Archive
30 March 2021
Vulnerabilities first published on this day (UTC), newest first.
78 results · Feed
-
High 8.0CVE-2021-21413 Public exploit
Misuse of `Reference` and other transferable APIs may lead to access to nodejs isolate
isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isol…
-
Unscored —
Buffer overflow vulnerability in sniff_channel_order function in aacdec_template.c in ffmpeg 3.1.2, allows attackers to…
-
Critical 9.8CVE-2020-24391 EPSS 75%
Remote code execution in mongo-express
mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.
-
Unscored —
An issue was discovered in the Linux kernel before 5.11.11. tipc_nl_retrieve_key in net/tipc/node.c does not properly v…
-
Unscored —
An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows attackers to obtain …
-
Unscored —
An issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly consider that resolved_…
-
Unscored —
An issue was discovered in the Linux kernel before 5.11.11. The user mode driver (UMD) has a copy_process() memory leak…
-
Unscored —
An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to cause a denial …
-
Unscored —
GistPad before 0.2.7 allows a crafted workspace folder to change the URL for the Gist API, which leads to leakage of Gi…
-
Medium 6.4
[thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values
Potential for arbitrary code execution in npm package @thi.ng/egf `#gpg`-tagged property values (only if `decrypt: true` option is enabled). PR with patch has been submitted and will has been released as of v0.4.0 By default the EGF parse functions do NOT att…
-
Unscored —
A security vulnerability in HPE Unified Data Management (UDM) could allow the local disclosure of privileged informatio…
-
Medium 5.4
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Medium 5.4
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Medium 5.4
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Medium 5.4
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Medium 5.4
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Medium 5.4
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
High 7.1
IBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. …
-
Medium 5.4
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Medium 5.1
IBM UrbanCode Deploy (UCD) 7.0.3.0, 7.0.4.0, 7.0.5.3, 7.0.5.4, 7.1.0.0, 7.1.1.0, 7.1.1.1, and 7.1.1.2, stores keystore …
-
High 7.1
IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection (XXE) attack wh…
-
Medium 6.2
IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 stores user credentials in plain in clear text which can be re…
-
Medium 5.4
IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 could allow an authenticated user to initiate a plugin or comp…
-
Medium 5.4
Possible XSS injection through DataColumn Grid class
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type DataColumn is badly used. The problem is fixed in 1.7.7.3
-
Medium 5.9
Possible request smuggling in HTTP/2 due missing validation of content-length
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that…
-
Medium 6.3
Arbitrary Command Injection
This affects the package kill-by-port before 0.0.2. If (attacker-controlled) user input is given to the killByPort function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sani…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Phantom…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Phantom…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Phantom…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Phantom…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Phantom…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1…
-
Unscored —
OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access…
-
Unscored —
D-link DIR-816 A2 v1.10 is affected by a remote code injection vulnerability. An HTTP request parameter can be used in …
-
Unscored —CVE-2021-28935 Public exploit
CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > …