Archive
6 April 2021
Vulnerabilities first published on this day (UTC), newest first.
94 results · Feed
-
Unscored —
An issue was discovered in the Linux kernel before 5.8. arch/x86/kvm/svm/svm.c allows a set_memory_region_test infinite…
-
Unscored —
An issue was discovered in the Linux kernel through 5.11.11. synic_get in arch/x86/kvm/hyperv.c has a NULL pointer dere…
-
Unscored —
An issue was discovered in the Linux kernel before 5.9. arch/x86/kvm/svm/sev.c allows attackers to cause a denial of se…
-
Unscored —
An issue was discovered in the Linux kernel before 5.8.10. virt/kvm/kvm_main.c has a kvm_io_bus_unregister_dev memory l…
-
Unscored —
An issue was discovered in the Linux kernel before 5.7. The KVM subsystem allows out-of-range access to memslots after …
-
Unscored —
The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is missing an authorization check on severa…
-
Unscored —
The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is vulnerable to XML external entity (XXE) …
-
Unscored —
The Proofpoint Insider Threat Management Agents (formerly ObserveIT Agent) for MacOS and Linux perform improper validat…
-
Unscored —
Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.11.1 allows stored XSS.
-
Unscored —
OpenIAM before 4.2.0.3 does not verify if a user has permissions to perform /webconsole/rest/api/* administrative actio…
-
Unscored —
OpenIAM before 4.2.0.3 has Incorrect Access Control for the Create User, Modify User Permissions, and Password Reset ac…
-
Unscored —
OpenIAM before 4.2.0.3 allows Directory Traversal in the Batch task.
-
Unscored —
OpenIAM before 4.2.0.3 allows XSS in the Add New User feature.
-
Unscored —
OpenIAM before 4.2.0.3 allows remote attackers to execute arbitrary code via Groovy Script.
-
High 7.5
Crash due to malformed relay protocol message
Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server `strelaysrv` can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the sa…
-
Unscored —
Sensitive smart card data is logged in default INFO logs by Teradici's PCoIP Connection Manager and Security Gateway pr…
-
Medium 6.8CVE-2021-21423 Public exploit
Exposure of Version-Control Repository to an Unauthorized Control Sphere in projen
`projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GitHub Workflows, `eslint`, `jest`, and more, from a well-typed definition written in JavaScript. Users of projen's `Node…
-
Unscored —
The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or…
-
Unscored —
ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when usi…
-
Critical —
Client TLS credentials sent raw to server in npm package nats
Nats is a Node.js client for the NATS messaging system. ## Problem Description _Preview versions_ of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this …
-
Medium 4.8
Local privilege escalation in MongoDB Compass for Windows
A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0…
-
Unscored —CVE-2021-24027 Public exploit
A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may h…
-
Unscored —
A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, …
-
Medium 5.5
Improper input validation in umoci
Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used.
-
Unscored —CVE-2021-30146 Public exploit
Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality."
-
Medium 5.4
LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administra…
-
Unscored —
Cleartext Storage in a File or on Disk in TimelyBills <= 1.7.0 for iOS and versions <= 1.21.115 for Android allows atta…
-
Unscored —
Union Pay up to 3.3.12, for iOS mobile apps, contains a CWE-347: Improper Verification of Cryptographic Signature vulne…
-
Unscored —
Union Pay up to 3.4.93.4.9, for android, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerabi…
-
Unscored —
Union Pay up to 1.2.0, for web based versions contains a CWE-347: Improper Verification of Cryptographic Signature vuln…
-
Medium 5.3
Directory Traversal in Django
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.
-
Unscored —CVE-2021-28142 Public exploit
CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete."
-
Unscored —
VIGRA Computer Vision Library Version-1-11-1 contains a segmentation fault vulnerability in the impex.hxx read_image_ba…
-
Unscored —
SerenityOS 2021-03-27 contains a buffer overflow vulnerability in the EndOfCentralDirectory::read() function.
-
Unscored —
SerenityOS fixed as of c9f25bca048443e317f1994ba9b106f2386688c3 contains a buffer overflow vulnerability in LibTextCode…
-
Unscored —
iKuaiOS 3.4.8 Build 202012291059 has an arbitrary file download vulnerability, which can be exploited by attackers to o…
-
Unscored —
RIOT-OS 2021.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl/gnrc_rpl_control_messages.c throu…
-
Unscored —
RIOT-OS 2021.01 contains a buffer overflow vulnerability in sys/net/gnrc/routing/rpl/gnrc_rpl_validation.c through the …
-
Unscored —
RIOT-OS 2020.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl/gnrc_rpl_control_messages.c.
-
Unscored —
SerenityOS Unspecified is affected by: Buffer Overflow. The impact is: obtain sensitive information (context-dependent)…