Archive
20 April 2021
Vulnerabilities first published on this day (UTC), newest first.
30 results · Feed
-
High 7.6
DNS rebinding in pupnp
The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp (libupnp) appears to be vulnerable to DNS rebinding attacks because it does not check the value of the `Host` header. This can …
-
High 7.5
A vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command. This vulnerability e…
-
High 8.1
LFI and possible code execution on discord-recon using tools arguments
Discord Recon Server is a bot that allows one to do one's reconnaissance process from one's Discord. A vulnerability in Discord Recon Server prior to 0.0.3 could be exploited to read internal files from the system and write files into the system resulting in …
-
Unscored —
A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, a…
-
Unscored —
A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in Wonde…
-
Critical 9.6
XSS Cross Site Scripting
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible to persistently inject scripts in XWiki versions prior to 12.6.3 and 12.8. Unregistred users can fill simple text fields. Registered users …
-
Medium 6.5
TIBCO Administrator CSV injection vulnerability
The Administration GUI component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Editi…
-
High 7.6
TIBCO Administrator SQL injection vulnerability
The Administration GUI component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Editi…
-
Critical 9.6
TIBCO Administrator Stored Cross Site Scripting vulnerability
The Administration GUI component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Editi…
-
Unscored —
OMICRON StationGuard before 1.10 allows remote attackers to cause a denial of service (connectivity outage) via crafted…
-
Medium 6.0
Dell PowerScale OneFS 8.1.0 - 9.1.0 contains a privilege escalation in SmartLock compliance mode that may allow compadm…
-
High 7.5
Dell PowerScale OneFS 8.1.0 - 9.1.0 contains an LDAP Provider inability to connect over TLSv1.2 vulnerability. It may m…
-
Unscored —
The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.
-
Unscored —
HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fi…
-
Medium 6.1
NVIDIA GeForce Experience, all versions prior to 3.22, contains a vulnerability in GameStream plugins where log files a…
-
Medium 6.1CVE-2020-25864 Scanner template
HashiCorp Consul Cross-site Scripting vulnerability
HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.
-
Unscored —
Unisys Stealth (core) 5.x before 5.0.048.0, 5.1.x before 5.1.017.0, and 6.x before 6.0.037.0 stores passwords in a reco…
-
Unscored —
vscode-restructuredtext before 146.0.0 contains an incorrect access control vulnerability, where a crafted project fold…
-
High 7.5
A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exi…
-
Medium 4.9
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an…
KEV Nov 3, 2021 -
High 8.2
IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when p…
-
Unscored —
AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. …
-
Unscored —CVE-2021-25680 Public exploit
The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These…
-
Unscored —CVE-2021-25679 Public exploit
The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues. …
-
Medium 5.5
GlobalProtect App: Windows VPN kernel driver denial of service (DoS)
A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send specifically-crafted input to the GlobalProtect app that results in a Windows blue screen of death (BSOD) error. This issu…
-
Medium 4.4
PAN-OS: Administrator secrets are logged in web server logs when using the PAN-OS XML API incorrectly
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests are logged in cleartext to the web server logs when the API is used incorrectly. This vulnerability applies only to PA…
-
Low 2.3
PAN-OS: Secrets for scheduled configuration exports are logged in system logs
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration export are logged in system logs. Logged information includes the cleartext username, password, and …
-
Medium 6.7
Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution
An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.26. Checkov 1.0 versions are not impacte…
-
Unscored —CVE-2021-29155 Public exploit
An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable out-of-bounds sp…
-
Medium 5.7
The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if th…