Archive
25 March 2021
Vulnerabilities first published on this day (UTC), newest first.
71 results · Feed
-
Unscored —
Cleartext transmission of sensitive information in Netop Vision Pro up to and including 9.7.1 allows a remote unauthent…
-
Unscored —
Incorrect default permissions vulnerability in the API of Netop Vision Pro up to and including 9.7.1 allows a remote un…
-
Unscored —
Local privilege escalation vulnerability in Windows clients of Netop Vision Pro up to and including 9.7.1 allows a loca…
-
Low 3.3
Hijacking vulnerability in Samsung Cloud prior to version 4.7.0.3 allows attackers to intercept when the provider is ex…
-
Low 3.7
Path Traversal vulnerability in Samsung Notes prior to version 4.2.00.22 allows attackers to access local files without…
-
Low 3.2
Improper access control in Samsung Internet prior to version 13.2.1.70 allows physically proximate attackers to bypass …
-
Medium 5.5
Using unsafe PendingIntent in Samsung Notes prior to version 4.2.00.22 allows local attackers unauthorized action witho…
-
Low 3.3
Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in…
-
Medium 5.5
Using empty PendingIntent in Galaxy Themes prior to version 5.2.00.1215 allows local attackers to read/write private fi…
-
Medium 5.5
Using PendingIntent with implicit intent in Bixby Voice prior to version 3.0.52.14 allows attackers to execute privileg…
-
Low 3.2
Improper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and 12.1.1.3 allows physica…
-
Low 2.0
Information Exposure vulnerability in Samsung Account prior to version 12.1.1.3 allows physically proximate attackers t…
-
Medium 5.5
Using unsafe PendingIntent in Slow Motion Editor prior to version 3.5.18.5 allows local attackers unauthorized action w…
-
Critical 9.8
A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially c…
-
High 7.5
Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specia…
-
Unscored —
Authentication Bypass Vulnerability in Micro Focus Access Manager Product, affects all version prior to version 4.5.3.3…
-
High 7.8
Uncontrolled Search Path Element in Bosch Video Streaming Gateway Installer
Calling an executable through an Uncontrolled Search Path Element in the Bosch Video Streaming Gateway installer up to and including version 6.45.10 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the vict…
-
High 7.8
Uncontrolled Search Path Element in Bosch Monitor Wall Installer
Loading a DLL through an Uncontrolled Search Path Element in the Bosch Monitor Wall installer up to and including version 10.00.0164 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked in…
-
High 7.8
Uncontrolled Search Path Element in Bosch Configuration Manager Installer
Loading a DLL through an Uncontrolled Search Path Element in the Bosch Configuration Manager installer up to and including version 7.21.0078 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tr…
-
High 7.8
Uncontrolled Search Path Element in Bosch Video Client installer
Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Client installer up to and including version 1.7.6.079 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked int…
-
High 7.8
Uncontrolled Search Path Element in Bosch Video Recording Manager Installer
Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Recording Manager installer up to and including version 3.82.0055 for 3.82, up to and including version 3.81.0064 for 3.81 and 3.71 and older potentially allows an attacker to execut…
-
High 7.8
Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer
Loading a DLL through an Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer in versions 10.1.0, 10.0.1, 10.0.0 and 9.0.0 and older potentially allows an attacker to execute arbitrary code on a victim's system. This affects both the installer as we…
-
High 7.8
Uncontrolled Search Path Element in Bosch IP Helper
Loading a DLL through an Uncontrolled Search Path Element in Bosch IP Helper up to and including version 1.00.0008 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malic…
-
Medium 6.6
Duo Authentication Proxy Installer Denial of Service Vulnerability
The Duo Authentication Proxy installer prior to 5.2.1 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If successful, an attacker can ma…
-
High 7.4
CA certificate check bypass with X509_V_FLAG_X509_STRICT
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded e…
-
Medium 5.9
NULL pointer deref in signature_algorithms processing
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a si…
-
Unscored —
Apache SpamAssassin has an OS Command Injection vulnerability
In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, us…
-
Unscored —
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attack…
-
Critical 9.1
Server Side Request Forgery (SSRF) in org.mitre:openid-connect-server
The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arises due to unsafe usage of the logo_uri parameter in the Dynamic Client Registration request. An unaut…
-
Unscored —
Fuji Xerox multifunction devices and printers (DocuCentre-VII C7773/C6673/C5573/C4473/C3373/C3372/C2273, DocuCentre-VII…
-
Unscored —
A flaw was found in libmicrohttpd. A missing bounds check in the post_process_urlencoded function leads to a buffer ove…