Archive
14 April 2021
Vulnerabilities first published on this day (UTC), newest first.
80 results · Feed
-
Unscored —
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the all_public_streams API feature r…
-
Unscored —
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (pre…
-
Unscored —
The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, fr…
-
Unscored —
The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from …
-
Unscored —
The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before ve…
-
Unscored —
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing…
-
Unscored —
In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to strea…
-
Unscored —
An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary …
-
Unscored —
An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClien…
-
Unscored —
An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the…
-
Unscored —CVE-2021-27180 Public exploit
An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webmail (aka WorldClient). It can be exploi…
-
Medium 6.3CVE-2021-29449 Public exploit
Multiple Privilege Escalation Vulnerabilities Pihole
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in version 5.2.4 of Pi-hole core. See the referenced GitHub security advisory for details.
-
Unscored —
An SQL Injection issue in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows an admini…
-
Unscored —
An overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows…
-
Unscored —
AjaxSearchPro before 4.20.8 allows Deserialization of Untrusted Data (in the import database feature of the administrat…
-
Unscored —
[20210402] - Core - Inadequate filters on module layout settings
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate filters on module layout settings could lead to an LFI.
-
Unscored —CVE-2021-26030 EPSS 83%
[20210401] - Core - Escape xss in logo parameter error pages
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page
-
Critical 9.8
SQL Injection via in django-debug-toolbar
A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form.
-
Unscored —
The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover crede…
-
Medium 6.5
Infinite loop in Yubico yubihsm-connector
An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04). The handler did not validate the length of the request, which can lead to a state where yubihsm-connector becomes stuck in…
-
Unscored —
Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmwa…
-
Unscored —
Cross Site Scripting (XSS) in Monica before 2.19.1 via the journal page.
-
Medium 5.4
Cross Site Scripting (XSS) in LavaLite 5.8.0
Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field.
-
High 8.8
TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge Windows Platform Installation vulnerability
The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Community Edition and TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Enterprise Edition contains a vulnerability that theoreti…
-
High 8.8
TIBCO Messaging - Eclipse Mosquitto Distribution - Core Windows Platform Installation vulnerability
The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Community Edition and TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Enterprise Edition contains a vulnerability that theoreticall…
-
Unscored —
A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET reques…
-
Unscored —
Cross Site Scripting (XSS) in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file.
-
Unscored —
Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter.
-
Unscored —
In Deark before 1.5.8, a specially crafted input file can cause a NULL pointer dereference in the dbuf_write function (…
-
Unscored —
In Deark before v1.5.8, a specially crafted input file can cause a division by zero in (src/fmtutil.c) because of the v…
-
Low 3.2
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…
-
High 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-…
-
Critical 9.8
This vulnerability allows remote attackers to execute escalate privileges on affected installations of SolarWinds Orion…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nig…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R78…
-
Medium 6.5CVE-2021-27250 EPSS 67%
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-L…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nig…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-…
-
Medium 6.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tencent WeCha…