2 April 2021

178 results · Feed

• Unscored —
  CVE-2019-20465

  An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. It is possible (using TELN…

  Apr 2, 2021
• High 7.5
  CVE-2019-20464

  An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. By default, a mobile appli…

  Apr 2, 2021
• Unscored —
  CVE-2019-20463

  An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. A crash and reboot can be …

  Apr 2, 2021
• Unscored —
  CVE-2021-28124

  A man-in-the-middle vulnerability in Cohesity DataPlatform support channel in version 6.3 up to 6.3.1g, 6.4 up to 6.4.1…

  Apr 2, 2021
• High 7.1
  CVE-2021-21400

  Entering code in App Lock modal sends input to conversation

  wire-webapp is an open-source front end for Wire, a secure collaboration platform. In wire-webapp before version 2021-03-15-production.0, when being prompted to enter the app-lock passphrase, the typed passphrase will be sent into the most recently used chat …

  wireapp wire-webapp
  Apr 2, 2021
• Unscored —
  CVE-2021-28123

  Undocumented Default Cryptographic Key Vulnerability in Cohesity DataPlatform version 6.3 prior 6.3.1g, 6.4 up to 6.4.1…

  Apr 2, 2021
• Medium 6.7
  CVE-2021-28113 EPSS 23%

  A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3…

  Apr 2, 2021
• Medium 6.1
  CVE-2021-29652

  pomerium_signature is not verified in middleware in github.com/pomerium/pomerium

  Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process

  github.com/pomerium/pomerium Go
  Apr 2, 2021
• Medium 6.3
  CVE-2021-29651

  JWT leak via Open Redirect in Programmatic access

  Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2).

  github.com/pomerium/pomerium Go
  Apr 2, 2021
• Unscored —
  CVE-2021-29011

  DMA Softlab Radius Manager 4.4.0 is affected by Cross Site Scripting (XSS) via the description, name, or address field …

  Apr 2, 2021
• Unscored —
  CVE-2021-29012

  DMA Softlab Radius Manager 4.4.0 assigns the same session cookie to every admin session. The cookie is valid when the a…

  Apr 2, 2021
• Unscored —
  CVE-2021-25894

  Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the /magnoliaPublic/trav…

  Apr 2, 2021
• Unscored —
  CVE-2021-25893

  Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the setText parameter of…

  Apr 2, 2021
• High 7.5
  CVE-2021-22696

  OAuth 2 authorization service vulnerable to DDos attacks

  CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, t…

  Apache Software Foundation Apache CXF org.apache.cxf:cxf org.apache.cxf:apache-cxf Maven
  Apr 2, 2021
• Unscored —
  CVE-2021-30000

  An issue was discovered in LATRIX 0.6.0. SQL injection in the txtaccesscode parameter of inandout.php leads to informat…

  Apr 2, 2021
• Unscored —
  CVE-2021-30003

  An issue was discovered on Nokia G-120W-F 3FE46606AGAB91 devices. There is Stored XSS in the administrative interface v…

  Apr 2, 2021
• Unscored —
  CVE-2021-30002

  An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 2, 2021
• Medium 4.3
  CVE-2021-30004

  In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in t…

  wpa wpa_supplicant hostapd wpa_supplicant Debian Azure Linux Alpine
  Apr 2, 2021