Archive
22 March 2021
Vulnerabilities first published on this day (UTC), newest first.
51 results · Feed
-
Medium 5.3CVE-2021-21348 EPSS 14%
XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, wh…
-
Medium 6.1
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the…
-
Medium 5.3CVE-2021-21350 EPSS 15%
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, …
-
Medium 5.4CVE-2021-21351 EPSS 82%
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream.…
-
High 7.5
XStream can cause a Denial of Service
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such…
-
Medium 5.3CVE-2021-21342 EPSS 50%
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creat…
-
Medium 5.3CVE-2021-21343 EPSS 47%
XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creat…
-
Medium 5.3CVE-2021-21344 EPSS 76%
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input s…
-
Medium 5.8
XStream is vulnerable to a Remote Command Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed inp…
-
Medium 6.1CVE-2021-21346 EPSS 76%
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input s…
-
Medium 6.1CVE-2021-21347 EPSS 14%
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input s…
-
Unscored —
In OpenEMR, versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being …
-
Medium 4.8
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being val…
-
Medium 4.8
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being val…
-
Medium 6.5
In OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating a new user, which lead…
-
Medium 5.4CVE-2021-25921 EPSS 89%
In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being…
-
Medium 4.8CVE-2021-25919 EPSS 66%
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being val…
-
Unscored —
There is a local privilege escalation vulnerability in some versions of ManageOne. A local authenticated attacker could…
-
Unscored —
There is a use-after-free vulnerability in a Huawei product. A module cannot deal with specific operations in special s…
-
Unscored —
There is an improper permission assignment vulnerability in Huawei ManageOne product. Due to improper security hardenin…
-
Unscored —
There is a denial of service vulnerability in Huawei products. A module cannot deal with specific messages correctly. A…
-
Unscored —
There is an information leakage vulnerability in some huawei products. Due to the properly storage of specific informat…
-
Unscored —
There is insecure algorithm vulnerability in Huawei products. A module uses less random input in a secure mechanism. At…
-
Unscored —
There is a denial of service vulnerability in some huawei products. In specific scenarios, due to the improper handling…
-
Unscored —
The eUDC660 product has a resource management vulnerability. An attacker with high privilege needs to perform specific …
-
Unscored —
There is a vulnerability in some version of USG9500 that the device improperly handles the information when a user logs…
-
Unscored —
A malicious website could execute code remotely in Sophos Connect Client before version 2.1.
-
Unscored —
A potential security vulnerability has been identified in HPE Network Orchestrator (NetO) version(s): Prior to 2.5. The…
-
Medium 6.1
IBM Planning Analytics 2.0 could be vulnerable to a Server-Side Request Forgery (SSRF) attack by constucting URLs from …
-
Medium 4.3
When a user opens manipulated Windows Bitmap (.BMP) files received from untrusted sources in SAP 3D Visual Enterprise V…
-
Medium 4.3
When a user opens manipulated Autodesk 3D Studio for MS-DOS (.3DS) files received from untrusted sources in SAP 3D Visu…
-
Medium 4.3
When a user opens manipulated Portable Document Format (.PDF) files received from untrusted sources in SAP 3D Visual En…
-
Medium 4.3
When a user opens manipulated Graphics Interchange Format (.GIF) files received from untrusted sources in SAP 3D Visual…
-
Unscored —
In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, user…
-
Unscored —
In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-toler…
-
Unscored —
An issue was discovered in PunBB before 1.4.6. An XSS vulnerability in the [email] BBcode tag allows (with authenticati…
-
Unscored —CVE-2021-27308 Public exploit
A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to i…
-
Unscored —
One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x befor…
-
Unscored —
The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorre…
-
Unscored —
The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana insta…