Archive
29 April 2021
Vulnerabilities first published on this day (UTC), newest first.
118 results · Feed
-
Unscored —
samurai 1.2 has a NULL pointer dereference in writefile() in util.c via a crafted build file.
-
Unscored —
samurai 1.2 has a NULL pointer dereference in printstatus() function in build.c via a crafted build file.
-
Unscored —CVE-2021-20092 Scanner template
The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not p…
-
Unscored —CVE-2021-20091 Scanner template
The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not p…
-
Unscored —
An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/S…
-
Unscored —
Smartwares HOME easy <=1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vu…
-
Unscored —
Inim Electronics Smartliving SmartLAN/G/SI <=6.x uses default hardcoded credentials. An attacker could exploit this to …
-
Unscored —
Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMedia…
-
Unscored —
Inim Electronics SmartLiving SmartLAN/G/SI <=6.x suffers from an authenticated remote command injection vulnerability. …
-
Unscored —
Emmanuel MyDomoAtHome (MDAH) REST API REST API Domoticz ISS Gateway 0.2.40 is affected by an information disclosure vul…
-
Unscored —
A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s) …
-
Unscored —
A remote cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to …
-
Unscored —
A remote disclosure of privileged information vulnerability was discovered in Aruba ClearPass Policy Manager version(s)…
-
Unscored —
A remote XML external entity (XXE) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to …
-
Unscored —
A remote cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to …
-
Unscored —
`aes-ctr` has been merged into the `aes` crate
Please use the `aes` crate going forward. The new repository location is at: <https://github.com/RustCrypto/block-ciphers/tree/master/aes> The `aes` crate now has an optional `ctr` feature which autodetects SIMD features on `i686`/`x86-64` targets and uses th…
-
Unscored —
`aes-soft` has been merged into the `aes` crate
Please use the `aes` crate going forward. The new repository location is at: <https://github.com/RustCrypto/block-ciphers/tree/master/aes> AES-NI is now autodetected at runtime on `i686`/`x86-64` platforms. If AES-NI is not present, the `aes` crate will fallb…
-
Unscored —
`aesni` has been merged into the `aes` crate
Please use the `aes` crate going forward. The new repository location is at: <https://github.com/RustCrypto/block-ciphers/tree/master/aes> AES-NI is now autodetected at runtime on `i686`/`x86-64` platforms. If AES-NI is not present, the `aes` crate will fallb…
-
Unscored —
A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to…
-
Unscored —
A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s) …
-
Unscored —
A remote server side request forgery (SSRF) remote code execution vulnerability was discovered in Aruba ClearPass Polic…
-
Unscored —
A remote cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to …
-
Unscored —
A remote URL redirection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1…
-
Unscored —
A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.…
-
Unscored —
A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.…
-
Unscored —
A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.…
-
Unscored —
GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue t…
-
High 8.8
Dependency Confusion in Bundler
Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a …
-
High 8.1CVE-2021-25216 EPSS 83%
A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack
In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch, BIND servers are vulnerable…
-
High 7.5CVE-2021-25215 EPSS 12%
An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself
In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version o…
-
Medium 6.5
A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly
In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vu…
-
High 7.7
Command injection vulnerability in @prisma/sdk in getPackedPackage function
Prisma is an open source ORM for Node.js & TypeScript. As of today, we are not aware of any Prisma users or external consumers of the `@prisma/sdk` package who are affected by this security vulnerability. This issue may lead to remote code execution if a clie…
-
Medium 6.5
Regular expression Denial of Service in multiple packages
CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. F…
-
Unscored —
Aviatrix VPN Client before 2.14.14 on Windows has an unquoted search path that enables local privilege escalation to th…
-
High 7.5
Denial of Service vulnerability in django-filter
django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS fr…
-
Unscored —
In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buf…
-
Critical 9.8
A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3…
KEV Nov 3, 2021 -
Unscored —CVE-2021-20294 Public exploit
A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a…