Archive
March 2021
Vulnerabilities first published in this month (UTC), newest first.
1,455 results · Feed
-
Unscored —CVE-2021-27310 Scanner template
Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "language" parameter.
-
Unscored —
Dolphin CMS 7.4.2 is vulnerable to stored XSS via the Page Builder "width" parameter.
-
Unscored —
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the …
-
Unscored —
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the …
-
Unscored —
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allow remote attacker to inject javascript via URI in…
-
Unscored —
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the …
-
Unscored —
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the …
-
Unscored —
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the …
-
High 7.3
Prototype Pollution
The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.
-
Critical 9.6
NETGEAR RBR850 devices before 3.2.10.11 are affected by authentication bypass.
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.…
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects RBW30 before 2.6.2.2, RBS40V before 2.6.2.4…
-
High 7.3
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects XR450 before 2.3.2.114…
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.1…
-
Critical 9.6
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.1…
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.1…
-
High 7.6
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R8000P bef…
-
High 8.4
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects RBW30 befo…
-
High 8.4
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects RBW30 befo…
-
Critical 9.6
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.…
-
Critical 9.6
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBW30 before 2.6…
-
Critical 9.6
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.…
-
Critical 9.6
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.…
-
High 8.1
Certain NETGEAR devices are affected by password reset by an unauthenticated attacker. This affects RBK852 before 3.2.1…
-
High 8.4
Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects RBW3…
-
Critical 9.6
Certain NETGEAR devices are affected by disclosure of sensitive information. This affects RBW30 before 2.6.1.4, RBS40V …
-
Critical 9.9
Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects R6700v3 before 1.0.4.9…
-
Medium 5.9
Denial of Service in Page Error Handling
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error mes…
-
Medium 5.4
Cross-Site Scripting in Content Preview (CType menu)
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that content elements of type _menu_ are vulnerable to cross-site scripting when their referenced items ge…
-
Medium 5.9
Cleartext storage of session identifier
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 user session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. Th…
-
Medium 5.4
Cross-Site Scripting in Content Preview
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that database fields used as _descriptionColumn_ are vulnerable to cross-site scripting when their content gets previewed. A valid…
-
High 8.6
Unrestricted File Upload in Form Framework
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1, due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary …
-
High 8.3
Broken Access Control in Form Framework
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the Form Designer…
-
Medium 5.4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account wi…
-
Medium 4.7
Open Redirection in Login Handling
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that Login Handling is susceptible to open redirection which allows attackers redirecting to arbit…
-
Unscored —
A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of …
-
Medium 5.3CVE-2021-21348 EPSS 14%
XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, wh…
-
Medium 6.1
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the…
-
Medium 5.3CVE-2021-21350 EPSS 15%
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, …
-
Medium 5.4
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream.…