Archive
March 2021
Vulnerabilities first published in this month (UTC), newest first.
1,455 results · Feed
-
High 7.2
OS Command Injection in baserCMS
baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors.
-
Medium 5.4
Cross-site Scripting (XSS) in baserCMS
Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
-
Unscored —
UNIVERGE Aspire series PBX (UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100…
-
Unscored —
CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid (and/or setgid) file. …
-
High 7.5
CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempt…
-
Unscored —
CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Obj…
-
Unscored —
CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS). The impact is: An authentica…
-
High 7.8
CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Obj…
-
Unscored —
ACRN through 2.2 has a devicemodel/hw/pci/virtio/virtio.c NULL Pointer Dereference.
-
Unscored —
HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users with…
-
Unscored —
app/views_mod/user/user.py in LibrIT PaSSHport through 2.5 is affected by LDAP Injection. There is an information leak …
-
Unscored —CVE-2020-23517 Scanner template
Cross Site Scripting (XSS) vulnerability in Aryanic HighMail (High CMS) versions 2020 and before allows remote attacker…
-
Unscored —
A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who c…
-
Unscored —
Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to sqlcipher_export in crypto.c and s…
-
Unscored —
Realtek xPON RTL9601D SDK 1.9 stores passwords in plaintext which may allow attackers to possibly gain access to the de…
-
High 7.8
ArcGIS general raster security update: uninitialized pointer
Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution i…
-
High 7.8
ArcGIS general raster security update: buffer overflow
Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the …
-
Medium 6.4
ArcGIS Server image service and raster analytics security update: uninitialized pointer
Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service acc…
-
Medium 6.4
ArcGIS Server image service and raster analytics security update: buffer overflow
Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
-
Medium 6.4
ArcGIS Server image service and raster analytics security update: use-after-free
A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
-
Unscored —
A directory traversal on the /admin/sysmon.php script of Invigo Automatic Device Management (ADM) through 5.0 allows re…
-
Unscored —
A command injection on the /admin/broadcast.php script of Invigo Automatic Device Management (ADM) through 5.0 allows r…
-
Unscored —
Multiple session validity check issues in several administration functionalities of Invigo Automatic Device Management …
-
Unscored —
A SQL injection on the /admin/display_errors.php script of Invigo Automatic Device Management (ADM) through 5.0 allows …
-
Unscored —
The /admin/admapi.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote authenticated attack…
-
Unscored —
A directory traversal on the /admin/search_by.php script of Invigo Automatic Device Management (ADM) through 5.0 allows…
-
Unscored —CVE-2021-22889 EPSS 31%
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of stats…
-
Unscored —CVE-2021-22888 EPSS 16%
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of campaign-zone…
-
Unscored —
A miscommunication in the file system allows adversaries with access to the MU320E to escalate privileges on the MU320E…
-
Unscored —
The software performs an operation at a privilege level higher than the minimum level required, which creates new weakn…
-
Unscored —
SSH server configuration file does not implement some best practices. This could lead to a weakening of the SSH protoco…
-
Unscored —
The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to…
-
Unscored —
The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to…
-
Unscored —
The software contains a hard-coded password that could allow an attacker to take control of the merging unit using thes…
-
Unscored —
A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in t…
-
Unscored —
A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in t…
-
Unscored —
A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via webmaster-tools.…
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.31. An assertion failure triggered by a crafted CGI request may lead…
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.31. A memory leak that occurs when decompression fails unexpectedly …
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the show-status CGI handler when memory allocati…