Archive
March 2021
Vulnerabilities first published in this month (UTC), newest first.
97 results · Clear filters · Feed
-
Unscored —
The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which lead…
-
Unscored —CVE-2021-28418 Public exploit
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and…
-
Unscored —CVE-2021-28417 Public exploit
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and …
-
High 8.8
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap co…
KEV Nov 3, 2021 -
Unscored —CVE-2021-27946 Public exploit
SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. (issue 1 of 3).
-
Unscored —
SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files.
-
Unscored —CVE-2021-27889 Public exploit
Cross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages.
-
Unscored —CVE-2021-27695 Public exploit
Multiple stored cross-site scripting (XSS) vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbi…
-
Unscored —CVE-2021-28379 Public exploit
web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allo…
-
Low 3.7CVE-2021-28378 Public exploit
Cross-site Scripting in Gitea
Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.
-
Unscored —CVE-2020-35682 Public exploit
Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login).
-
High 7.8CVE-2021-26882 Public exploit
Remote Access API Elevation of Privilege Vulnerability
Remote Access API Elevation of Privilege Vulnerability
-
High 7.8CVE-2021-26871 Public exploit
Windows WalletService Elevation of Privilege Vulnerability
Windows WalletService Elevation of Privilege Vulnerability
-
High 7.8CVE-2021-26868 Public exploit
Windows Graphics Component Elevation of Privilege Vulnerability
Windows Graphics Component Elevation of Privilege Vulnerability
-
High 8.8
Internet Explorer Memory Corruption Vulnerability
Internet Explorer Memory Corruption Vulnerability
KEV Nov 3, 2021 -
Unscored —CVE-2021-0399 Public exploit
In qtaguid_untag of xt_qtaguid.c, there is a possible memory corruption due to a use after free. This could lead to loc…
-
Unscored —CVE-2021-0392 Public exploit
In main of main.cpp, there is a possible memory corruption due to a double free. This could lead to local escalation of…
-
Unscored —CVE-2021-0390 Public exploit
In various methods of WifiNetworkSuggestionsManager.java, there is a possible modification of suggested networks due to…
-
Unscored —CVE-2021-0397 Public exploit
In sdp_copy_raw_data of sdp_discovery.cc, there is a possible system compromise due to a double free. This could lead t…
-
Unscored —CVE-2021-0391 Public exploit
In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, witho…
-
Unscored —CVE-2021-0394 Public exploit
In android_os_Parcel_readString8 of android_os_Parcel.cpp, there is a possible out of bounds read due to a missing boun…
-
Unscored —CVE-2021-0393 Public exploit
In Scanner::LiteralBuffer::NewCapacity of scanner.cc, there is a possible out of bounds write due to an integer overflo…
-
Unscored —CVE-2021-0396 Public exploit
In Builtins::Generate_ArgumentsAdaptorTrampoline of builtins-arm.cc and related files, there is a possible out of bound…
-
Unscored —CVE-2021-3310 Public exploit
Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can…
-
Unscored —
An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sens…
-
High 8.1CVE-2021-21772 Public exploit
A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3m…
-
Unscored —CVE-2021-20253 Public exploit
A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker …
-
High 8.0
malicious repositories can execute remote code while cloning
Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed w…
-
Medium 6.5
Keycloak discloses information without authentication
A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL l…
-
Medium 5.7CVE-2021-21337 Public exploit
URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService
Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality c…
-
Medium 6.7CVE-2020-5014 Public exploit
IBM DataPower Gateway V10 and V2018 could allow a local attacker with administrative privileges to execute arbitrary co…
-
Unscored —CVE-2021-27365 Public exploit
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate lengt…
-
High 8.8CVE-2021-26814 Public exploit
Improper Input Validation (RCE)
Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. An authenticated user to the service may exploit incomplete input validation on the /manager/files API to inject…
-
High 8.1CVE-2020-28502 Public exploit
Arbitrary Code Injection
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and …
-
Unscored —
The TOTVS Fluig platform allows path traversal through the parameter "file = .. /" encoded in base64. This affects all …
-
Unscored —CVE-2020-5148 Public exploit
SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing …
-
Unscored —
The MsIo64.sys driver before 1.1.19.1016 in MSI Dragon Center before 2.0.98.0 has a buffer overflow that allows privile…
-
Unscored —CVE-2021-27963 Public exploit
SonLogger before 6.4.1 is affected by user creation with any user permissions profile (e.g., SuperAdmin). An anonymous …
-
Unscored —
SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Co…
-
Medium 4.4
Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted…
KEV Nov 8, 2022