Archive
26 March 2021
Vulnerabilities first published on this day (UTC), newest first.
72 results · Feed
-
Unscored —
A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input…
-
Unscored —
A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_…
-
Unscored —
A flaw was found in upx canPack in p_lx_elf.cpp in UPX 3.96. This flaw allows attackers to cause a denial of service (S…
-
Medium 5.3
Exposure of class information in RESTEasy
A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS reso…
-
Unscored —
Tableau Server fails to validate certain URLs that are embedded in emails sent to Tableau Server users.
-
Unscored —
MuleSoft is aware of a XML External Entity (XXE) vulnerability affecting certain versions of a Mule runtime component t…
-
Unscored —
MuleSoft is aware of a Server Side Request Forgery vulnerability affecting certain versions of a Mule runtime component…
-
Unscored —
MuleSoft is aware of a Remote Code Execution vulnerability affecting certain versions of a Mule runtime component that …
-
Unscored —
SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page.
-
Unscored —
The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context…
-
Unscored —
Remote Code Execution Vulnerability in tests/support/stores/test_grid_filter.php in oria gridx 1.3, allows remote attac…
-
Medium 5.4
Craft CMS Cross-site Scripting Vulnerability
Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.
-
Unscored —
Cross-Site scripting vulnerability in Micro Focus Access Manager product, affects all version prior to version 5.0. The…
-
High 7.5
Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all ver…
KEV Nov 3, 2021 -
Unscored —
Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless …
-
Medium 6.5
McAfee ePO Information Leak vulnerability
Information leak vulnerability in the Agent Handler of McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows an unauthenticated user to download McAfee product packages (specifically McAfee Agent) available in ePO repository and install them on the…
-
Medium 6.3
McAfee ePO unvalidated URL redirect vulnerability
Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 could cause an authenticated ePO user to load an untrusted site in an ePO iframe which could steal information from the authenticated user.
-
Low 3.5
McAfee ePO Cross-site Scripting vulnerability
Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized.
-
Medium 5.4
Cross-site Scripting (XSS) in baserCMS
Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
-
High 7.2
OS Command Injection in baserCMS
baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors.
-
Medium 5.4
Cross-site Scripting (XSS) in baserCMS
Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
-
Unscored —
UNIVERGE Aspire series PBX (UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100…
-
Unscored —
CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid (and/or setgid) file. …
-
High 7.5
CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempt…
-
Unscored —
CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Obj…
-
Unscored —
CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS). The impact is: An authentica…
-
High 7.8
CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Obj…
-
Unscored —
ACRN through 2.2 has a devicemodel/hw/pci/virtio/virtio.c NULL Pointer Dereference.
-
Unscored —
HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users with…
-
Unscored —
app/views_mod/user/user.py in LibrIT PaSSHport through 2.5 is affected by LDAP Injection. There is an information leak …
-
Unscored —CVE-2020-23517 Scanner template
Cross Site Scripting (XSS) vulnerability in Aryanic HighMail (High CMS) versions 2020 and before allows remote attacker…
-
Unscored —
A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who c…