Archive
March 2021
Vulnerabilities first published in this month (UTC), newest first.
303 results · Clear filters · Feed
-
Medium 4.4
Denial of Service (DoS)
The package github.com/pires/go-proxyproto before 0.5.0 are vulnerable to Denial of Service (DoS) via the parseVersion1() function. The reader in this package is a default bufio.Reader wrapping a net.Conn. It will read from the connection until it finds a new…
-
Medium 6.5
This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected …
-
Medium 6.3
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmwar…
-
Medium 6.3
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R780…
-
Medium 6.3
Reflected XSS issues
Cross-site Scripting (XSS) vulnerability in web GUI of Secomea GateManager allows an attacker to inject arbitrary javascript code. This issue affects: Secomea GateManager all versions prior to 9.4.
-
Medium 6.1CVE-2021-3377 Scanner template
ansi_up cross-site scripting vulnerability
The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is f…
-
Medium 5.4CVE-2021-27907 EPSS 86%
Apache Superset stored XSS on Dashboard markdown
Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the …
-
Medium 5.3
Activerecord-session_store Vulnerable to Timing Attack
The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can levera…
-
Medium 5.3
Hijacking vulnerability in Samsung Email application version prior to SMR Feb-2021 Release 1 allows attackers to interc…
-
Medium 4.0
Graphic format mismatch while converting video format in hwcomposer prior to SMR Mar-2021 Release 1 results in kernel p…
-
Medium 6.2
Missing permission check in knox_custom service prior to SMR Mar-2021 Release 1 allows attackers to gain access to devi…
-
Medium 4.0
Calling of non-existent provider in Samsung Members prior to version 2.4.81.13 (in Android O(8.1) and below) and 3.8.00…
-
Medium 4.0
Calling of non-existent provider in SMP sdk prior to version 3.0.9 allows unauthorized actions including denial of serv…
-
Medium 4.0
Calling of non-existent provider in S Assistant prior to version 6.5.01.22 allows unauthorized actions including denial…
-
Medium 5.1
Improper access control vulnerability in Samsung keyboard version prior to SMR Feb-2021 Release 1 allows physically pro…
-
Medium 4.4
Improper address validation in HArx in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given…
-
Medium 4.4
Improper memory access control in RKP in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, giv…
-
Medium 4.4
Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted…
KEV Nov 8, 2022 -
Medium 5.5
Improper input check in wallpaper service in Samsung mobile devices prior to SMR Feb-2021 Release 1 allows untrusted ap…
-
Medium 5.4
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav…
-
Medium 5.4
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav…
-
Medium 5.4
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav…
-
Medium 5.4
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav…
-
Medium 5.4
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav…
-
Medium 6.4
IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitr…
-
Medium 6.4
IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitr…
-
Medium 6.4
IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitr…
-
Medium —
[20210308] - Core - Path Traversal within joomla/archive zip class
An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path.
-
Medium 4.0
When traffic other than HTTP/S (eg: SSH traffic, etc...) traverses the FortiGate in version below 6.2.5 and below 6.4.2…
-
Medium 4.8
Regular Expression Denial of Service (ReDoS)
This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process.
-
Medium 4.1
An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS…
-
Medium 5.9
Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the…
-
Medium 6.1CVE-2020-24912 Scanner template
qcubed reflected cross-site scripting (XSS) vulnerability
A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.
-
Medium 6.1
openark/orchestrator cross-site scripting vulnerability
resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter.
-
Medium 5.4
XSS injection on ticket update
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is an XSS vulnerability involving a logged in user while updating a ticket.
-
Medium 5.4
Stored XSS on documents
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability within the document upload function (Home > Management > Do…
-
Medium 4.9
XSS on tabs
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability in the /ajax/common.tabs.php endpoint, indeed, at least two…
-
Medium 5.3
An issue has been discovered in GitLab affecting all versions starting with 13.0. Confidential issue titles in Gitlab w…
-
Medium 5.9
IBM Security Verify Bridge contains hard-coded credentials, such as a password or cryptographic key, which it uses for …
-
Medium 5.9
IBM Security Verify Bridge uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h…