Archive
March 2021
Vulnerabilities first published in this month (UTC), newest first.
1,455 results · Feed
-
Unscored —
A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): …
-
Unscored —
A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products…
-
Unscored —
A remote denial of service (dos) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in vers…
-
Unscored —
Xerox Phaser 6510 before 64.61.23 and 64.59.11 (Bridge), WorkCentre 6515 before 65.61.23 and 65.59.11 (Bridge), VersaLi…
-
Critical 9.8
gitjacker arbitrary code execution
gitjacker before 0.1.0 allows remote attackers to execute arbitrary code via a crafted .git directory because of directory traversal.
-
Unscored —
An issue was discovered in PortSwigger Burp Suite before 2021.2. During viewing of a malicious request, it can be manip…
-
Unscored —
Xerox AltaLink B8045/B8090 before 103.008.030.32000, C8030/C8035 before 103.001.030.32000, C8045/C8055 before 103.002.0…
-
Unscored —
Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allows Command Injection as root in its administ…
-
Unscored —
Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allow Authentication Bypass in its administrativ…
-
Unscored —
A local authentication bypass vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version…
-
High 7.8
Douzone ActiveX File Download and Execution Vulnerability
NBBDownloader.ocx ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing dam…
-
Unscored —
A ZTE product has a DoS vulnerability. A remote attacker can amplify traffic by sending carefully constructed IPv6 pack…
-
Unscored —
An open redirect vulnerability in Ilch CMS version 2.1.42 allows attackers to redirect users to an attacker's site afte…
-
Unscored —CVE-2021-29267 Public exploit
Sherlock SherlockIM through 2021-03-29 allows Cross Site Scripting (XSS) by leveraging the api/Files/Attachment URI to …
-
Low 3.3CVE-2021-23358 Public exploit
Arbitrary Code Injection
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
-
Unscored —
The Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) Web management administrator password can be changed by sending…
-
Unscored —CVE-2021-28937 Scanner template
The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) cont…
-
Unscored —
Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.
-
Unscored —
The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded API key, used to communicate with the …
-
Medium 6.1
Cross-site scripting in bluemonday
bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism against the "script" string.
-
Unscored —
remark42 before 1.6.1 allows XSS, as demonstrated by "Locator: Locator{URL:" followed by an XSS payload. This is relate…
-
Unscored —
BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability.
-
Medium 6.5
Bulk list client endpoint exposes too much metadata about a client
wire-server is an open-source back end for Wire, a secure collaboration platform. In wire-server from version 2021-02-16 and before version 2021-03-02, the client metadata of all users was exposed in the `GET /users/list-clients` endpoint. The endpoint could …
-
Unscored —
An issue was discovered in the Linux kernel through 5.11.10. drivers/net/ethernet/freescale/gianfar.c in the Freescale …
-
Unscored —
An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows at…
-
Unscored —
An issue was discovered in the Linux kernel before 5.11.9. drivers/vhost/vdpa.c has a use-after-free because v->config_…
-
High 7.2
containernetworking/cni improper limitation of path name
An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to ref…
-
High 7.5
Nimble falls back to insecure http url when fetching packages
Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.ni…
-
High 8.1
Nimble fails to validate certificates due to insecure httpClient defaults
Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setti…
-
High 8.3
Nimble arbitrary code execution for specially crafted package metadata
Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the …
-
Unscored —
In FreeBSD 12.2-STABLE before r365730, 11.4-STABLE before r365738, 12.1-RELEASE before p10, 11.4-RELEASE before p4, and…
-
Medium 5.5
Incorrect authorization in OAuth2-Proxy
OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The `--gitlab-group` flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag sett…
-
Unscored —CVE-2020-7461 Public exploit
In FreeBSD 12.1-STABLE before r365010, 11.4-STABLE before r365011, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and …
-
Unscored —
In FreeBSD 12.1-STABLE before r364644, 11.4-STABLE before r364651, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and …
-
Unscored —
In 11.4-PRERELEASE before r360733 and 11.3-RELEASE before p13, improper mbuf handling in the kernel causes a use-after-…
-
Unscored —
In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and …
-
Unscored —CVE-2020-25578 Public exploit
In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and …
-
Unscored —
In FreeBSD 12.2-STABLE before r369334, 11.4-STABLE before r369335, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 wh…
-
Unscored —
In FreeBSD 12.2-STABLE before r369312, 11.4-STABLE before r369313, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 du…
-
Unscored —
In FreeBSD 12.2-STABLE before r369346, 11.4-STABLE before r369345, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 a …