Archive
8 April 2021
Vulnerabilities first published on this day (UTC), newest first.
65 results · Feed
-
Unscored —
A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0. A credential leak was i…
-
Medium 4.0
A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network inter…
-
Unscored —
A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size pr…
-
Unscored —
Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information di…
-
Medium 4.3
CSRF vulnerability in Jenkins Micro Focus Application Automation Tools Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow form validation without permission checks.
-
Medium 4.8
SSL/TLS certificate validation unconditionally disabled by Jenkins Micro Focus Application Automation Tools Plugin
Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow unconditionally disabling of SSL/TLS certificates.
-
High 8.8
Reflected XSS vulnerability in Jenkins Micro Focus Application Automation Tools Plugin
Reflected XSS vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects all version 6.7 and earlier versions.
-
Medium 4.3
Missing permission checks in Micro Focus Application Automation Tools Plugin
Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow access without permission checks.
-
Unscored —
The application in the mobile phone can unauthorized access to the list of running processes in the mobile phone, Xiaom…
-
Unscored —
The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.
-
Unscored —
The Dolby Audio X2 (DAX2) API service before 0.8.8.90 on Windows allows local users to gain privileges.
-
Unscored —
There is a memory leak vulnerability in some Huawei products. An authenticated remote attacker may exploit this vulnera…
-
Unscored —
On Xiaomi router AX1800 rom version < 1.0.336 and RM1800 root version < 1.0.26, the encryption scheme for a user's back…
-
Unscored —
A RACE CONDITION on XQBACKUP causes a decompression path error on Xiaomi router AX3600 with ROM version =1.0.50.
-
Unscored —
Authentication bypass vulnerability in Micro Focus Operations Bridge Manager affects versions 2019.05, 2019.11, 2020.05…
-
Unscored —
Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging confi…
-
Unscored —
An issue was discovered in Aprelium Abyss Web Server X1 2.12.1 and 2.14. A crafted HTTP request can lead to an out-of-b…
-
Unscored —
The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting (XSS) vulnerability affecting versions 2.0…
-
Low —
CSRF Vuln can expose user's QRcode
### Impact When a user is setting up two-factor authentication using an authenticator app, a QRcode is generated and made available via a GET request to /tf-qrcode. Since GETs do not have any CSRF protection, it is possible a malicious 3rd party could access …
-
Unscored —
An issue was discovered in Realtek rtl8723de BLE Stack <= 4.1 that allows remote attackers to cause a Denial of Service…
-
Unscored —
Learnsite 1.2.5.0 contains a remote privilege escalation vulnerability in /Manager/index.aspx through the JudgIsAdmin()…
-
Unscored —
zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows a…
-
Unscored —
VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration does not r…
-
Unscored —
VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissi…
-
Unscored —CVE-2021-28924 EPSS 10%
Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page.
-
Unscored —
SQL injection vulnerability in Nagios Network Analyzer before 2.4.3 via the o[col] parameter to api/checks/read/.
-
Medium 4.3
IBM WebSphere Application Server 7.0, 8.0, and 8.5 is vulnerable to server-side request forgery (SSRF). By sending a sp…
-
Unscored —
A stored XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in the event name and description fields. An…
-
Unscored —
Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create…
-
Unscored —
A blind XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in event name and description fields. An atta…
-
Unscored —
Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create…
-
Unscored —
AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to trigger a stack-based bu…
-
Unscored —
AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to interact directly with p…
-
Unscored —
A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remo…
-
High 7.5
Clam AntiVirus (ClamAV) Email Parser Denial of Service Vulnerability
A vulnerability in the PDF parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper buffe…
-
High 7.5
Clam AntiVirus (ClamAV) PDF Parser Denial of Service Vulnerability
A vulnerability in the email parsing module in Clam AntiVirus (ClamAV) Software version 0.103.1 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to im…
-
High 7.5
Clam AntiVirus (ClamAV) Excel XLM Parser Denial of Service Vulnerability
A vulnerability in the Excel XLM macro parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to im…
-
Medium 6.6
Cisco IOS XR Software Command Injection Vulnerability
A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges on the underlying Linux operating system (OS) of an affected device. This vulnerability is due…
-
High 7.8CVE-2021-1480 Public exploit
Cisco SD-WAN vManage Software Vulnerabilities
Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gain escalated privileges on an affected system. For more information about these …
-
High 7.8
Cisco SD-WAN vManage Software Vulnerabilities
Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gain escalated privileges on an affected system. For more information about these …