Archive
2 March 2021
Vulnerabilities first published on this day (UTC), newest first.
39 results · Feed
-
Critical 9.1CVE-2021-27078 EPSS 22%
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
-
High 7.8
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
KEV Nov 3, 2021 -
High 7.8
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
KEV Nov 3, 2021 -
Critical 9.1
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
KEV Nov 3, 2021 -
High 7.8
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
KEV Nov 3, 2021 -
Medium 6.6CVE-2021-26854 EPSS 25%
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
-
Critical 9.1CVE-2021-26412 EPSS 34%
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
-
Medium 6.5
An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. Impro…
-
Medium 4.3
An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There…
-
Medium 5.8
An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2 There …
-
Medium 6.5
Improper Access Validation in products of MB connect line and Helmholz
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. Improper access validation allows a logged in user to shutdown or reboot devices in his account without having corr…
-
Medium 6.8
XSS injection in ajax/kanban
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI from version 9.5.0 and before version 9.5.4, there is a cross-site scripting injection vulnerability whe…
-
Medium 5.8
entities switch IDOR
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI version 9.5.3, it was possible to switch entities with IDOR from a logged in user. This is fixed in vers…
-
Unscored —CVE-2021-27885 Public exploit
usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7. A potential resource exhau…
-
Unscored —
A component API of the HarmonyOS 2.0 has a permission bypass vulnerability. Local attackers may exploit this vulnerabil…
-
Unscored —
In bPanel 2.0, the administrative ajax endpoints (aka ajax/aj_*.php) are accessible without authentication and allow SQ…
-
Unscored —
A component of HarmonyOS 2.0 has a DoS vulnerability. Local attackers may exploit this vulnerability to mount a file sy…
-
Unscored —
Calling of non-existent provider in MobileWips application prior to SMR Feb-2021 Release 1 allows unauthorized actions …
-
Unscored —
A vulnerability in Stormshield Network Security could allow an attacker to trigger a protection related to ARP/NDP tabl…
-
Medium 4.0
The IBM Application Performance Monitoring UI (IBM Cloud APM 8.1.4) allows web pages to be stored locally which can be …
-
Medium 4.3
IBM Monitoring (IBM Cloud APM 8.1.4 ) could allow an authenticated user to modify HTML content by sending a specially c…
-
Medium 4.9
The IBM Cloud APM 8.1.4 server will issue a DNS request to resolve any hostname specified in the Cloud Event Management…
-
Unscored —CVE-2020-23518 Public exploit
Cross Site Scripting (XSS) vulnerability in UltimateKode Neo Billing - Accounting, Invoicing And CRM Software up to ver…
-
Medium 4.9CVE-2021-21514 Public exploit
Dell EMC OpenManage Server Administrator (OMSA) versions 9.5 and prior contain a path traversal vulnerability. A remote…
-
High 8.6
Dell EMC OpenManage Server Administrator (OMSA) version 9.5 Microsoft Windows installations with Distributed Web Server…
-
Unscored —
Blackboard Collaborate Ultra 20.02 is affected by a cross-site scripting (XSS) vulnerability. The XSS payload will exec…
-
Medium 6.1
Stored XSS in Apache Ambari
A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4.
-
Unscored —
An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139. In the implementation of Sharing Groups, t…
-
Unscored —
An issue was discovered on LG mobile devices with Android OS 11 software. They mishandle fingerprint recognition becaus…
-
Critical 10.0
Prefix escape
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. I…
-
Critical 10.0
Prefix escape
fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server…
-
Low 2.6
User content sandbox can be confused into opening arbitrary documents
matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content sandbox can be abused to trick users into opening unexpected documents. The content is opened with a `blob` origin that …
-
Unscored —
Accellion FTA 9_12_432 and earlier is affected by argument injection via a crafted POST request to an admin endpoint. T…
-
Unscored —
Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed v…
-
Unscored —
The telnet administrator service running on port 650 on Gigaset DX600A v41.00-175 devices does not implement any lockou…
-
Unscored —
A buffer overflow vulnerability in the AT command interface of Gigaset DX600A v41.00-175 devices allows remote attacker…
-
Unscored —
JPEG XL (aka jpeg-xl) through 0.3.2 allows writable memory corruption.
-
Unscored —
ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters.