Archive
March 2021
Vulnerabilities first published in this month (UTC), newest first.
80 results · Clear filters · Feed
-
Critical 9.8
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious acto…
KEV Jan 18, 2022 -
Critical 9.8
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12…
KEV Jan 18, 2022 -
Critical 9.8
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12…
KEV Nov 3, 2021 -
Critical 9.8
An out-of-bounds write vulnerability exists in the SGI format buffer size processing functionality of Accusoft ImageGea…
-
Critical 9.8
An out-of-bounds write vulnerability exists in the SGI Format Buffer Size Processing functionality of Accusoft ImageGea…
-
Critical 9.8
Remote code execution in mongo-express
mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Netwo…
-
Critical 9.8
gitjacker arbitrary code execution
gitjacker before 0.1.0 allows remote attackers to execute arbitrary code via a crafted .git directory because of directory traversal.
-
Critical 9.8
A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially c…
-
Critical 9.1
Server Side Request Forgery (SSRF) in org.mitre:openid-connect-server
The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arises due to unsafe usage of the logo_uri parameter in the Dynamic Client Registration request. An unaut…
-
Critical 9.3
Improper Neutralization of Argument Delimiters in a Decompiling Package Process
APKLeaks is an open-source project for scanning APK file for URIs, endpoints & secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary OS commands via package name inside application manifest. An attacker could include arguments that al…
-
Critical 9.9
Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information…
-
Critical 9.9
Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information…
-
Critical 9.9
Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information…
-
Critical 9.9
Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information…
-
Critical 9.9
Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information…
-
Critical 9.9
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authentica…
-
Critical 9.6
HID OMNIKEY 5427 and OMNIKEY 5127 readers are vulnerable to CSRF when using the EEM driver (Ethernet Emulation Mode). B…
-
Critical 9.8
TIBCO API Exchange Gateway Clickjack Vulnerability
The Config UI component of TIBCO Software Inc.'s TIBCO API Exchange Gateway and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows an unauthenticated attacker with network access to execute a cli…
-
Critical 9.6
NETGEAR RBR850 devices before 3.2.10.11 are affected by authentication bypass.
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.…
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects RBW30 before 2.6.2.2, RBS40V before 2.6.2.4…
-
Critical 9.6
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.1…
-
Critical 9.6
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.…
-
Critical 9.6
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBW30 before 2.6…
-
Critical 9.6
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.…
-
Critical 9.6
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.…
-
Critical 9.6
Certain NETGEAR devices are affected by disclosure of sensitive information. This affects RBW30 before 2.6.1.4, RBS40V …
-
Critical 9.9
Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects R6700v3 before 1.0.4.9…
-
Critical 9.8
Arbitrary code execution due to an uncontrolled search path for the git binary
git-bug before 0.7.2 has an Uncontrolled Search Path Element. It will execute git.bat from the current directory in certain PATH situations (most often seen on Windows).
-
Critical 9.8
Resource Exhaustion Denial of Service in http-proxy-agent
A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resou…
-
Critical 9.8
Remote code execution in Kramdown
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
-
Critical 9.8
Out of bounds write in Pillow
An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2…
-
Critical 9.8
Command injection in eslint-fixer
The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The ozum/eslint-fixer GitHub repository ha…
-
Critical 9.8
EIC e-document system - Broken Authentication
EIC e-document system does not perform completed identity verification for sorting and filtering personnel data. The vulnerability allows remote attacker to obtain users’ credential information without logging in the system, and further acquire the privileged…
-
Critical 9.8
EIC e-document system - SQL Injection
The users’ data querying function of EIC e-document system does not filter the special characters which resulted in remote attackers can inject SQL syntax and execute arbitrary commands without privilege.
-
Critical 9.8
Prototype pollution vulnerability in 'patchmerge'
Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
ShopXO RCE Vulnerability
A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix.
-
Critical —
Code injection in nobelprizeparser
Code injection through use of eval.
-
Critical 9.8
A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory…