is running on TCP …
-
Unscored —
In Electric Coin Company Zcashd before 2.1.1-1, the time offset between messages could be leveraged to obtain sensitive…
-
Unscored —
Electric Coin Company Zcashd before 2.1.1-1 allows attackers to trigger consensus failure and double spending. A valid …
-
Unscored —CVE-2020-35765 EPSS 27%
doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows…
-
Unscored —CVE-2021-26710 Scanner template
A cross-site scripting (XSS) issue in the login panel in Redwood Report2Web 4.3.4.5 and 4.5.3 allows remote attackers t…
-
Unscored —
A frame-injection issue in the online help in Redwood Report2Web 4.3.4.5 allows remote attackers to render an external …
-
Unscored —CVE-2021-26708 Public exploit
A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOC…
-
Unscored —
autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Di…
-
Critical 9.8
October CMS Session ID not invalidated after logout
An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant…
-
Unscored —
A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submi…
-
Unscored —
SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parameter filte…
-
Unscored —
SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordA…
-
Unscored —
SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordM…
-
Unscored —
SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in custo…
-
Unscored —
An out-of-bounds write information disclosure vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG S…
-
Unscored —
An out-of-bounds read information disclosure vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP…
-
Unscored —
An improper access control information disclosure vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeS…
-
Unscored —
An improper access control vulnerability in Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user t…
-
Unscored —
An improper access control vulnerability in Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user t…
-
Unscored —
An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free …
-
Unscored —
A server-side request forgery (SSRF) information disclosure vulnerability in Trend Micro Apex One and Worry-Free Busine…
-
Unscored —
An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free …
-
Unscored —
An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free …
-
Unscored —
An improper access control vulnerability in Trend Micro Apex One (on-prem), OfficeScan XG SP1, and Worry-Free Business …
-
Unscored —
An improper access control information disclosure vulnerability in Trend Micro OfficeScan XG SP1 and Worry-Free Busines…
-
Unscored —
An improper access control vulnerability in Trend Micro Apex One (on-prem) could allow an unauthenticated user to obtai…
-
Unscored —
A server-side request forgery (SSRF) information disclosure vulnerability in Trend Micro OfficeScan XG SP1 and Worry-Fr…
-
Unscored —
An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS) and OfficeScan XG SP1 could allow a…
-
Unscored —
An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free …