Archive
3 March 2021
Vulnerabilities first published on this day (UTC), newest first.
57 results · Feed
-
Low 3.0
DataDog API Client contains a Local Information Disclosure Vulnerability
The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the API Client. The Datadog API is executed on a unix-like system with multiple users. The API is used to …
-
Medium 6.1
openark/orchestrator cross-site scripting vulnerability
resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter.
-
Unscored —CVE-2021-27931 EPSS 18%
LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageContro…
-
Unscored —
An issue was discovered in AdGuard before 0.105.2. An attacker able to get the user's cookie is able to bruteforce thei…
-
Medium 5.4
XSS injection on ticket update
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is an XSS vulnerability involving a logged in user while updating a ticket.
-
Medium 5.4
Stored XSS on documents
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability within the document upload function (Home > Management > Do…
-
Medium 4.9
XSS on tabs
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability in the /ajax/common.tabs.php endpoint, indeed, at least two…
-
Unscored —
A CSV injection vulnerability found in Online Invoicing System (OIS) 4.3 and below can be exploited by users to perform…
-
Critical 9.8
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key…
KEV Mar 5, 2026 -
Low 3.5
An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS…
-
Medium 5.3
An issue has been discovered in GitLab affecting all versions starting with 13.0. Confidential issue titles in Gitlab w…
-
High 8.8
A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A s…
-
High 8.6
An out-of-bounds read vulnerability exists in the AMF File AMFParserContext::endElement() functionality of Slic3r libsl…
-
Critical 9.8
A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predictin…
-
Unscored —
VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input va…
-
Unscored —
Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured.
-
Unscored —
Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `…
-
Unscored —
A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users exte…
-
Unscored —CVE-2021-22883 EPSS 77%
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connect…
-
Unscored —CVE-2021-22884 EPSS 37%
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes …
-
Unscored —CVE-2020-29047 EPSS 16%
The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of a…
-
Medium 5.9
IBM Security Verify Bridge contains hard-coded credentials, such as a password or cryptographic key, which it uses for …
-
Medium 5.9
IBM Security Verify Bridge uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h…
-
Unscored —
The [Webform module for Drupal 8/9](https://www.drupal.org/project/webform) includes a default Contact webform, which s…
-
Unscored —CVE-2021-20233 Public exploit
A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length cal…
-
Unscored —
A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a he…
-
Unscored —CVE-2020-25632 Public exploit
A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as …
-
Unscored —
A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very l…
-
Unscored —CVE-2020-14372 Public exploit
A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Se…
-
Unscored —
A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line i…
-
Unscored —
A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an …
-
Unscored —
Tenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 were found to contain a vulnerability that could allow an…
-
Unscored —
In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r…
-
High 8.8
An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCA…
-
Unscored —
Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds read while processing project files, allowi…
-
Unscored —
Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files, allow…
-
Unscored —
Fatek FvDesigner Version 1.5.76 and prior is vulnerable to a stack-based buffer overflow while project files are being …
-
Unscored —
An uninitialized pointer may be exploited in Fatek FvDesigner Version 1.5.76 and prior while the application is process…
-
Unscored —
A use after free issue has been identified in Fatek FvDesigner Version 1.5.76 and prior in the way the application proc…
-
Medium 4.7
An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allo…