Archive
March 2021
Vulnerabilities first published in this month (UTC), newest first.
30 results · Clear filters · Feed
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Phantom…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Phantom…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Phantom…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Phantom…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Phantom…
-
Low —
Regular Expression Denial of Service (ReDoS) in braces
A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
-
Low 3.3CVE-2021-23358 Public exploit
Arbitrary Code Injection
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
-
Low 3.5
McAfee ePO Cross-site Scripting vulnerability
Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized.
-
Low 3.3
Hijacking vulnerability in Samsung Cloud prior to version 4.7.0.3 allows attackers to intercept when the provider is ex…
-
Low 3.7
Path Traversal vulnerability in Samsung Notes prior to version 4.2.00.22 allows attackers to access local files without…
-
Low 3.2
Improper access control in Samsung Internet prior to version 13.2.1.70 allows physically proximate attackers to bypass …
-
Low 3.3
Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in…
-
Low 3.2
Improper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and 12.1.1.3 allows physica…
-
Low 2.0
Information Exposure vulnerability in Samsung Account prior to version 12.1.1.3 allows physically proximate attackers t…
-
Low 3.5
An issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able t…
-
Low 3.5
Config Items are shown to users without permission
Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and prior versions, ITSMConfigurationManagement 7.0.24 and prior versions
-
Low 3.5
FAQ articles are shown to users without permission
Agents are able to see linked FAQ articles without permissions (defined in FAQ Category). This issue affects: FAQ version 6.0.29 and prior versions, OTRS version 7.0.24 and prior versions.
-
Low 3.7
IBM Resilient SOAR 40 and earlier could disclose sensitive information by allowing a user to enumerate usernames.
-
Low 3.3
Directory Traversal
All versions of package github.com/tyktechnologies/tyk/gateway are vulnerable to Directory Traversal via the handleAddOrUpdateApi function. This function is able to delete arbitrary JSON files on the disk where Tyk is running via the management API. The APIID…
-
Low 3.7CVE-2021-28378 Public exploit
Cross-site Scripting in Gitea
Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.
-
Low 3.7CVE-2021-28116 EPSS 13%
Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bo…
-
Low 2.1
Improper permission grant check in Samsung Internet prior to version 13.0.1.60 allows access to files in internal stora…
-
Low 2.8
Improper access control in NotificationManagerService in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows …
-
Low 2.5
Improper lockscreen status check in cocktailbar service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allow…
-
Low 3.2
Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance informat…
-
Low 3.2
Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to contacts informa…
-
Low 3.2
Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance informat…
-
Low 3.0
DataDog API Client contains a Local Information Disclosure Vulnerability
The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the API Client. The Datadog API is executed on a unix-like system with multiple users. The API is used to …
-
Low 3.5
An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS…
-
Low 2.6
User content sandbox can be confused into opening arbitrary documents
matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content sandbox can be abused to trick users into opening unexpected documents. The content is opened with a `blob` origin that …