Archive
23 March 2021
Vulnerabilities first published on this day (UTC), newest first.
27 results · Clear filters · Feed
-
High 7.7CVE-2021-21380 Public exploit
Rating Script Service expose XWiki to SQL injection
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform (and only those with the Ratings API installed), the Rating Script Service expose an API to perform SQL requests wi…
-
High 8.8
TIBCO ActiveSpaces Windows Platform Installation vulnerability
The Windows Installation component of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacke…
-
High 8.8
TIBCO eFTL Windows Platform Installation vulnerability
The Windows Installation component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on s…
-
High 8.8
TIBCO Enterprise Message Service Windows Platform Artifact Search vulnerability
The Enterprise Message Service Server (tibemsd), Enterprise Message Service Central Administration (tibemsca), Enterprise Message Service JSON configuration generator (tibemsconf2json), and Enterprise Message Service C API components of TIBCO Software Inc.'s …
-
High 8.8
TIBCO Enterprise Message Service Windows Platform Installation vulnerability
The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Message Service, TIBCO Enterprise Message Service - Community Edition, and TIBCO Enterprise Message Service - Developer Edition contains a vulnerability that theoretically allows a l…
-
High 8.8
TIBCO FTL Windows Platform Artifact Search vulnerability
The FTL Server (tibftlserver), FTL C API, FTL Golang API, FTL Java API, and FTL .Net API components of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contain a vulnerability that theoreti…
-
High 8.8
TIBCO FTL Windows Platform Installation vulnerability
The Windows Installation component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some…
-
High 8.8
TIBCO Rendezvous Windows Platform Artifact Search vulnerability
The Rendezvous Routing Daemon (rvrd), Rendezvous Secure Routing Daemon (rvrsd), Rendezvous Secure Daemon (rvsd), Rendezvous Cache (rvcache), Rendezvous Secure C API, Rendezvous Java API, and Rendezvous .Net API components of TIBCO Software Inc.'s TIBCO Rendez…
-
High 8.8
TIBCO Rendezvous Windows Platform Installation vulnerability
The Windows Installation component of TIBCO Software Inc.'s TIBCO Rendezvous and TIBCO Rendezvous Developer Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system…
-
High 7.7
Unauthenticated Arbitrary File Access in Jellyfin
Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. S…
-
High 7.1CVE-2021-21401 Public exploit
Invalid free() call in Nanopb
Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` calls if the message type contains an `oneof` field, and the `…
-
High 7.8
Linux kernel bpf verifier incorrect mod32 truncation
The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory lead…
-
High 7.5
Infinite Loop in Pygments
An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
-
High 8.3
Code injection in keycloak
A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
-
High 8.2
AppStore Remote Download and Installation Vulnerability
The appstore before 8.12.0.0 exposes some of its components, and the attacker can cause remote download and install apps through carefully constructed parameters.
-
High 7.8
Privilege escalation in McAfee DLP Endpoint for Windows
Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) for Windows prior to 11.6.100 allows a local, low privileged, attacker through the use of junctions to cause the product to load DLLs of the attacker's choosing. This requires the creatio…
-
High 7.3
Prototype Pollution
The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.
-
High 7.3
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects XR450 before 2.3.2.114…
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.1…
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.1…
-
High 7.6
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R8000P bef…
-
High 8.4
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects RBW30 befo…
-
High 8.4
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects RBW30 befo…
-
High 8.1
Certain NETGEAR devices are affected by password reset by an unauthenticated attacker. This affects RBK852 before 3.2.1…
-
High 8.4
Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects RBW3…
-
High 8.6
Unrestricted File Upload in Form Framework
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1, due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary …
-
High 8.3
Broken Access Control in Form Framework
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the Form Designer…