Archive
February 2021
Vulnerabilities first published in this month (UTC), newest first.
1,464 results · Feed
-
Unscored —
A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Pri…
-
Unscored —
A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior …
-
Unscored —
Snow Inventory Agent through 6.7.0 on Windows uses CPUID to report on processor types and versions that may be deployed…
-
Unscored —
A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior …
-
Unscored —
fastadmin V1.0.0.20200506_beta contains a cross-site scripting (XSS) vulnerability which may allow an attacker to obtai…
-
Unscored —
A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cau…
-
Unscored —
A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use…
-
Unscored —CVE-2020-16243 EPSS 12%
Multiple buffer overflow vulnerabilities exist when LeviStudioU (Version 2019-09-21 and prior) processes project files.…
-
Unscored —
The WADashboard component of WebAccess/SCADA Versions 9.0 and prior may allow an attacker to control or influence a pat…
-
Medium —
Incorrect Authorization in Spring Cloud Netflix Zuul
Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs. Applications that use Spr…
-
High 7.4
The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can …
-
Unscored —
"loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. Before doing …
-
Medium 4.3
IBM Planning Analytics 2.0 could allow a remote authenticated attacker to obtain information about an organization's in…
-
High 7.3
Command Injection
All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})
-
Unscored —
Polaris Office v9.102.66 is affected by a divide-by-zero error in PolarisOffice.exe and EngineDLL.dll that may cause a …
-
Unscored —
KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned i…
-
High 7.3
Keycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers
A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) an attacker can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection …
-
Low 3.5
SSRF in Rendertron
Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery (SSRF) attack. An attacker can use a specially crafted webpage to force a rendertron headless chrome process to render internal sites it has access to, and display it as a…
-
Medium —
NanoHTTPD Cross-site Scripting vulnerability
An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler …
-
Unscored —
An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certa…
-
Unscored —
An issue was discovered in libxls before and including 1.6.1 when reading Microsoft Excel files. A NULL pointer derefer…
-
High 7.1
PDF Injection BlackHat Talk
Acrobat Reader DC versions 2020.013.20066 (and earlier), 2020.001.30010 (and earlier) and 2017.011.30180 (and earlier) are affected by an information exposure vulnerability, that could enable an attacker to get a DNS interaction and track if the user has open…
-
Unscored —
Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering v…
-
Unscored —
Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering v…
-
Unscored —
Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering v…
-
Unscored —
Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering v…
-
Medium 5.9CVE-2021-27568 Public exploit
Improper Check for Unusual or Exceptional Conditions in json-smart
An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the l…
-
Unscored —
Chatbox is affected by cross-site scripting (XSS). An attacker has to upload any XSS payload with SVG, XML file in Chat…
-
Unscored —
In ImageMagick, there is an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-priv…
-
Unscored —
The CIRA Canadian Shield app before 4.0.13 for iOS lacks SSL Certificate Validation.
-
Unscored —
Keybase Desktop Client before 5.6.0 on Windows and macOS, and before 5.6.1 on Linux, allows an attacker to obtain poten…
-
Unscored —
Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially…
-
Unscored —
Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to potentially exploit hea…
-
Unscored —
Heap buffer overflow in Tab Strip in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker who had …
-
Unscored —
Heap buffer overflow in Tab Strip in Google Chrome prior to 88.0.4324.182 allowed a remote attacker who had compromised…
-
Unscored —
Stack buffer overflow in GPU Process in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to pote…
-
Unscored —
Heap buffer overflow in Media in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially…
-
Unscored —
Use after free in Downloads in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker who had compro…
-
Unscored —
Use after free in Payments in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to potentially perform a s…
-
Unscored —
Stack buffer overflow in Data Transfer in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to pe…