Archive
1 April 2021
Vulnerabilities first published on this day (UTC), newest first.
65 results · Feed
-
High 8.1
ApiKey secret could be revelated on network issue
node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too This is fixed in node-etsy-client v0.3.0 and later.
-
Unscored —
An issue was discovered in Devolutions Remote Desktop Manager before 2020.2.12. There is a cross-site scripting (XSS) v…
-
Unscored —
An issue was discovered in Devolutions Server before 2020.3. There is a cross-site scripting (XSS) vulnerability in ent…
-
Unscored —
An issue was discovered in Devolutions Server before 2020.3. There is an exposure of sensitive information in diagnosti…
-
Unscored —
An issue was discovered in Devolutions Server before 2020.3. There is broken access control on Password List entry elem…
-
Unscored —
An issue was discovered in Devolutions Server before 2020.3. There is Broken Authentication with Windows domain users.
-
High 7.5
Vulnerability in Stripe for Visual Studio Code < 1.7.3
vscode-stripe is an extension for Visual Studio Code. A vulnerability in Stripe for Visual Studio Code extension exists when it loads an untrusted source-code repository containing malicious settings. An attacker who successfully exploited the vulnerability c…
-
Low 3.7
Potential sensitive information disclosed in error reports
django-registration is a user registration package for Django. The django-registration package provides tools for implementing user-account registration flows in the Django web framework. In django-registration prior to 3.1.2, the base user-account registrati…
-
Unscored —
Cross-Site Scripting (XSS) in Administrative Reports in Devolutions Remote Desktop Manager before 2021.1 allows remote …
-
Unscored —
eMPS 9.0.1.923211 on the Central Management of FireEye EX 3500 devices allows remote authenticated users to conduct SQL…
-
Unscored —
eMPS 9.0.1.923211 on FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.
-
Unscored —
Server Side Request Forgery (SSRF) vulnerability in saveUrlAs function in ImagesService.java in sunkaifei FlyCMS versio…
-
Unscored —
VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a…
-
Unscored —
A potential security vulnerability has been identified in HPE Superdome Flex server. A denial of service attack can be …
-
Unscored —
A potential security vulnerability has been identified in HPE iLO Amplifier Pack. The vulnerability could be remotely e…
-
Medium 6.6
Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data expo…
-
Unscored —
The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attacker…
-
Unscored —CVE-2021-20078 EPSS 59%
Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path tr…
-
Unscored —
KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus …
-
Unscored —
In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `…
-
Unscored —
An application bypass mechanism vulnerability exists in a component interface of Huawei Smartphone. Local attackers can…
-
Unscored —
An application error verification vulnerability exists in a component interface of Huawei Smartphone. Local attackers c…
-
Unscored —
A memory buffer error vulnerability exists in a component interface of Huawei Smartphone. Local attackers can exploit t…
-
Unscored —
A memory buffer error vulnerability exists in a component interface of Huawei Smartphone. Local attackers may exploit t…
-
Medium 6.5
Improper Locking in github.com/containers/storage
A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an un…
-
Medium 4.3
curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due…
-
Medium 5.3
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Act…
-
High 8.6
Client side code execution in gitlab-vscode-extension v3.15.0 and earlier allows attacker to execute code on user system
-
High 7.5
Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
-
Medium 5.3
Authorization Before Parsing and Canonicalization in jetty
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml …
-
Low 2.7
Directory exposure in jetty
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and…
-
Medium 4.3
Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike…
-
Unscored —CVE-2021-20235 EPSS 44%
There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp. The decoder static allocato…
-
Unscored —
An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4.3.3 in src/…
-
Unscored —
An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having U…
-
Medium 6.5
Acrobat Reader DC Missing Support for Integrity Check
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are missing support for an integrity check. An unauthenticated attacker could leverage this vulnerability to modify content in a ce…