Archive
5 March 2021
Vulnerabilities first published on this day (UTC), newest first.
61 results · Feed
-
Unscored —
The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter.
-
Unscored —
Deutsche Post Mailoptimizer 4.3 before 2020-11-09 allows Directory Traversal via a crafted ZIP archive to the Upload fe…
-
Medium 6.5
This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected …
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R78…
-
Medium 6.3
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmwar…
-
Medium 6.3
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R780…
-
Unscored —
A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions …
-
High 8.1
Insufficient CSRF guards
Cross-Site Request Forgery (CSRF) vulnerability in web GUI of Secomea GateManager allows an attacker to execute malicious code. This issue affects: Secomea GateManager All versions prior to 9.4.
-
Critical 9.1
Reject Remote Management via Cellular UPLINK2
Improper Access Control vulnerability in web service of Secomea SiteManager allows remote attacker to access the web UI from the internet using the configured credentials. This issue affects: Secomea SiteManager All versions prior to 9.4.620527004 on Hardware.
-
Medium 6.3
Reflected XSS issues
Cross-site Scripting (XSS) vulnerability in web GUI of Secomea GateManager allows an attacker to inject arbitrary javascript code. This issue affects: Secomea GateManager all versions prior to 9.4.
-
High 7.3
XSS issue due to insufficient sanitization of input field
Improper Input Validation, Cross-site Scripting (XSS) vulnerability in Web GUI of Secomea GateManager allows an attacker to execute arbitrary javascript code. This issue affects: Secomea GateManager all versions prior to 9.4.
-
Unscored —
ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstr…
-
Medium 6.1
ansi_up cross-site scripting vulnerability
The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is f…
-
Unscored —
An issue was discovered in SquareBox CatDV Server through 9.2. An attacker can invoke sensitive RMI methods such as get…
-
Unscored —
An issue was discovered in OSSEC 3.6.0. An uncontrolled recursion vulnerability in os_xml.c occurs when a large number …
-
High 8.1CVE-2020-28502 Public exploit
Arbitrary Code Injection
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and …
-
Unscored —
In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node Attestor improperly normalizes the…
-
High 8.1
Legacy Node API Allows Impersonation in github.com/spiffe/spire/pkg/server/endpoints/node
In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID…
-
High 8.4
Add integrity check of GateManager firmware
Upload of Code Without Integrity Check vulnerability in firmware archive of Secomea GateManager allows authenticated attacker to execute malicious code on server. This issue affects: Secomea GateManager all versions prior to 9.4.621054022
-
Unscored —
A ZTE product has an information leak vulnerability. An attacker with higher authority can go beyond their authority to…
-
Unscored —
A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform ve…
-
Unscored —
A remote authenticated authenticated xml external entity (xxe) vulnerability was discovered in Aruba AirWave Management…
-
Unscored —
A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform ve…
-
Unscored —
Zoho ManageEngine Desktop Central before build 10.0.647 allows a single authentication secret from multiple agents to c…
-
Unscored —
A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platf…
-
Unscored —
A remote reflected cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version…
-
Unscored —
A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prio…
-
Unscored —
Zoho ManageEngine ADManager Plus before 7066 allows XSS.
-
Unscored —
A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prio…
-
Unscored —
A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform ve…
-
Unscored —
A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s)…
-
Unscored —
A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Pla…
-
Unscored —
A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform ve…
-
Unscored —
A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Pla…
-
Unscored —
The TOTVS Fluig platform allows path traversal through the parameter "file = .. /" encoded in base64. This affects all …
-
Unscored —
jpeg-xl v0.3.2 is affected by a heap buffer overflow in /lib/jxl/coeff_order.cc ReadPermutation. When decoding a malico…
-
Medium 5.4CVE-2021-27907 EPSS 86%
Apache Superset stored XSS on Dashboard markdown
Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the …
-
Unscored —
Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movab…
-
Unscored —
Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Ty…
-
Unscored —
Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7…