Archive
March 2021
Vulnerabilities first published in this month (UTC), newest first.
1,455 results · Feed
-
Low 2.5
Improper lockscreen status check in cocktailbar service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allow…
-
Medium 5.5
Improper input check in wallpaper service in Samsung mobile devices prior to SMR Feb-2021 Release 1 allows untrusted ap…
-
Low 3.2
Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance informat…
-
Low 3.2
Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to contacts informa…
-
Low 3.2
Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance informat…
-
Unscored —
Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P9 and 9.8 are susceptible to a vulnerability which c…
-
Unscored —
Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P8 and 9.8 are susceptible to a vulnerability which c…
-
Unscored —
An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They all…
-
Unscored —
Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utilit…
-
Unscored —
In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file…
-
Critical 9.8CVE-2020-8298 EPSS 11%
Command injection in fs-path
fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, and `removeSync` methods.
-
Medium 5.4
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav…
-
Medium 5.4
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav…
-
Medium 5.4
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav…
-
Medium 5.4
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav…
-
Medium 5.4
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav…
-
Medium 6.4
IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitr…
-
Medium 6.4
IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitr…
-
Medium 6.4
IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitr…
-
Unscored —
An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3. The function does not…
-
Unscored —
[20210307] - Core - ACL violation within com_content frontend editing
An issue was discovered in Joomla! 3.0.0 through 3.9.24. Incorrect ACL checks could allow unauthorized change of the category for an article.
-
Unscored —
[20210309] - Core - Inadequate filtering of form contents could allow to overwrite the author field
An issue was discovered in Joomla! 1.6.0 through 3.9.24. Inadequate filtering of form contents could allow to overwrite the author field.
-
Medium —
[20210308] - Core - Path Traversal within joomla/archive zip class
An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path.
-
Unscored —
[20210303] - Core - XSS within alert messages showed to users
An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of messages showed to users that could lead to xss issues.
-
Unscored —
[20210302] - Core - Potential Insecure FOFEncryptRandval
An issue was discovered in Joomla! 3.2.0 through 3.9.24. The core shipped but unused randval implementation within FOF (FOFEncryptRandval) used an potential insecure implemetation. That has now been replaced with a call to 'random_bytes()' and its backport th…
-
Unscored —
[20210301] - Core - Insecure randomness within 2FA secret generation
An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes.
-
Unscored —
[20210305] - Core - Input validation within the template manager
An issue was discovered in Joomla! 3.2.0 through 3.9.24. Missing input validation within the template manager.
-
Unscored —
[20210304] - Core - XSS within the feed parser library
An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues.
-
Unscored —
[20210301] - Core - Insecure randomness within 2FA secret generation
An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand() function within the process of generating the 2FA secret.
-
Unscored —CVE-2021-23132 Public exploit
[20210306] - Core - com_media allowed paths that are not intended for image uploads
An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intended for image uploads
-
Medium 4.0
When traffic other than HTTP/S (eg: SSH traffic, etc...) traverses the FortiGate in version below 6.2.5 and below 6.4.2…
-
High 7.1
An improper access control vulnerability in FortiProxy SSL VPN portal 2.0.0, 1.2.9 and below versions may allow an auth…
-
Medium 4.8
Regular Expression Denial of Service (ReDoS)
This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process.
-
Critical 9.8
Remote Code Execution (RCE)
The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.
-
Unscored —
Courier Management System 1.0 1.0 is affected by SQL Injection via 'MULTIPART street '.
-
Unscored —
Courier Management System 1.0 - 'First Name' Stored XSS
-
Unscored —
SQL injection vulnerability was discovered in Courier Management System 1.0, which can be exploited via the ref_no (POS…
-
Medium 4.1
An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS…
-
Medium 5.9
Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the…
-
Critical 9.8
qcubed PHP object injection
A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request.