Archive
March 2021
Vulnerabilities first published in this month (UTC), newest first.
1,455 results · Feed
-
Medium 6.8
Cisco IOS XE ROM Monitor Software for Cisco Industrial Switches OS Command Injection Vulnerability
A vulnerability in the ROM Monitor (ROMMON) of Cisco IOS XE Software for Cisco Catalyst IE3200, IE3300, and IE3400 Rugged Series Switches, Cisco Catalyst IE3400 Heavy Duty Series Switches, and Cisco Embedded Services 3300 Series Switches could allow an unauth…
-
High 8.1
Cisco IOS XE Software Easy Virtual Switching System Arbitrary Code Execution Vulnerability
A vulnerability in the Easy Virtual Switching System (VSS) feature of Cisco IOS XE Software for Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code on the unde…
-
Medium 6.7
Cisco Access Point Software Arbitrary Code Execution Vulnerability
A vulnerability in the boot logic of Cisco Access Points Software could allow an authenticated, local attacker to execute unsigned code at boot time. The vulnerability is due to an improper check that is performed by the area of code that manages system start…
-
High 8.6
Cisco IOS XE Software DNS NAT Protocol Application Layer Gateway Denial of Service Vulnerability
A vulnerability in the DNS application layer gateway (ALG) functionality used by Network Address Translation (NAT) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a lo…
-
Medium 5.5
Cisco IOS XE Software Web UI OS Command Injection Vulnerability
A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying operating system of an affected device. The vulnerability exists because the affected softwar…
-
Medium 6.7
Cisco IOS XE Software Hardware Initialization Routines Arbitrary Code Execution Vulnerability
A vulnerability in the hardware initialization routines of Cisco IOS XE Software for Cisco 1100 Series Industrial Integrated Services Routers and Cisco ESR6300 Embedded Series Routers could allow an authenticated, local attacker to execute unsigned code at sy…
-
High 7.0
Cisco IOS XE Software Plug-and-Play Privilege Escalation Vulnerability
A vulnerability in a diagnostic command for the Plug-and-Play (PnP) subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to the level of an Administrator user (level 15) on an affected device. The vulnerability…
-
High 7.4
Cisco Aironet Access Points FlexConnect Multicast DNS Denial of Service Vulnerability
A vulnerability in the multicast DNS (mDNS) gateway feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insuf…
-
High 7.5
Cisco Aironet Access Points FlexConnect Upgrade Information Disclosure Vulnerability
A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to obtain confidential information from an affected device. This vulnerability is due to an unrestricted Trivial …
-
Medium 4.4
Cisco IOS XE SD-WAN Software Path Traversal Vulnerability
A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. This vulnerability is due to insufficient validation of …
-
Medium 6.6
Cisco IOS XE Software Web UI Command Injection Vulnerability
A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that can be executed as the root user. This vulnerability is due to insufficient input validation. An attacker could exploit this…
-
Medium 4.4
Cisco IOS XE SD-WAN Software Arbitrary File Corruption Vulnerability
A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying file system. This vulnerability is due to insufficient validation of the parameters of a specific CLI comman…
-
High 8.1
Cisco IOS XE SD-WAN Software vDaemon Buffer Overflow Vulnerability
A vulnerability in the vDaemon process in Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected device. This vulnerability is due to insufficient bounds checking when the device processes traffi…
-
High 7.3
Cisco IOS XE SD-WAN Software Arbitrary Command Execution Vulnerability
A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as the root user. The attacker must be authenticated on the affected device as a low-privi…
-
High 7.5
Cisco IOS XE SD-WAN Software vDaemon Denial of Service Vulnerability
A vulnerability in the vDaemon process of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to cause a device to reload, resulting a denial of service (DoS) condition. This vulnerability is due to insufficient handling of malformed …
-
Medium 4.3
An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages.
-
Medium 5.0
An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack …
-
Low 3.5
An issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able t…
-
Unscored —
spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Travers…
-
Medium 5.4
A vulnerability was discovered in GitLab versions before 12.2. GitLab was vulnerable to a SSRF attack through the Outbo…
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demot…
-
Medium 4.9
An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables wh…
-
Medium 5.4
Insufficient input sanitization in wikis in GitLab version 13.8 and up allows an attacker to exploit a stored cross-sit…
-
Critical 9.9
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authentica…
-
High 8.8
MarkAny MaEPSBroker Command Injection Vulnerability
In MaEPSBroker 2.5.0.31 and prior, a command injection vulnerability caused by improper input validation checks when parsing brokerCommand parameter.
-
Unscored —
An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hadoop as shipped in…
-
Unscored —
An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hive as shipped in R…
-
Unscored —
An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/presto as shipped in…
-
Unscored —
ThinkSAAS before 3.38 contains a SQL injection vulnerability through app/topic/action/admin/topic.php via the title par…
-
Unscored —
An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ansible-service-broker as shi…
-
Unscored —
An insecure modification vulnerability in the /etc/passwd file was found in the container operator-framework/operator-m…
-
Critical 9.6
HID OMNIKEY 5427 and OMNIKEY 5127 readers are vulnerable to CSRF when using the EEM driver (Ethernet Emulation Mode). B…
-
Medium 5.4
Plone XSS Vulnerability
A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter.
-
High 7.5
IBM Elastic Storage System 6.0.0 through 6.0.1.2 and IBM Elastic Storage Server 5.3.0 through 5.3.6.2 could allow a rem…
-
Unscored —
An issue was discovered in Contiki through 3.0. When sending an ICMPv6 error message because of invalid extension heade…
-
Unscored —CVE-2021-27320 Scanner template
Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert mali…
-
Unscored —CVE-2021-27319 Scanner template
Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert mali…
-
Unscored —CVE-2021-27316 Scanner template
Blind SQL injection in contactus.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert mali…
-
Unscored —CVE-2021-27315 Scanner template
Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert mali…
-
Unscored —
A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via …