Archive
March 2021
Vulnerabilities first published in this month (UTC), newest first.
1,455 results · Feed
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the client-tags CGI handler when client tags are…
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Dereference of a NULL-pointer that could result in a crash if ac…
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Memory leak if multiple filters are executed and the last one is…
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Memory leak when client tags are active can cause a system crash.
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Memory leak in the show-status CGI handler when no filter files …
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Memory leaks when a response is buffered and the buffer limit is…
-
Unscored —
An issue was discovered in Nokia NetAct 18A. A malicious user can change a filename of an uploaded file to include Java…
-
Unscored —
An issue was discovered in Nokia NetAct 18A. A remote user, authenticated to the NOKIA NetAct Web Page, can visit the S…
-
Unscored —
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF…
-
Unscored —
A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a…
-
Unscored —
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the …
-
High 7.8
ArcGIS general raster security update: use-after-free
A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context o…
-
Unscored —
Improper Authorization vulnerability in Netop Vision Pro up to and including to 9.7.1 allows an attacker to replay netw…
-
Unscored —
Cleartext transmission of sensitive information in Netop Vision Pro up to and including 9.7.1 allows a remote unauthent…
-
Unscored —
Incorrect default permissions vulnerability in the API of Netop Vision Pro up to and including 9.7.1 allows a remote un…
-
Unscored —
Local privilege escalation vulnerability in Windows clients of Netop Vision Pro up to and including 9.7.1 allows a loca…
-
Low 3.3
Hijacking vulnerability in Samsung Cloud prior to version 4.7.0.3 allows attackers to intercept when the provider is ex…
-
Low 3.7
Path Traversal vulnerability in Samsung Notes prior to version 4.2.00.22 allows attackers to access local files without…
-
Low 3.2
Improper access control in Samsung Internet prior to version 13.2.1.70 allows physically proximate attackers to bypass …
-
Medium 5.5
Using unsafe PendingIntent in Samsung Notes prior to version 4.2.00.22 allows local attackers unauthorized action witho…
-
Low 3.3
Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in…
-
Medium 5.5
Using empty PendingIntent in Galaxy Themes prior to version 5.2.00.1215 allows local attackers to read/write private fi…
-
Medium 5.5
Using PendingIntent with implicit intent in Bixby Voice prior to version 3.0.52.14 allows attackers to execute privileg…
-
Low 3.2
Improper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and 12.1.1.3 allows physica…
-
Low 2.0
Information Exposure vulnerability in Samsung Account prior to version 12.1.1.3 allows physically proximate attackers t…
-
Medium 5.5
Using unsafe PendingIntent in Slow Motion Editor prior to version 3.5.18.5 allows local attackers unauthorized action w…
-
Critical 9.8
A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially c…
-
High 7.5
Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specia…
-
Unscored —
Authentication Bypass Vulnerability in Micro Focus Access Manager Product, affects all version prior to version 4.5.3.3…
-
High 7.8
Uncontrolled Search Path Element in Bosch Video Streaming Gateway Installer
Calling an executable through an Uncontrolled Search Path Element in the Bosch Video Streaming Gateway installer up to and including version 6.45.10 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the vict…
-
High 7.8
Uncontrolled Search Path Element in Bosch Monitor Wall Installer
Loading a DLL through an Uncontrolled Search Path Element in the Bosch Monitor Wall installer up to and including version 10.00.0164 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked in…
-
High 7.8
Uncontrolled Search Path Element in Bosch Configuration Manager Installer
Loading a DLL through an Uncontrolled Search Path Element in the Bosch Configuration Manager installer up to and including version 7.21.0078 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tr…
-
High 7.8
Uncontrolled Search Path Element in Bosch Video Client installer
Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Client installer up to and including version 1.7.6.079 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked int…
-
High 7.8
Uncontrolled Search Path Element in Bosch Video Recording Manager Installer
Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Recording Manager installer up to and including version 3.82.0055 for 3.82, up to and including version 3.81.0064 for 3.81 and 3.71 and older potentially allows an attacker to execut…
-
High 7.8
Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer
Loading a DLL through an Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer in versions 10.1.0, 10.0.1, 10.0.0 and 9.0.0 and older potentially allows an attacker to execute arbitrary code on a victim's system. This affects both the installer as we…
-
High 7.8
Uncontrolled Search Path Element in Bosch IP Helper
Loading a DLL through an Uncontrolled Search Path Element in Bosch IP Helper up to and including version 1.00.0008 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malic…
-
Medium 6.6
Duo Authentication Proxy Installer Denial of Service Vulnerability
The Duo Authentication Proxy installer prior to 5.2.1 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If successful, an attacker can ma…
-
High 7.4
CA certificate check bypass with X509_V_FLAG_X509_STRICT
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded e…
-
Medium 5.9
NULL pointer deref in signature_algorithms processing
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a si…
-
Unscored —
Apache SpamAssassin has an OS Command Injection vulnerability
In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, us…