Archive
16 March 2021
Vulnerabilities first published on this day (UTC), newest first.
22 results · Feed
-
Unscored —
A privilege escalation flaw was found in OpenShift builder. During build time, credentials outside the build context ar…
-
Unscored —
It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, …
-
High 7.4
Improper Limitation of a Pathname to a Restricted Directory in Fabric8 Kubernetes Client
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat fro…
-
High 7.5
nats-io/jwt not enforcing checking of Import token permissions
NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.
-
Unscored —CVE-2021-28295 EPSS 16%
Online Ordering System 1.0 is vulnerable to unauthenticated SQL injection through /onlineordering/GPST/admin/design.php…
-
Unscored —
Online Ordering System 1.0 is vulnerable to arbitrary file upload through /onlineordering/GPST/store/initiateorder.php,…
-
Medium 5.4
SQL injection in vhs (aka VHS: Fluid ViewHelpers)
The vhs (aka VHS: Fluid ViewHelpers) extension before 5.1.1 for TYPO3 allows SQL injection via isLanguageViewHelper.
-
Medium 5.4
Aimeos Typo3 extension contains Cross-site Scripting vulnerability
The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend user account.
-
Unscored —
The Web CGI Script on ZyXEL LTE4506-M606 V1.00(ABDO.2)C0 devices does not require authentication, which allows remote u…
-
Medium —
XSS in CreateQueuedJobTask
A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module. A Cross Site Scripting vulnerability allows an attacker to inject an arbitrary payload in the CreateQueuedJobTask dev task via a specia…
-
Critical 9.8
Prototype pollution vulnerability in 'patchmerge'
Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Unscored —
A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to…
-
Medium 4.0
Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in some con…
-
Unscored —
Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. …
-
Unscored —
Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary cod…
-
Unscored —
Heap buffer overflow in tab groups in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially expl…
-
High 8.8
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap co…
KEV Nov 3, 2021 -
Unscored —
Use after free in WebRTC in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap c…
-
Medium 6.2
IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 uses an inadequate account lockout setting that coul…
-
Medium 4.4
IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user with a valid role to the RE…
-
Medium 4.0
IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user to poison log files which c…
-
Medium 5.9
Timing attack in Cookie signature verification
Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8