Skip to content
OpenAdvisories

Archive

5 March 2021

Vulnerabilities first published on this day (UTC), newest first.

← February 2021 2021 / March /5 April 2021 →
  1. 130
  2. 239
  3. 357
  4. 467
  5. 561
  6. 61
  7. 76
  8. 826
  9. 990
  10. 10102
  11. 11121
  12. 1247
  13. 135
  14. 14 
  15. 1565
  16. 1622
  17. 1739
  18. 1896
  19. 1942
  20. 206
  21. 216
  22. 2251
  23. 2366
  24. 2486
  25. 2571
  26. 2672
  27. 272
  28. 28 
  29. 2945
  30. 3078
  31. 3156
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 8.8
    CVE-2021-27256

    This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R78…

    NETGEAR R7800 Network devices
  • High 8.1
    CVE-2020-29030

    Insufficient CSRF guards

    Cross-Site Request Forgery (CSRF) vulnerability in web GUI of Secomea GateManager allows an attacker to execute malicious code. This issue affects: Secomea GateManager All versions prior to 9.4.

    Secomea GateManager
  • High 7.3
    CVE-2020-29029

    XSS issue due to insufficient sanitization of input field

    Improper Input Validation, Cross-site Scripting (XSS) vulnerability in Web GUI of Secomea GateManager allows an attacker to execute arbitrary javascript code. This issue affects: Secomea GateManager all versions prior to 9.4.

    Secomea GateManager
  • High 8.1
    CVE-2020-28502 Public exploit

    Arbitrary Code Injection

    This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and …

    xmlhttprequest-ssl node-xmlhttprequest-ssl node-xmlhttprequest node-xmlhttprequest Debian Ubuntu npm
  • High 8.1
    CVE-2021-27098

    Legacy Node API Allows Impersonation in github.com/spiffe/spire/pkg/server/endpoints/node

    In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID…

    github.com/spiffe/spire Go
  • High 8.4
    CVE-2020-29032

    Add integrity check of GateManager firmware

    Upload of Code Without Integrity Check vulnerability in firmware archive of Secomea GateManager allows authenticated attacker to execute malicious code on server. This issue affects: Secomea GateManager all versions prior to 9.4.621054022

    Secomea GateManager
  • High 7.5
    CVE-2021-28030

    Use of Uninitialized Resource in truetype

    An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation within Tape::take_bytes.

    truetype crates.io
  • High 7.5
    CVE-2021-28036

    quinn invalidly assumes the memory layout of std::net::SocketAddr

    An issue was discovered in the quinn crate before 0.7.0 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures.

    quinn crates.io
  • High 7.1
    CVE-2021-25313

    Rancher: XSS on /v3/cluster/

    A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rancher allows remote attackers to execute JavaScript via malicious links. This issue affects: SUSE Rancher Rancher versions prior to 2.5.6.

    SUSE Rancher github.com/rancher/rancher Go