Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
424 results · Clear filters · Feed
-
High 8.8
A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security …
KEV May 4, 2022 -
High 7.0
A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-0…
KEV Nov 3, 2021 -
High 7.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions st…
-
High 8.8
An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a …
-
High 7.8
An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. A local attacker with the …
-
High 7.5
An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. By default, a mobile appli…
-
High 7.1
Entering code in App Lock modal sends input to conversation
wire-webapp is an open-source front end for Wire, a secure collaboration platform. In wire-webapp before version 2021-03-15-production.0, when being prompted to enter the app-lock passphrase, the typed passphrase will be sent into the most recently used chat …
-
High 7.5
OAuth 2 authorization service vulnerable to DDos attacks
CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, t…
-
High 8.1
ApiKey secret could be revelated on network issue
node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too This is fixed in node-etsy-client v0.3.0 and later.
-
High 7.5
Vulnerability in Stripe for Visual Studio Code < 1.7.3
vscode-stripe is an extension for Visual Studio Code. A vulnerability in Stripe for Visual Studio Code extension exists when it loads an untrusted source-code repository containing malicious settings. An attacker who successfully exploited the vulnerability c…
-
High 8.6
Client side code execution in gitlab-vscode-extension v3.15.0 and earlier allows attacker to execute code on user system
-
High 7.5
Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
-
High 8.1
Acrobat Reader DC Missing Support for Integrity Check
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are missing support for an integrity check. An unauthenticated attacker would have the ability to completely manipulate data in a c…
-
High 7.2
Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Ma…
-
High 7.5
Double free in endian_trait
An issue was discovered in the endian_trait crate through 2021-01-04 for Rust. A double drop can occur when a user-provided Endian impl panics.
-
High 7.5
Out of bounds write in arenavec
An issue was discovered in the arenavec crate through 2021-01-12 for Rust. A drop of uninitialized memory can sometimes occur upon a panic in T::default().
-
High 7.5
Uncontrolled Resource Consumption in parse_duration
An issue was discovered in the parse_duration crate through 2021-03-18 for Rust. It allows attackers to cause a denial of service (CPU and memory consumption) via a duration string with a large exponent.
-
High 7.5
Double free in insert_many
An issue was discovered in the insert_many crate through 2021-01-26 for Rust. Elements may be dropped twice if a .next() method panics.
-
High 7.3
Out of bounds read in uu_od
An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation.
-
High 7.3
Use after free in Rocket
An issue was discovered in the rocket crate before 0.4.7 for Rust. uri::Formatter can have a use-after-free if a user-provided function panics.
-
High 7.5
Double free in slice-deque
An issue was discovered in the slice-deque crate through 2021-02-19 for Rust. A double drop can occur in SliceDeque::drain_filter upon a panic in a predicate function.
-
High 7.3
Out of bounds write in stackvector
An issue was discovered in the stackvector crate through 2021-02-19 for Rust. There is an out-of-bounds write in StackVec::extend if size_hint provides certain anomalous data.
-
High 7.3
Out of bounds write in reorder
An issue was discovered in the reorder crate through 2021-02-24 for Rust. swap_index has an out-of-bounds write if an iterator returns a len() that is too small.
-
High 7.5
Improper Restriction of XML External Entity Reference in pikepdf
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.