Archive
February 2021
Vulnerabilities first published in this month (UTC), newest first.
1,464 results · Feed
-
High 8.6
Prototype Pollution
This affects all versions of package decal. The vulnerability is in the set function.
-
High 8.6
Prototype Pollution
This affects all versions of package decal. The vulnerability is in the extend function.
-
Unscored —
An Insecure Direct Object Reference (IDOR) vulnerability was found in Prestashop Opart devis < 4.0.2. Unauthenticated a…
-
Unscored —
office is unmaintained, use calamine instead
The `office` crate is unmaintained. Use [calamine](https://crates.io/crates/calamine) for reading excel files. Contact the `office` author for ownership of the package name.
-
Unscored —
HCL OneTest Performance V9.5, V10.0, V10.1 uses basic authentication which is relatively weak. An attacker could potent…
-
Unscored —
HCL OneTest Performance V9.5, V10.0, V10.1 contains an inadequate session timeout, which could allow an attacker time t…
-
High 8.8
A memory corruption vulnerability exists in the Excel Document SST Record 0x00fc functionality of SoftMaker Software Gm…
-
Unscored —
HCL OneTest UI V9.5, V10.0, and V10.1 does not perform authentication for functionality that either requires a provable…
-
High 7.5
An exploitable denial of service vulnerability exists in the ENIP Request Path Network Segment functionality of Allen-B…
-
High 8.8
A specially crafted document can cause the document parser to copy data from a particular record type into a static-siz…
-
High 8.8
A specially crafted document can cause the document parser to copy data from a particular record type into a static-siz…
-
High 8.8
A specially crafted document can cause the document parser to copy data from a particular record type into a static-siz…
-
High 8.8CVE-2020-13579 EPSS 71%
An exploitable integer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Offic…
-
High 8.8CVE-2020-13580 EPSS 71%
An exploitable heap-based buffer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftM…
-
Unscored —
An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. In preloaded applications,…
-
Unscored —
An issue was discovered on LG Wing mobile devices with Android OS 10 software. The biometric sensor has weak security p…
-
Unscored —
An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. The USB laf gadget has a u…
-
Unscored —CVE-2021-3401 EPSS 11%
Bitcoin Core before 0.19.0 might allow remote attackers to execute arbitrary code when another application unsafely pas…
-
Unscored —CVE-2021-26024 EPSS 19%
The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to Insecure Direct Object Reference: it is possi…
-
Unscored —CVE-2021-26023 EPSS 25%
The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS.
-
Critical 9.8
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perfor…
KEV Nov 3, 2021 -
Unscored —
A username enumeration issue was discovered in SquaredUp before version 4.6.0. The login functionality was implemented …
-
Medium 4.4
Insecure Temporary File
This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between user…
-
Unscored —
Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Admin…
-
Unscored —
Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthori…
-
Unscored —
Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthori…
-
Unscored —CVE-2020-18724 Public exploit
Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 1…
-
Unscored —CVE-2020-18723 Public exploit
Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code…
-
Unscored —
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pa…
-
Critical 9.8
Authentication bypass in Apache Shiro
Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
-
Unscored —CVE-2021-25274 EPSS 36%
The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set …
-
Unscored —
The function CheckMic() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and exclud…
-
Unscored —
The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and …
-
Unscored —
SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backe…
-
Unscored —
The function AES_UnWRAP() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excl…
-
Unscored —
The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and …
-
Unscored —
The function ClientEAPOLKeyRecvd() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to…
-
Unscored —
A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack us…
-
High 7.5
Authentication Bypass in Apache Cassandra
Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user ca…
-
Unscored —
Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution …