Archive
9 April 2021
Vulnerabilities first published on this day (UTC), newest first.
55 results · Feed
-
High 8.5
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary co…
-
Unscored —
Use after free in Aura in Google Chrome on Linux prior to 89.0.4389.114 allowed a remote attacker who had compromised t…
-
Unscored —
Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially explo…
-
Unscored —
Out of bounds read in IPC in Google Chrome prior to 89.0.4389.114 allowed a remote attacker who had compromised the ren…
-
Unscored —
Heap buffer overflow in TabStrip in Google Chrome on Windows prior to 89.0.4389.114 allowed a remote attacker to potent…
-
Unscored —
Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corr…
-
Unscored —
Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially explo…
-
High 7.5
Reject unauthorized access with GitHub PATs
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` fi…
-
Critical 9.9
Remote code execution on discord-recon .dirsearch and .arjun commands due to improper input validation
Discord Recon Server is a bot that allows you to do your reconnaissance process from your Discord. Remote code execution in version 0.0.1 would allow remote users to execute commands on the server resulting in serious issues. This flaw is patched in 0.0.2.
-
Unscored —
SQL injection in admin.php in Online Book Store 1.0 allows remote attackers to execute arbitrary SQL commands and bypas…
-
High 7.2
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload …
KEV Nov 3, 2021 -
Critical 9.8
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account…
KEV Nov 3, 2021 -
Critical 9.3
A privilege escalation vulnerability exists in Dream Report 5 R20-2. In the default configuration, the Syncfusion Dashb…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in the Larsens Calender plugin Version <= 1.2 for WordPress allows remote atta…
-
Critical 9.3
A privilege escalation vulnerability exists in Dream Report 5 R20-2. IIn the default configuration, the following regis…
-
Critical 9.3
A privilege escalation vulnerability exists in Dream Report 5 R20-2. COM Class Identifiers (CLSID), installed by Dream …
-
Medium 6.1
subrion CMS Cross Site Scripting (XSS) vulnerability
Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the "payment gateway" column on transactions tab.
-
Medium 5.4
An exploitable SQL injection vulnerability exists in "global_lists/choices" page of the Rukovoditel Project Management …
-
Medium 5.4
An exploitable SQL injection vulnerability exists in the "forms_fields_rules/rules" page of the Rukovoditel Project Man…
-
Medium 5.4
An exploitable SQL injection vulnerability exists in the "access_rules/rules_form" page of the Rukovoditel Project Mana…
-
Medium 5.5
Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android…
-
Medium 5.8
Improper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions …
-
Medium 4.0
Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action.
-
Medium 4.3
Improper access control of certain port in SmartThings prior to version 1.7.63.6 allows remote temporary denial of serv…
-
Low 3.3
Intent redirection in Samsung Experience Service versions 10.8.0.4 in Android P(9.0) below, and 12.2.0.5 in Android Q(1…
-
Low 3.1
An improper synchronization logic in Samsung Email prior to version 6.1.41.0 can leak messages in certain mailbox in pl…
-
Medium 6.5
Using predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote attackers to get attac…
-
High 8.6CVE-2021-25374 Public exploit
An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in…
-
Medium 5.5
Using unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(…
-
Medium 5.9
An improper exception control in softsimd prior to SMR APR-2021 Release 1 allows unprivileged applications to access th…
-
Medium 4.0
A pendingIntent hijacking vulnerability in Secure Folder prior to SMR APR-2021 Release 1 allows unprivileged applicatio…
-
Medium 6.8
An improper access control in ActivityManagerService prior to SMR APR-2021 Release 1 allows untrusted applications to a…
-
Medium 6.8
An improper permission management in CertInstaller prior to SMR APR-2021 Release 1 allows untrusted applications to del…
-
High 7.9
An improper access control vulnerability in stickerCenter prior to SMR APR-2021 Release 1 allows local attackers to rea…
-
Critical 9.0
An improper input validation vulnerability in libswmfextractor library prior to SMR APR-2021 Release 1 allows attackers…
-
Medium 4.0
An improper SELinux policy prior to SMR APR-2021 Release 1 allows local attackers to access AP information without prop…
-
Medium 4.0
A vulnerability that stores IMSI values in an improper path prior to SMR APR-2021 Release 1 allows local attackers to a…
-
Medium 5.6
A pendingIntent hijacking vulnerability in Create Movie prior to SMR APR-2021 Release 1 in Android O(8.x) and P(9.0), 3…
-
High 7.1
An improper caller check vulnerability in Managed Provisioning prior to SMR APR-2021 Release 1 allows unprivileged appl…
-
Unscored —
A ZTE product has a configuration error vulnerability. Because a certain port is open by default, an attacker can consu…