Archive
9 March 2021
Vulnerabilities first published on this day (UTC), newest first.
90 results · Feed
-
Unscored —
Use after free in bookmarks in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit hea…
-
High 8.8
Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corrupt…
KEV Nov 3, 2021 -
Unscored —
Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corrupt…
-
Unscored —
Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker t…
-
Unscored —
Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to …
-
Unscored —
Use after free in WebRTC in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap c…
-
Unscored —
Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploi…
-
Unscored —
Heap buffer overflow in WebAudio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploi…
-
Unscored —
Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploi…
-
Medium 6.8
Keycloak Missing authentication for critical function
A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. This flaw allows an attacker to take over an account if they can obtain temporary, physical access to a user’s browser. The highest threat from this vulner…
-
Unscored —
A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause th…
-
Unscored —
An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user…
-
Unscored —CVE-2021-20253 Public exploit
A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker …
-
Medium 4.9
An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Adm…
-
Medium 5.5
A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.200.2042, that could allow con…
-
Medium 4.9
An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, f…
-
Unscored —
Oozie local privilege escalation
There is a race condition in OozieSharelibCLI in Apache Oozie before version 5.2.1 which allows a malicious attacker to replace the files in Oozie's sharelib during it's creation.
-
Medium 5.3
IBM Cloud Pak for Multicloud Management Monitoring 2.2 returns potentially sensitive information in headers which could…
-
Critical 9.8
Changeset vulnerable to prototype pollution
Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Medium 4.3
When a user opens manipulated Universal 3D (.U3D) files received from untrusted sources in SAP 3D Visual Enterprise Vie…
-
Medium 4.3
When a user opens manipulated Tag Image File Format (.TIFF) format files received from untrusted sources in SAP 3D Visu…
-
Medium 4.3
When a user opens manipulated PhotoShop Document (.PSD) format files received from untrusted sources in SAP 3D Visual E…
-
Medium 4.3
When a user opens manipulated HPGL format files received from untrusted sources in SAP 3D Visual Enterprise Viewer vers…
-
Medium 4.3
When a user opens manipulated Interchange File Format (.IFF) format files received from untrusted sources in SAP 3D Vis…
-
Medium 4.3
When a user opens manipulated Jupiter Tessellation (.JT) format files received from untrusted sources in SAP 3D Visual …
-
Medium 4.3
When a user opens manipulated Portable Document Format (.PDF) format files received from untrusted sources in SAP 3D Vi…
-
Medium 4.3
When a user opens manipulated Scalable Vector Graphics (.SVG) format files received from untrusted sources in SAP 3D Vi…
-
Medium 4.3
When a user opens manipulated Computer Graphics Metafile (.CGM) format files received from untrusted sources in SAP 3D …
-
High 7.7
LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configure…
-
Medium 6.8
SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in…
-
Critical 9.9CVE-2021-21480 EPSS 52%
SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment).…
-
Medium 4.3
When a user opens manipulated Graphics Interchange Format (.GIF) format files received from untrusted sources in SAP 3D…
-
Medium 6.8
SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does …
-
Medium 6.5
Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to dese…
-
Critical 9.6
The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perfor…
-
Unscored —
A flaw was found in privoxy before 3.0.32. Invalid memory access with an invalid pattern passed to pcre_compile() may l…
-
Unscored —
A flaw was found in privoxy before 3.0.32. A invalid read of size two may occur in chunked_body_is_complete() leading t…
-
Unscored —
A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks server misbe…
-
Unscored —
A flaw was found in privoxy before 3.0.32. A crash can occur via a crafted CGI request if Privoxy is toggled off.
-
Unscored —
A flaw was found in privoxy before 3.0.32. An assertion failure could be triggered with a crafted CGI request leading t…