Archive
25 March 2021
Vulnerabilities first published on this day (UTC), newest first.
71 results · Feed
-
Unscored —
Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to sqlcipher_export in crypto.c and s…
-
Unscored —
Realtek xPON RTL9601D SDK 1.9 stores passwords in plaintext which may allow attackers to possibly gain access to the de…
-
High 7.8
ArcGIS general raster security update: uninitialized pointer
Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution i…
-
High 7.8
ArcGIS general raster security update: buffer overflow
Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the …
-
Medium 6.4
ArcGIS Server image service and raster analytics security update: uninitialized pointer
Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service acc…
-
Medium 6.4
ArcGIS Server image service and raster analytics security update: buffer overflow
Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
-
Medium 6.4
ArcGIS Server image service and raster analytics security update: use-after-free
A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
-
Unscored —
A directory traversal on the /admin/sysmon.php script of Invigo Automatic Device Management (ADM) through 5.0 allows re…
-
Unscored —
A command injection on the /admin/broadcast.php script of Invigo Automatic Device Management (ADM) through 5.0 allows r…
-
Unscored —
Multiple session validity check issues in several administration functionalities of Invigo Automatic Device Management …
-
Unscored —
A SQL injection on the /admin/display_errors.php script of Invigo Automatic Device Management (ADM) through 5.0 allows …
-
Unscored —
The /admin/admapi.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote authenticated attack…
-
Unscored —
A directory traversal on the /admin/search_by.php script of Invigo Automatic Device Management (ADM) through 5.0 allows…
-
Unscored —CVE-2021-22889 EPSS 31%
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of stats…
-
Unscored —CVE-2021-22888 EPSS 16%
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of campaign-zone…
-
Unscored —
A miscommunication in the file system allows adversaries with access to the MU320E to escalate privileges on the MU320E…
-
Unscored —
The software performs an operation at a privilege level higher than the minimum level required, which creates new weakn…
-
Unscored —
SSH server configuration file does not implement some best practices. This could lead to a weakening of the SSH protoco…
-
Unscored —
The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to…
-
Unscored —
The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to…
-
Unscored —
The software contains a hard-coded password that could allow an attacker to take control of the merging unit using thes…
-
Unscored —
A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in t…
-
Unscored —
A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in t…
-
Unscored —
A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via webmaster-tools.…
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.31. An assertion failure triggered by a crafted CGI request may lead…
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.31. A memory leak that occurs when decompression fails unexpectedly …
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the show-status CGI handler when memory allocati…
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the client-tags CGI handler when client tags are…
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Dereference of a NULL-pointer that could result in a crash if ac…
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Memory leak if multiple filters are executed and the last one is…
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Memory leak when client tags are active can cause a system crash.
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Memory leak in the show-status CGI handler when no filter files …
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Memory leaks when a response is buffered and the buffer limit is…
-
Unscored —
An issue was discovered in Nokia NetAct 18A. A malicious user can change a filename of an uploaded file to include Java…
-
Unscored —
An issue was discovered in Nokia NetAct 18A. A remote user, authenticated to the NOKIA NetAct Web Page, can visit the S…
-
Unscored —
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF…
-
Unscored —
A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a…
-
Unscored —
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the …
-
High 7.8
ArcGIS general raster security update: use-after-free
A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context o…
-
Unscored —
Improper Authorization vulnerability in Netop Vision Pro up to and including to 9.7.1 allows an attacker to replay netw…