Archive
February 2021
Vulnerabilities first published in this month (UTC), newest first.
1,464 results · Feed
-
Unscored —
The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from ver…
-
High 7.2
Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4
OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrators to perform remote code execution. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20…
-
High 7.2
Authenticated command path traversal on timezone settings in Guardian/CMC before 20.0.7.4
Path Traversal vulnerability when changing timezone using web GUI of Nozomi Networks Guardian, CMC allows an authenticated administrator to read-protected system files. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3 and prior versions.…
-
Unscored —
MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode).
-
Unscored —
Genymotion Desktop through 3.2.0 leaks the host's clipboard data to the Android application by default. NOTE: the vendo…
-
Unscored —
An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys ar…
-
Unscored —
"Tasks" application version before 9.7.3 is affected by insecure permissions. The VoiceCommandActivity application comp…
-
Unscored —
In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local f…
-
Unscored —
A stored XSS issue exists in Appspace 6.2.4. After a user is authenticated and enters an XSS payload under the groups s…
-
Unscored —
Buffer overflow in Yz1 0.30 and 0.32, as used in IZArc 4.4, ZipGenius 6.3.2.3116, and Explzh (extension) 8.14, allows a…
-
Unscored —
A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0. A remote attacker can send a malicio…
-
Unscored —
Automated Logic Corporation (ALC) WebCTRL System 6.5 and prior allows remote attackers to execute any JavaScript code v…
-
Unscored —
The Contact page in Monica 2.19.1 allows stored XSS via the First Name field.
-
Unscored —CVE-2021-27370 Public exploit
The Contact page in Monica 2.19.1 allows stored XSS via the Last Name field.
-
Unscored —
The Contact page in Monica 2.19.1 allows stored XSS via the Description field.
-
Unscored —
The Contact page in Monica 2.19.1 allows stored XSS via the Nickname field.
-
Unscored —
The Contact page in Monica 2.19.1 allows stored XSS via the Middle Name field.
-
Critical 9.8CVE-2021-3120 EPSS 37%
An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress all…
-
Unscored —
Out of bound read access in hypervisor due to an invalid read access attempt by passing invalid addresses in Snapdragon…
-
Unscored —
Denial of service in WLAN module due to improper check of subtypes in logic where excessive frames are dropped in Snapd…
-
Unscored —
Arithmetic overflow can happen while processing NOA IE due to improper error handling in Snapdragon Auto, Snapdragon Co…
-
Unscored —
Allowing RTT frames to be linked with non randomized MAC address by comparing the sequence numbers can lead to informat…
-
Unscored —
A buffer overflow can occur when playing an MKV clip due to lack of input validation in Snapdragon Auto, Snapdragon Com…
-
Unscored —
An Untrusted Pointer Dereference can occur while doing USB control transfers, if multiple requests of different standar…
-
Unscored —
Improper access control when using mmap with the kgsl driver with a special offset value that can be provided to map th…
-
Unscored —
Allowing RTT frames to be linked with non randomized MAC address by comparing the sequence numbers can lead to informat…
-
Unscored —
Denial of service while processing fine timing measurement request (FTMR) frame with reserved bits set in the FTM param…
-
Unscored —
Possible denial of service while handling host WMI command due to improper validation in Snapdragon Auto, Snapdragon Co…
-
Unscored —
Possible race condition during async fastrpc session after sending RPC message due to the fastrpc ctx gets free during …
-
Unscored —
Possible buffer over read while processing P2P IE and NOA attribute of beacon and probe response frames due to improper…
-
Unscored —
Possible buffer over-read while parsing quiet IE in Rx beacon frame due to improper check of IE length in received beac…
-
Unscored —
Before enqueuing a frame to the PE queue for further processing, an entry in a hash table can be deleted and using a st…
-
Unscored —
Possible out of bounds while accessing global control elements due to race condition in Snapdragon Auto, Snapdragon Com…
-
Unscored —
Possible denial of service due to RTT responder consistently rejects all FTMR by transmitting FTM1 with failure status …
-
Unscored —
Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Sna…
-
Unscored —
Arbitrary memory write issue in video driver while setting the internal buffers in Snapdragon Auto, Snapdragon Compute,…
-
Unscored —
Out of bound in camera driver due to lack of check of validation of array index before copying into array in Snapdragon…
-
Unscored —
Stack overflow may occur if GSM/WCDMA broadcast config size received from user is larger than variable length array in …
-
Unscored —
Possible memory corruption and information leakage in sub-system due to lack of check for validity and boundary complia…
-
Unscored —
Key material used for TZ diag buffer encryption and other data related to log buffer is not wiped securely due to impro…