Archive
February 2021
Vulnerabilities first published in this month (UTC), newest first.
1,464 results · Feed
-
Unscored —
SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS.
-
Unscored —
SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal.
-
High 7.3CVE-2020-2506 Exploited
improper access control vulnerability in Helpdesk
The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This iss…
KEV Mar 25, 2022 -
Unscored —CVE-2020-35667 Public exploit
JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials.
-
Critical 9.8
command injection vulnerability in Helpdesk
The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.
-
Unscored —
In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.
-
Unscored —
In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.
-
Unscored —
SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS.
-
Unscored —
SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection.
-
Unscored —
In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails,…
-
Unscored —
In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users.
-
Unscored —
In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user.
-
Unscored —
In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.
-
Unscored —
In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration.
-
Unscored —
JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.
-
Unscored —
In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed.
-
Unscored —
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code …
-
Unscored —
In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments.
-
Unscored —
In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly.
-
Unscored —
In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution.
-
Unscored —
In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made.
-
Unscored —
In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permis…
-
Unscored —
In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.
-
Unscored —
In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible.
-
Unscored —
In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default.
-
Unscored —
In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible.
-
Medium 5.3
Incorrect Default Permissions in JetBrains Kotlin
In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.
-
Unscored —
In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible.
-
Unscored —
In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user.
-
Unscored —
In JetBrains Hub before 2020.1.12629, an open redirect was possible.
-
High 7.3
integer overflow in calloc
In Wind River VxWorks, memory allocator has a possible overflow in calculating the memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corrupti…
-
Unscored —
In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to loc…
-
Unscored —
In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS.
-
Unscored —
In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to th…
-
Unscored —
Certain Moxa Inc products are affected by an improper restriction of operations in EDR-G903 Series Firmware Version 5.5…
-
Unscored —
PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by file read/manipulation, which can result in remote i…
-
Unscored —
PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by incorrect access control, which can result in remote…
-
Unscored —CVE-2020-29164 Scanner template
PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by cross-site scripting (XSS).
-
Unscored —
PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by SQL injection.
-
Unscored —
CSRF protection was not present in SquaredUp before version 4.6.0. A CSRF attack could have been possible by an adminis…