Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
1,841 results · Feed
-
Unscored —
XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript via the name field
-
Unscored —
OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that…
-
Unscored —
OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list (payload in the common name) that is mishand…
-
Medium 6.4
Dell EMC Unity, UnityVSA, and Unity XT versions prior to 5.0.7.0.5.008 contain a plain-text password storage vulnerabil…
-
High 8.1
Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. A local authentica…
-
High 8.8
Dell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX Switch Module firmware vers…
-
High 8.3
Dell OpenManage Enterprise-Modular (OME-M) versions prior to 1.30.00 contain a security bypass vulnerability. An authen…
-
Unscored —
OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of …
-
Unscored —
OX App Suite 7.10.4 and earlier allows SSRF via a snippet.
-
Low 2.7
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated m…
-
Medium 4.8
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. A remote aut…
-
Medium 4.8
Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. A remote aut…
-
Medium 5.9
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability. A remote authenticated attac…
-
Medium 6.1
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthent…
-
Medium 5.9
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability.…
-
High 7.2
A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a paramet…
-
Unscored —
Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into …
-
Unscored —
Use after free in Dev Tools in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit hea…
-
Unscored —
Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 90.0.4430.93 allowed a remote attacker to potentiall…
-
Unscored —
Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially expl…
-
Unscored —
Incorrect security UI in downloads in Google Chrome on Android prior to 90.0.4430.93 allowed a remote attacker to perfo…
-
Unscored —
Type confusion in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corru…
-
Unscored —
Insufficient policy enforcement in extensions in Google Chrome prior to 90.0.4430.93 allowed an attacker who convinced …
-
Unscored —
Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially expl…
-
Unscored —
AMP Application Deployment Service in CubeCoders AMP 2.1.x before 2.1.1.2 allows a remote, authenticated user to open p…
-
Medium 6.2
Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacke…
-
Medium 6.2
Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacke…
-
High 7.4
Dell Hybrid Client versions prior to 1.5 contain a missing authentication for a critical function vulnerability. A loca…
-
Medium 4.0
Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacke…
-
High 7.5
Improper Input Validation and Loop with Unreachable Exit Condition ('Infinite Loop') in cumulative-distribution-function
cumulative-distribution-function is an open source npm library used which calculates statistical cumulative distribution function from data array of x values. In versions prior to 2.0.0 apps using this library on improper data may crash or go into an infinite…
-
High 7.5
Denial of Service (DoS)
This affects all versions <0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.
-
Medium 6.7
IBM Informix Dynamic Server 14.10 is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A…
-
High 8.6
Directory Traversal Vulnerability in SUSI.AI Server
SUSI.AI is an intelligent Open Source personal assistant. SUSI.AI Server before version d27ed0f has a directory traversal vulnerability due to insufficient input validation. Any admin config and file readable by the app can be retrieved by the attacker. Furth…
-
High 8.2
Unauthenticated SQL injection in Ampache
Ampache before version 4.2.2 allows unauthenticated users to perform SQL injection. Refer to the referenced GitHub Security Advisory for details and a workaround. This is fixed in version 4.2.2 and the development branch.
-
Unscored —
Pritunl Client v1.2.2550.20 contains a local privilege escalation vulnerability in the pritunl-service component. The a…
-
Medium 5.5
Improper input validation in CNCF Cortex
The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanag…
-
Unscored —
The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vu…
-
Unscored —CVE-2021-28959 EPSS 17%
Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in …
-
Unscored —
A buffer overflow in the RTSP service of the Ambarella Oryx RTSP Server 2020-01-07 allows an unauthenticated attacker t…
-
Unscored —
A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause…