Archive
28 April 2021
Vulnerabilities first published on this day (UTC), newest first.
59 results · Feed
-
High 7.5
Avaya Meetings Server Information Disclosure vulnerability
A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote attacker to gain access to screen sharing and whiteboard sessions. The affected versions of Management component of Av…
-
High 8.1
Avaya Equinox Conferencing XXE vulnerability
An XML External Entities (XXE) vulnerability in Media Server component of Avaya Equinox Conferencing could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system or even potentially lead to a denial of …
-
Critical 9.4
wikiconfig API leaked private config variables set through ManageWiki
ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af1…
-
Medium 6.0
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Unscored —
Unauthenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to gain admin privile…
-
Unscored —
Authenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to execute codeby injec…
-
Unscored —
In Etherpad < 1.8.3, a specially crafted URI would raise an unhandled exception in the cache mechanism and cause a deni…
-
Unscored —
Etherpad < 1.8.3 is affected by a denial of service in the import functionality. Upload of binary file to the import en…
-
Unscored —
Etherpad <1.8.3 stored passwords used by users insecurely in the database and in log files. This affects every database…
-
Unscored —
In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrie…
-
Unscored —
Etherpad < 1.8.3 is affected by a missing lock check which could cause a denial of service. Aggressively targeting rand…
-
Unscored —
A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.…
-
Unscored —
A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.…
-
Unscored —
A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to…
-
Unscored —
A remote SQL injection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. …
-
Unscored —
A remote escalation of privilege vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to …
-
Unscored —CVE-2021-25151 EPSS 12%
A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to…
-
High 7.5
denial of service in github.com/ulikunitz/xz
xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a…
-
Unscored —
The [SAML Authentication module](https://www.drupal.org/project/samlauth) allows users to authenticate against a SAML i…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
-
Unscored —
Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via…
-
Unscored —
Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obta…
-
Unscored —
AVE DOMINAplus <=1.10.x suffers from an unauthenticated reboot command execution. Attackers can exploit this issue to c…
-
Unscored —
AVE DOMINAplus <=1.10.x suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated att…
-
Unscored —
In WEMS Limited Enterprise Manager 2.58, input passed to the GET parameter 'email' is not properly sanitized before bei…
-
Unscored —
A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s)…
-
Unscored —
A local escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.…
-
Unscored —
AVE DOMINAplus <=1.10.x suffers from an authentication bypass vulnerability due to missing control check when directly …
-
Unscored —
A flaw was found in PDFResurrect in version 0.22b. There is an infinite loop in get_xref_linear_skipped() in pdf.c via …
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in SourceCodester Budget Management System 1.0 allows users to inject…
-
Unscored —
SQL Injection in Xinhu OA System v1.8.3 allows remote attackers to obtain sensitive information by injecting arbitrary …
-
Unscored —
SQL Injection in PHPSHE Mall System v1.7 allows remote attackers to execute arbitrary code by injecting SQL commands in…
-
Unscored —
Multiple stored cross-site scripting (XSS) vulnerabilities in Sourcecodester Equipment Inventory System 1.0 allow remot…
-
Unscored —
A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. An attack…
-
Unscored —
There is a JavaScript injection vulnerability in certain Huawei smartphones. A module does not verify some inputs suffi…
-
Unscored —
There is a pointer double free vulnerability in some versions of CloudEngine 5800, CloudEngine 6800, CloudEngine 7800 a…
-
Unscored —
There is an out of bounds write vulnerability in Huawei Smartphone HUAWEI P30 versions 9.1.0.131(C00E130R1P21) when pro…
-
Unscored —
There is a denial of service vulnerability in some versions of CloudEngine 5800, CloudEngine 6800, CloudEngine 7800 and…
-
Unscored —
There is an arbitrary memory write vulnerability in Huawei smart phone when processing file parsing. Due to insufficien…
-
Unscored —
An arbitrary code execution vulnerability exists in Micro Focus Application Performance Management, affecting versions …