Archive
26 March 2021
Vulnerabilities first published on this day (UTC), newest first.
19 results · Clear filters · Feed
-
Medium 6.5
Bulk list client endpoint exposes too much metadata about a client
wire-server is an open-source back end for Wire, a secure collaboration platform. In wire-server from version 2021-02-16 and before version 2021-03-02, the client metadata of all users was exposed in the `GET /users/list-clients` endpoint. The endpoint could …
-
Medium 5.5
Incorrect authorization in OAuth2-Proxy
OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The `--gitlab-group` flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag sett…
-
Medium 6.1
HTML injection in email and account expiry notifications
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed message…
-
Medium 6.9
Cross-site scripting (XSS) vulnerability in the password reset endpoint
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to …
-
Medium 6.2
An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to s…
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauth…
-
Medium 5.7
In all versions of GitLab, marshalled session keys were being stored in Redis.
-
Medium 4.3
Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inacces…
-
Medium 6.1CVE-2021-25372 Exploited
An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.
KEV Jun 29, 2023 -
Medium 6.1CVE-2021-25371 Exploited
A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.
KEV Jun 29, 2023 -
Medium 6.1CVE-2021-25370 Exploited
An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory co…
KEV Nov 8, 2022 -
Medium 6.2CVE-2021-25369 Exploited
An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel infor…
KEV Nov 8, 2022 -
Medium 6.3
There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar…
-
Medium 5.3
Exposure of class information in RESTEasy
A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS reso…
-
Medium 5.4
Craft CMS Cross-site Scripting Vulnerability
Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.
-
Medium 6.5
McAfee ePO Information Leak vulnerability
Information leak vulnerability in the Agent Handler of McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows an unauthenticated user to download McAfee product packages (specifically McAfee Agent) available in ePO repository and install them on the…
-
Medium 6.3
McAfee ePO unvalidated URL redirect vulnerability
Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 could cause an authenticated ePO user to load an untrusted site in an ePO iframe which could steal information from the authenticated user.
-
Medium 5.4
Cross-site Scripting (XSS) in baserCMS
Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
-
Medium 5.4
Cross-site Scripting (XSS) in baserCMS
Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.