Archive
March 2021
Vulnerabilities first published in this month (UTC), newest first.
1,455 results · Feed
-
High 7.5
XStream can cause a Denial of Service
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such…
-
Medium 5.3CVE-2021-21342 EPSS 50%
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creat…
-
Medium 5.3CVE-2021-21343 EPSS 47%
XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creat…
-
Medium 5.3CVE-2021-21344 EPSS 76%
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input s…
-
Medium 5.8
XStream is vulnerable to a Remote Command Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed inp…
-
Medium 6.1CVE-2021-21346 EPSS 76%
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input s…
-
Medium 6.1CVE-2021-21347 EPSS 14%
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input s…
-
Unscored —
In OpenEMR, versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being …
-
Medium 4.8
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being val…
-
Medium 4.8
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being val…
-
Medium 6.5
In OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating a new user, which lead…
-
Medium 5.4CVE-2021-25921 EPSS 89%
In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being…
-
Medium 4.8CVE-2021-25919 EPSS 66%
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being val…
-
Unscored —
There is a local privilege escalation vulnerability in some versions of ManageOne. A local authenticated attacker could…
-
Unscored —
There is a use-after-free vulnerability in a Huawei product. A module cannot deal with specific operations in special s…
-
Unscored —
There is an improper permission assignment vulnerability in Huawei ManageOne product. Due to improper security hardenin…
-
Unscored —
There is a denial of service vulnerability in Huawei products. A module cannot deal with specific messages correctly. A…
-
Unscored —
There is an information leakage vulnerability in some huawei products. Due to the properly storage of specific informat…
-
Unscored —
There is insecure algorithm vulnerability in Huawei products. A module uses less random input in a secure mechanism. At…
-
Unscored —
There is a denial of service vulnerability in some huawei products. In specific scenarios, due to the improper handling…
-
Unscored —
The eUDC660 product has a resource management vulnerability. An attacker with high privilege needs to perform specific …
-
Unscored —
There is a vulnerability in some version of USG9500 that the device improperly handles the information when a user logs…
-
Unscored —
A malicious website could execute code remotely in Sophos Connect Client before version 2.1.
-
Unscored —
A potential security vulnerability has been identified in HPE Network Orchestrator (NetO) version(s): Prior to 2.5. The…
-
Medium 6.1
IBM Planning Analytics 2.0 could be vulnerable to a Server-Side Request Forgery (SSRF) attack by constucting URLs from …
-
Medium 4.3
When a user opens manipulated Windows Bitmap (.BMP) files received from untrusted sources in SAP 3D Visual Enterprise V…
-
Medium 4.3
When a user opens manipulated Autodesk 3D Studio for MS-DOS (.3DS) files received from untrusted sources in SAP 3D Visu…
-
Medium 4.3
When a user opens manipulated Portable Document Format (.PDF) files received from untrusted sources in SAP 3D Visual En…
-
Medium 4.3
When a user opens manipulated Graphics Interchange Format (.GIF) files received from untrusted sources in SAP 3D Visual…
-
Unscored —
In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, user…
-
Unscored —
In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-toler…
-
Unscored —
An issue was discovered in PunBB before 1.4.6. An XSS vulnerability in the [email] BBcode tag allows (with authenticati…
-
Unscored —CVE-2021-27308 Public exploit
A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to i…
-
Unscored —
One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x befor…
-
Unscored —
The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorre…
-
Unscored —
The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana insta…
-
Unscored —
Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permissio…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators.
-
Unscored —
RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI
Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.
-
Low 3.5
Config Items are shown to users without permission
Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and prior versions, ITSMConfigurationManagement 7.0.24 and prior versions