Skip to content
OpenAdvisories

Archive

4 March 2021

Vulnerabilities first published on this day (UTC), newest first.

← February 2021 2021 / March /4 April 2021 →
  1. 130
  2. 239
  3. 357
  4. 467
  5. 561
  6. 61
  7. 76
  8. 826
  9. 990
  10. 10102
  11. 11121
  12. 1247
  13. 135
  14. 14 
  15. 1565
  16. 1622
  17. 1739
  18. 1896
  19. 1942
  20. 206
  21. 216
  22. 2251
  23. 2366
  24. 2486
  25. 2571
  26. 2672
  27. 272
  28. 28 
  29. 2945
  30. 3078
  31. 3156
All Critical High Medium Low Exploited only Public exploit

67 results · Feed

  • Medium —
    CVE-2021-26028

    [20210308] - Core - Path Traversal within joomla/archive zip class

    An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path.

    Joomla! Project Joomla! CMS joomla/archive Web / CMS Packagist
  • Unscored —
    CVE-2021-23129

    [20210303] - Core - XSS within alert messages showed to users

    An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of messages showed to users that could lead to xss issues.

    Joomla! Project Joomla! CMS Web / CMS
  • Unscored —
    CVE-2021-23128

    [20210302] - Core - Potential Insecure FOFEncryptRandval

    An issue was discovered in Joomla! 3.2.0 through 3.9.24. The core shipped but unused randval implementation within FOF (FOFEncryptRandval) used an potential insecure implemetation. That has now been replaced with a call to 'random_bytes()' and its backport th…

    Joomla! Project Joomla! CMS Web / CMS
  • Unscored —
    CVE-2021-23127

    [20210301] - Core - Insecure randomness within 2FA secret generation

    An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes.

    Joomla! Project Joomla! CMS Web / CMS
  • Unscored —
    CVE-2021-23131

    [20210305] - Core - Input validation within the template manager

    An issue was discovered in Joomla! 3.2.0 through 3.9.24. Missing input validation within the template manager.

    Joomla! Project Joomla! CMS Web / CMS
  • Unscored —
    CVE-2021-23130

    [20210304] - Core - XSS within the feed parser library

    An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues.

    Joomla! Project Joomla! CMS Web / CMS
  • Unscored —
    CVE-2021-23126

    [20210301] - Core - Insecure randomness within 2FA secret generation

    An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand() function within the process of generating the 2FA secret.

    Joomla! Project Joomla! CMS Web / CMS
  • Unscored —
    CVE-2021-23132 Public exploit

    [20210306] - Core - com_media allowed paths that are not intended for image uploads

    An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intended for image uploads

    Joomla! Project Joomla! CMS Web / CMS
  • Medium 4.0
    CVE-2020-15938

    When traffic other than HTTP/S (eg: SSH traffic, etc...) traverses the FortiGate in version below 6.2.5 and below 6.4.2…

    Fortinet Fortinet FortiOS Network devices
  • High 7.1
    CVE-2021-22128

    An improper access control vulnerability in FortiProxy SSL VPN portal 2.0.0, 1.2.9 and below versions may allow an auth…

    Fortinet Fortinet FortiProxy Network devices
  • Medium 4.8
    CVE-2021-23346

    Regular Expression Denial of Service (ReDoS)

    This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process.

    html-parse-stringify2 html-parse-stringify npm
  • Critical 9.8
    CVE-2021-23344

    Remote Code Execution (RCE)

    The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.

    total.js npm
  • Unscored —
    CVE-2020-35329

    Courier Management System 1.0 1.0 is affected by SQL Injection via 'MULTIPART street '.

  • Unscored —
    CVE-2020-35328

    Courier Management System 1.0 - 'First Name' Stored XSS

  • Unscored —
    CVE-2020-35327

    SQL injection vulnerability was discovered in Courier Management System 1.0, which can be exploited via the ref_no (POS…

  • Medium 4.1
    CVE-2021-22183

    An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.9
    CVE-2021-22189

    Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Critical 9.8
    CVE-2020-24914

    qcubed PHP object injection

    A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request.

    qcubed/qcubed Packagist
  • Critical 9.8
    CVE-2020-24913 Public exploit EPSS 41%

    qcubed SQL injection vulnerability in profile.php via the strQuery parameter

    A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.

    qcubed/qcubed Packagist
  • Medium 6.1
    CVE-2020-24912 Scanner template

    qcubed reflected cross-site scripting (XSS) vulnerability

    A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.

    qcubed/qcubed Packagist
  • Unscored —
    CVE-2020-24036

    PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote …

  • Unscored —
    CVE-2019-18629

    Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software rel…

  • Unscored —
    CVE-2019-18628

    Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software rel…

  • Critical 10.0
    CVE-2020-35628

    A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read …

    cgal cgal Debian Ubuntu
  • Critical 10.0
    CVE-2020-35636

    A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC…

    cgal cgal Debian Ubuntu
  • Critical 10.0
    CVE-2020-28601

    A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read …

    cgal cgal Debian Ubuntu
  • Critical 10.0
    CVE-2020-28636

    A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read …

    cgal cgal Debian Ubuntu