Archive
9 March 2021
Vulnerabilities first published on this day (UTC), newest first.
24 results · Clear filters · Feed
-
Medium 5.9CVE-2021-21295 EPSS 19%
Possible request smuggling in HTTP/2 due missing validation
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that…
-
Medium 5.9
Regular Expression Denial of Service (ReDoS)
This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.
-
Medium 6.5
Potential DoS in Besu HTTP JSON-RPC API
Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerability involving the HTTP JSON-RPC API service. If username and password authentication is enabled for th…
-
Medium 6.8
Keycloak Missing authentication for critical function
A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. This flaw allows an attacker to take over an account if they can obtain temporary, physical access to a user’s browser. The highest threat from this vulner…
-
Medium 4.9
An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Adm…
-
Medium 5.5
A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.200.2042, that could allow con…
-
Medium 4.9
An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, f…
-
Medium 5.3
IBM Cloud Pak for Multicloud Management Monitoring 2.2 returns potentially sensitive information in headers which could…
-
Medium 4.3
When a user opens manipulated Universal 3D (.U3D) files received from untrusted sources in SAP 3D Visual Enterprise Vie…
-
Medium 4.3
When a user opens manipulated Tag Image File Format (.TIFF) format files received from untrusted sources in SAP 3D Visu…
-
Medium 4.3
When a user opens manipulated PhotoShop Document (.PSD) format files received from untrusted sources in SAP 3D Visual E…
-
Medium 4.3
When a user opens manipulated HPGL format files received from untrusted sources in SAP 3D Visual Enterprise Viewer vers…
-
Medium 4.3
When a user opens manipulated Interchange File Format (.IFF) format files received from untrusted sources in SAP 3D Vis…
-
Medium 4.3
When a user opens manipulated Jupiter Tessellation (.JT) format files received from untrusted sources in SAP 3D Visual …
-
Medium 4.3
When a user opens manipulated Portable Document Format (.PDF) format files received from untrusted sources in SAP 3D Vi…
-
Medium 4.3
When a user opens manipulated Scalable Vector Graphics (.SVG) format files received from untrusted sources in SAP 3D Vi…
-
Medium 4.3
When a user opens manipulated Computer Graphics Metafile (.CGM) format files received from untrusted sources in SAP 3D …
-
Medium 6.8
SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in…
-
Medium 4.3
When a user opens manipulated Graphics Interchange Format (.GIF) format files received from untrusted sources in SAP 3D…
-
Medium 6.8
SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does …
-
Medium 6.5
Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to dese…
-
Medium 5.3
Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin
The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being e…
-
Medium 5.3
Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetup
Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before version 2.1.1 there is an information disclosure vulnerability - anonymous visitors may view log and…
-
Medium 5.6
react-dev-utils OS Command Injection in function `getProcessForPort`
react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. O…