Archive
March 2021
Vulnerabilities first published in this month (UTC), newest first.
1,455 results · Feed
-
Critical 9.8
qcubed SQL injection vulnerability in profile.php via the strQuery parameter
A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.
-
Medium 6.1CVE-2020-24912 Scanner template
qcubed reflected cross-site scripting (XSS) vulnerability
A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.
-
Unscored —
PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote …
-
Unscored —
Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software rel…
-
Unscored —
Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software rel…
-
Critical 10.0
A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read …
-
Critical 10.0
A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC…
-
Critical 10.0
A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read …
-
Critical 10.0
A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read …
-
Low 3.0
DataDog API Client contains a Local Information Disclosure Vulnerability
The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the API Client. The Datadog API is executed on a unix-like system with multiple users. The API is used to …
-
Medium 6.1
openark/orchestrator cross-site scripting vulnerability
resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter.
-
Unscored —
LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageContro…
-
Unscored —
An issue was discovered in AdGuard before 0.105.2. An attacker able to get the user's cookie is able to bruteforce thei…
-
Medium 5.4
XSS injection on ticket update
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is an XSS vulnerability involving a logged in user while updating a ticket.
-
Medium 5.4
Stored XSS on documents
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability within the document upload function (Home > Management > Do…
-
Medium 4.9
XSS on tabs
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability in the /ajax/common.tabs.php endpoint, indeed, at least two…
-
Unscored —
A CSV injection vulnerability found in Online Invoicing System (OIS) 4.3 and below can be exploited by users to perform…
-
Critical 9.8
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key…
KEV Mar 5, 2026 -
Low 3.5
An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS…
-
Medium 5.3
An issue has been discovered in GitLab affecting all versions starting with 13.0. Confidential issue titles in Gitlab w…
-
High 8.8
A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A s…
-
High 8.6
An out-of-bounds read vulnerability exists in the AMF File AMFParserContext::endElement() functionality of Slic3r libsl…
-
Critical 9.8
A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predictin…
-
Unscored —
VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input va…
-
Unscored —
Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured.
-
Unscored —
Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `…
-
Unscored —
A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users exte…
-
Unscored —CVE-2021-22883 EPSS 77%
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connect…
-
Unscored —CVE-2021-22884 EPSS 37%
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes …
-
Unscored —
The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of a…
-
Medium 5.9
IBM Security Verify Bridge contains hard-coded credentials, such as a password or cryptographic key, which it uses for …
-
Medium 5.9
IBM Security Verify Bridge uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h…
-
Unscored —
The [Webform module for Drupal 8/9](https://www.drupal.org/project/webform) includes a default Contact webform, which s…
-
Unscored —CVE-2021-20233 Public exploit
A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length cal…
-
Unscored —
A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a he…
-
Unscored —CVE-2020-25632 Public exploit
A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as …
-
Unscored —
A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very l…
-
Unscored —CVE-2020-14372 Public exploit
A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Se…
-
Unscored —
A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line i…
-
Unscored —
A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an …