Archive
March 2021
Vulnerabilities first published in this month (UTC), newest first.
1,455 results · Feed
-
Unscored —
A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap all…
-
Unscored —
A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack …
-
Unscored —
Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network…
-
Unscored —
By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been appli…
-
Unscored —
A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an addres…
-
Unscored —
If an attacker is able to alter specific about:config values (for example malware running on the user's computer), the …
-
Unscored —
A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a …
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some o…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence of memory corr…
-
Unscored —
PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensit…
-
Unscored —
Simple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax.php?action=save_settin…
-
Unscored —
A SQL injection vulnerability in Simple College Website 1.0 allows remote unauthenticated attackers to bypass the admin…
-
Medium 5.5
Infinite loop in Apache Tika's MP3 parser
A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.
-
Unscored —
There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta. An attacker who is able t…
-
Unscored —
There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit…
-
Unscored —
There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit…
-
High 8.0CVE-2021-21413 Public exploit
Misuse of `Reference` and other transferable APIs may lead to access to nodejs isolate
isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isol…
-
Unscored —
Buffer overflow vulnerability in sniff_channel_order function in aacdec_template.c in ffmpeg 3.1.2, allows attackers to…
-
Critical 9.8
Remote code execution in mongo-express
mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.
-
Unscored —
An issue was discovered in the Linux kernel before 5.11.11. tipc_nl_retrieve_key in net/tipc/node.c does not properly v…
-
Unscored —
An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows attackers to obtain …
-
Unscored —
An issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly consider that resolved_…
-
Unscored —
An issue was discovered in the Linux kernel before 5.11.11. The user mode driver (UMD) has a copy_process() memory leak…
-
Unscored —
An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to cause a denial …
-
Unscored —
GistPad before 0.2.7 allows a crafted workspace folder to change the URL for the Gist API, which leads to leakage of Gi…
-
Medium 6.4
[thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values
Potential for arbitrary code execution in npm package @thi.ng/egf `#gpg`-tagged property values (only if `decrypt: true` option is enabled). PR with patch has been submitted and will has been released as of v0.4.0 By default the EGF parse functions do NOT att…
-
Unscored —
A security vulnerability in HPE Unified Data Management (UDM) could allow the local disclosure of privileged informatio…
-
Medium 5.4
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Medium 5.4
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Medium 5.4
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Medium 5.4
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Medium 5.4
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Medium 5.4
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
High 7.1
IBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. …
-
Medium 5.4
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Medium 5.1
IBM UrbanCode Deploy (UCD) 7.0.3.0, 7.0.4.0, 7.0.5.3, 7.0.5.4, 7.1.0.0, 7.1.1.0, 7.1.1.1, and 7.1.1.2, stores keystore …
-
High 7.1
IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection (XXE) attack wh…
-
Medium 6.2
IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 stores user credentials in plain in clear text which can be re…
-
Medium 5.4
IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 could allow an authenticated user to initiate a plugin or comp…
-
Medium 5.4
Possible XSS injection through DataColumn Grid class
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type DataColumn is badly used. The problem is fixed in 1.7.7.3