Archive
February 2021
Vulnerabilities first published in this month (UTC), newest first.
1,464 results · Feed
-
Unscored —
Out of bound write and read in TA while processing command from NS side due to improper length check on command and res…
-
Unscored —
Possible out of bound access in TA while processing a command from NS side due to improper length check of response buf…
-
Unscored —
User can overwrite Security Code NV item without knowing current SPC due to improper validation of SPC code setting and…
-
Unscored —
Possible memory corruption in BSI module due to improper validation of parameter count in Snapdragon Auto, Snapdragon C…
-
Unscored —
Out of bound memory access while playing music playbacks with crafted vorbis content due to improper checks in header e…
-
Unscored —
Use after free issue in audio modules while removing and freeing objects during list iteration due to incorrect usage o…
-
Unscored —
Possible buffer overflow while updating ikev2 parameters due to lack of check of input validation for certain parameter…
-
Medium 6.1
MantisBT XSS in manage_custom_field_update.php
An issue was discovered in MantisBT through 2.24.3. In the helper_ensure_confirmed call in manage_custom_field_update.php, the custom field name is not sanitized. This may be problematic depending on CSP settings.
-
Unscored —
An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. Because the local notification service…
-
Unscored —
An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. There is cross-site scripting (XSS) in…
-
High 7.4
Django Channels leakage of session identifiers using legacy AsgiHandler
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not corre…
-
Unscored —
In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, b…
-
Unscored —
On Netshield NANO 25 10.2.18 devices, /usr/local/webmin/System/manual_ping.cgi allows OS command injection (after authe…
-
Critical 9.8CVE-2021-26120 EPSS 82%
PHP Code Injection by malicious function name in smarty
Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.
-
High 7.5
Sandbox escape through template_object in smarty
Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.
-
High 7.5
URIjs Hostname spoofing via backslashes in URL
URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
-
Unscored —
The module admin_ITSM in EyesOfNetwork 5.3-10 allows remote authenticated users to upload arbitrary .xml.php files beca…
-
Unscored —
EyesOfNetwork 5.3-10 uses an integer of between 8 and 10 digits for the session ID, which might be leveraged for brute-…
-
Unscored —
Modules/input/Views/schedule.php in Emoncms through 10.2.7 allows XSS via the node parameter.
-
Medium 5.3
Path traversal in url-parse
url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
-
Medium 5.4
Apache Livy (Incubating) is vulnerable to cross site scripting
Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in …
-
High 8.8
Integer Overflow in png-img
An integer overflow in the PngImg::InitStorage_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file.
-
Unscored —
An issue was discovered in SmartStoreNET before 4.1.0. Lack of Cross Site Request Forgery (CSRF) protection may lead to…
-
Unscored —
Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campai…
-
Medium 5.9
Improper Certificate Validation in TweetStream
TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.
-
Medium 5.9
Improper Certificate Validation in twitter-stream
In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library (because eventmachine is misused).
-
Unscored —
An issue was discovered in Alfresco Enterprise Content Management (ECM) before 6.2.1. A user with privileges to edit a …
-
Medium 6.5
Unauthorized access to Class instance in Jinjava
Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure.
-
Medium 6.1
Open redirect in Slashify
The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring.
-
Unscored —
In Visualware MyConnection Server before 11.0b build 5382, each published report is not associated with its own access …
-
High 7.5
Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric FA Engineering Software (CPU M…
-
High 7.5
Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configurati…
-
Unscored —
A NULL pointer dereference flaw in Linux kernel versions prior to 5.11 may be seen if sco_sock_getsockopt function in n…
-
Unscored —
A stack-based buffer overflow in res_rtp_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x be…
-
Unscored —
The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and …
-
Unscored —
A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus…
-
Unscored —CVE-2021-27328 Public exploit
Yeastar NeoGate TG400 91.3.0.3 devices are affected by Directory Traversal. An authenticated user can decrypt firmware …
-
High 7.5
Metasys Reporting Engine (MRE) Web Services - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Path Traversal vulnerability exists in Metasys Reporting Engine (MRE) Web Services which could allow a remote unauthenticated attacker to access and download arbitrary files from the system.
-
Unscored —
Fuji Electric V-Server Lite
The affected Fuji Electric V-Server Lite versions prior to 3.3.24.0 are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbitrary code.
-
High 8.8
An exploitable local privilege elevation vulnerability exists in the file system permissions of Sytech XL Reporter v14.…