Archive
March 2021
Vulnerabilities first published in this month (UTC), newest first.
1,455 results · Feed
-
Unscored —
In FreeBSD 12.2-STABLE before r365772, 11.4-STABLE before r365773, 12.1-RELEASE before p10, 11.4-RELEASE before p4 and …
-
Unscored —
In FreeBSD 12.2-STABLE before r365767, 11.4-STABLE before r365769, 12.1-RELEASE before p10, 11.4-RELEASE before p4 and …
-
High 8.1
BuddyPress privilege escalation via REST API
BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint.…
-
Medium 6.1
HTML injection in email and account expiry notifications
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed message…
-
Medium 6.9
Cross-site scripting (XSS) vulnerability in the password reset endpoint
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to …
-
Medium 6.2
An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to s…
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauth…
-
Medium 5.7
In all versions of GitLab, marshalled session keys were being stored in Redis.
-
Medium 4.3
Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inacces…
-
Medium 6.1CVE-2021-25372 Exploited
An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.
KEV Jun 29, 2023 -
Medium 6.1CVE-2021-25371 Exploited
A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.
KEV Jun 29, 2023 -
Medium 6.1CVE-2021-25370 Exploited
An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory co…
KEV Nov 8, 2022 -
Medium 6.2CVE-2021-25369 Exploited
An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel infor…
KEV Nov 8, 2022 -
Unscored —
Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markd…
-
Unscored —
MicroSeven MYM71080i-B 2.0.5 through 2.0.20 devices send admin credentials in cleartext to pnp.microseven.com TCP port …
-
High 7.5
Authentication Bypass by Primary Weakness in github.com/kongchuanhujiao/server
In github.com/kongchuanhujiao/server before version 1.3.21 there is an authentication Bypass by Primary Weakness vulnerability. All users are impacted. This is fixed in version 1.3.21.
-
Unscored —
Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admi…
-
Unscored —
A heap based buffer overflow in coders/tiff.c may result in program crash and denial of service in ImageMagick before 7…
-
Medium 6.3
There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar…
-
Unscored —
A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child…
-
Unscored —
When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or …
-
Unscored —
A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input…
-
Unscored —
A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_…
-
Unscored —
A flaw was found in upx canPack in p_lx_elf.cpp in UPX 3.96. This flaw allows attackers to cause a denial of service (S…
-
Medium 5.3
Exposure of class information in RESTEasy
A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS reso…
-
Unscored —
Tableau Server fails to validate certain URLs that are embedded in emails sent to Tableau Server users.
-
Unscored —
MuleSoft is aware of a XML External Entity (XXE) vulnerability affecting certain versions of a Mule runtime component t…
-
Unscored —
MuleSoft is aware of a Server Side Request Forgery vulnerability affecting certain versions of a Mule runtime component…
-
Unscored —
MuleSoft is aware of a Remote Code Execution vulnerability affecting certain versions of a Mule runtime component that …
-
Unscored —
SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page.
-
Unscored —
The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context…
-
Unscored —
Remote Code Execution Vulnerability in tests/support/stores/test_grid_filter.php in oria gridx 1.3, allows remote attac…
-
Medium 5.4
Craft CMS Cross-site Scripting Vulnerability
Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.
-
Unscored —
Cross-Site scripting vulnerability in Micro Focus Access Manager product, affects all version prior to version 5.0. The…
-
High 7.5
Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all ver…
KEV Nov 3, 2021 -
Unscored —
Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless …
-
Medium 6.5
McAfee ePO Information Leak vulnerability
Information leak vulnerability in the Agent Handler of McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows an unauthenticated user to download McAfee product packages (specifically McAfee Agent) available in ePO repository and install them on the…
-
Medium 6.3
McAfee ePO unvalidated URL redirect vulnerability
Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 could cause an authenticated ePO user to load an untrusted site in an ePO iframe which could steal information from the authenticated user.
-
Low 3.5
McAfee ePO Cross-site Scripting vulnerability
Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized.
-
Medium 5.4
Cross-site Scripting (XSS) in baserCMS
Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.