Archive
March 2021
Vulnerabilities first published in this month (UTC), newest first.
1,455 results · Feed
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7. A potential resource exhau…
-
Unscored —
A component API of the HarmonyOS 2.0 has a permission bypass vulnerability. Local attackers may exploit this vulnerabil…
-
Unscored —
In bPanel 2.0, the administrative ajax endpoints (aka ajax/aj_*.php) are accessible without authentication and allow SQ…
-
Unscored —
A component of HarmonyOS 2.0 has a DoS vulnerability. Local attackers may exploit this vulnerability to mount a file sy…
-
Unscored —
Calling of non-existent provider in MobileWips application prior to SMR Feb-2021 Release 1 allows unauthorized actions …
-
Unscored —
A vulnerability in Stormshield Network Security could allow an attacker to trigger a protection related to ARP/NDP tabl…
-
Medium 4.0
The IBM Application Performance Monitoring UI (IBM Cloud APM 8.1.4) allows web pages to be stored locally which can be …
-
Medium 4.3
IBM Monitoring (IBM Cloud APM 8.1.4 ) could allow an authenticated user to modify HTML content by sending a specially c…
-
Medium 4.9
The IBM Cloud APM 8.1.4 server will issue a DNS request to resolve any hostname specified in the Cloud Event Management…
-
Unscored —CVE-2020-23518 Public exploit
Cross Site Scripting (XSS) vulnerability in UltimateKode Neo Billing - Accounting, Invoicing And CRM Software up to ver…
-
Medium 4.9CVE-2021-21514 Public exploit
Dell EMC OpenManage Server Administrator (OMSA) versions 9.5 and prior contain a path traversal vulnerability. A remote…
-
High 8.6
Dell EMC OpenManage Server Administrator (OMSA) version 9.5 Microsoft Windows installations with Distributed Web Server…
-
Unscored —
Blackboard Collaborate Ultra 20.02 is affected by a cross-site scripting (XSS) vulnerability. The XSS payload will exec…
-
Medium 6.1
Stored XSS in Apache Ambari
A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4.
-
Unscored —
An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139. In the implementation of Sharing Groups, t…
-
Unscored —
An issue was discovered on LG mobile devices with Android OS 11 software. They mishandle fingerprint recognition becaus…
-
Critical 10.0
Prefix escape
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. I…
-
Critical 10.0
Prefix escape
fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server…
-
Low 2.6
User content sandbox can be confused into opening arbitrary documents
matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content sandbox can be abused to trick users into opening unexpected documents. The content is opened with a `blob` origin that …
-
Unscored —
Accellion FTA 9_12_432 and earlier is affected by argument injection via a crafted POST request to an admin endpoint. T…
-
Unscored —
Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed v…
-
Unscored —
The telnet administrator service running on port 650 on Gigaset DX600A v41.00-175 devices does not implement any lockou…
-
Unscored —
A buffer overflow vulnerability in the AT command interface of Gigaset DX600A v41.00-175 devices allows remote attacker…
-
Unscored —
JPEG XL (aka jpeg-xl) through 0.3.2 allows writable memory corruption.
-
Unscored —
ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters.
-
Unscored —CVE-2021-27886 EPSS 46%
rakibtg Docker Dashboard before 2021-02-28 allows command injection in backend/utilities/terminal.js via shell metachar…
-
Medium 5.1
Weak JSON Web Token in yapi-vendor
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.
-
High 8.2
An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentica…
KEV Apr 7, 2023 -
High 8.8
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires su…
KEV Apr 7, 2023 -
High 8.1
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires su…
KEV Apr 7, 2023 -
Unscored —
EPrints 3.4.2 allows remote attackers to execute arbitrary commands via crafted input to the verb parameter in a cgi/to…
-
Unscored —
EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted JSON/XML input …
-
Unscored —
EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted LaTeX input to …
-
Unscored —CVE-2021-26475 Scanner template
EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI.
-
Unscored —
EPrints 3.4.2 allows remote attackers to execute OS commands via crafted LaTeX input to a cgi/cal?year= URI.
-
Unscored —CVE-2021-26702 Scanner template
EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/dataset_dictionary URI.
-
Critical 9.0
Dell EMC SourceOne, versions 7.2SP10 and prior, contain a Stored Cross-Site Scripting vulnerability. A remote low privi…
-
High 7.2
SRS Policy Manager 6.X is affected by an XML External Entity Injection (XXE) vulnerability due to a misconfigured XML p…
-
Unscored —
WPS Hide Login 1.6.1 allows remote attackers to bypass a protection mechanism via post_password.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to i…