Archive
12 March 2021
Vulnerabilities first published on this day (UTC), newest first.
47 results · Feed
-
Medium —
Authenticated remote code execution
### Impact Authenticated remote code execution using plugin manager without ACL permissions. ### Patches We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overv…
-
High —
Vulnerability allowing for reading internal HTTP resources
### Impact The vulnerability allows for reading and outputting files served by other services on the internal network in which the export server is hosted. If the export server is exposed to the internet, this potentially allows a malicious user to gain read …
-
Critical —
Code injection in nobelprizeparser
Code injection through use of eval.
-
Medium —
Verification flaw in Solid identity-token-verifier
### Impact #### Severity Any Pod on a Solid server using a vulnerable version of the identity-token-verifier library is at risk of a spoofed Demonstration of Proof-of-Possession (DPoP) token binding. This vulnerability could give total and complete access to …
-
High 7.5
Regular Expression Denial of Service (ReDoS)
ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the stri…
-
Medium 6.1
Command Injection in @theia/messages
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.
-
Medium 6.1
Improper Neutralization of Input in Theia console
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.
-
High 7.5
Regular Expression Denial of Service (ReDoS)
The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time.
-
High 7.8
Dell SupportAssist Client for Consumer PCs versions 3.7.x, 3.6.x, 3.4.x, 3.3.x, Dell SupportAssist Client for Business …
-
Critical 9.8
A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory…
-
Unscored —
A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption …
-
High 7.8
Adobe Photoshop Memory Corruption
Adobe Photoshop versions 21.2.5 (and earlier) and 22.2 (and earlier) are affected by a Memory Corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in …
-
Medium 6.5
Adobe Creative Cloud Unquoted Service Path in CCXProcess
Adobe Creative Cloud Desktop Application version 5.3 (and earlier) is affected by an Unquoted Service Path vulnerability in CCXProcess that could allow an attacker to achieve arbitrary code execution in the process of the current user. Exploitation of this is…
-
High 7.1
Adobe Animate out-of-bounds read vulnerability
Adobe Animate version 21.0.3 (and earlier) is affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose sensitive information in the context of the current user. Exploitation of this issue requi…
-
High 7.8CVE-2021-21056 EPSS 23%
Adobe FrameMaker Out-of-Bounds Read Vulnerability Could Lead To Remote Code Execution
Adobe Framemaker version 2020.0.1 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the c…
-
High 7.8
Adobe Connect CSV injection via export feature could lead to code execution
Adobe Connect version 11.0.7 (and earlier) is affected by an Input Validation vulnerability in the export feature. An attacker could exploit this vulnerability by injecting a payload into an online event form and achieve code execution if the victim exports a…
-
High 7.8
Adobe Animate memory corruption vulnerability
Adobe Animate version 21.0.3 (and earlier) is affected by a Memory Corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requi…
-
High 7.8
Adobe Photoshop CoolType arbitrary stack manipulation in Type 1/Multiple Master
Adobe Photoshop versions 21.2.5 (and earlier) and 22.2 (and earlier) are affected by an Out-of-bounds Write vulnerability in the CoolType library. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context…
-
High 7.1
Adobe Animate out-of-bounds read vulnerability
Adobe Animate version 21.0.3 (and earlier) is affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose sensitive information in the context of the current user. Exploitation of this issue requi…
-
Medium 6.1
Adobe Connect Reflected Cross-site Scripting via query parameter
Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript content that may be executed within the context of the victim's browser…
-
High 7.1
Adobe Animate out-of-bounds read vulnerability
Adobe Animate version 21.0.3 (and earlier) is affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose sensitive information in the context of the current user. Exploitation of this issue requi…
-
Medium 6.1
Adobe Creative Cloud installer arbitrary file overwrite vulnerability
Adobe Creative Cloud Desktop Application version 5.3 (and earlier) is affected by a file handling vulnerability that could allow an attacker to cause arbitrary file overwriting. Exploitation of this issue requires physical access and user interaction.
-
High 7.8
Adobe Animate heap-based overflow vulnerability
Adobe Animate version 21.0.3 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this is…
-
High 7.8
Adobe Creative Cloud Privilege Escalation Vulnerability
Adobe Creative Cloud Desktop Application version 5.3 (and earlier) is affected by a local privilege escalation vulnerability that could allow an attacker to call functions against the installer to perform high privileged actions. Exploitation of this issue do…
-
High 7.1
Adobe Animate out-of-bounds read vulnerability
Adobe Animate version 21.0.3 (and earlier) is affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose sensitive information in the context of the current user. Exploitation of this issue requi…
-
High 7.1
Adobe Animate out-of-bounds read vulnerability
Adobe Animate version 21.0.3 (and earlier) is affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose sensitive information in the context of the current user. Exploitation of this issue requi…
-
Medium 6.1
Adobe Connect Reflected Cross-site Scripting via archiveOffset parameter
Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript content that may be executed within the context of the victim's browser…
-
Unscored —
Some ZTE products have an input verification vulnerability in the diagnostic function interface. Due to insufficient ve…
-
High 7.7
It's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macro
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the `{{wikimacrocontent}}` executes the content with the rights of the wiki macro author instead of the caller of …
-
Medium 6.7
Prototype poisoning
msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a "Prototype Poisoning" vulnerability. When msgpack5 decodes a map containing a key "__proto__", it assigns the decoded value to …
-
Medium 5.9
IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an …
-
Medium 6.1
Incorrect Authorization in switchboard-plug-bluetooth
Switchboard Bluetooth Plug for elementary OS from version 2.3.0 and before version version 2.3.5 has an incorrect authorization vulnerability. When the Bluetooth plug is running (in discoverable mode), Bluetooth service requests and pairing requests are autom…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g in lib/printf.js. The vulnerable regular exp…
-
Unscored —
A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser_parseDocument() func…
-
Critical 9.8
Fix a use-after-free bug in diesels Sqlite backend
An issue was discovered in the diesel crate before 1.4.6 for Rust. There is a use-after-free in the SQLite backend because the semantics of sqlite3_column_name are not followed.
-
High 7.5
Null pointer deference in fltk
An issue was discovered in the fltk crate before 0.15.3 for Rust. There is a NULL pointer dereference during attempted use of a multi label type if the image is nonexistent.
-
Unscored —
An issue was discovered in the fltk crate before 0.15.3 for Rust. There is a NULL pointer dereference during attempted …
-
Unscored —
An issue was discovered in the fltk crate before 0.15.3 for Rust. There is an out-of bounds read because the pixmap con…
-
Critical 9.8
Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 all…
-
Critical 9.8
Race Condition within a Thread vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6…