Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
424 results · Clear filters · Feed
-
High 7.8
Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability
Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability
-
High 7.8
Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability
Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability
-
High 7.5
Windows TCP/IP Driver Denial of Service Vulnerability
Windows TCP/IP Driver Denial of Service Vulnerability
-
High 7.8
Windows Media Video Decoder Remote Code Execution Vulnerability
Windows Media Video Decoder Remote Code Execution Vulnerability
-
High 7.8
Windows Hyper-V Elevation of Privilege Vulnerability
Windows Hyper-V Elevation of Privilege Vulnerability
-
High 7.8
Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability
Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability
-
High 7.8
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
High 7.8
NTFS Elevation of Privilege Vulnerability
NTFS Elevation of Privilege Vulnerability
-
High 7.8
Windows Media Video Decoder Remote Code Execution Vulnerability
Windows Media Video Decoder Remote Code Execution Vulnerability
-
High 7.8
RPC Endpoint Mapper Service Elevation of Privilege Vulnerability
RPC Endpoint Mapper Service Elevation of Privilege Vulnerability
-
High 7.8
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
-
High 7.8
Microsoft Internet Messaging API Remote Code Execution Vulnerability
Microsoft Internet Messaging API Remote Code Execution Vulnerability
-
High 7.8
Windows Event Tracing Elevation of Privilege Vulnerability
Windows Event Tracing Elevation of Privilege Vulnerability
-
High 7.8
Windows Services and Controller App Elevation of Privilege Vulnerability
Windows Services and Controller App Elevation of Privilege Vulnerability
-
High 7.0
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
-
High 7.8
Visual Studio Installer Elevation of Privilege Vulnerability
Visual Studio Installer Elevation of Privilege Vulnerability
-
High 7.8CVE-2021-26415 Public exploit
Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
-
High 7.7
Windows Hyper-V Denial of Service Vulnerability
Windows Hyper-V Denial of Service Vulnerability
-
High 7.4
An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Applicati…
-
High 8.3
SAP NetWeaver Master Data Management, versions - 710, 710.750, allows a malicious unauthorized user with access to the …
-
High 8.2
Under certain conditions SAP Solution Manager, version - 720, allows a high privileged attacker to get access to sensit…
-
High 7.8
A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could allow remote code exec…
-
High 8.0
Account compromise by man-in-the-middle attack
ScratchOAuth2 is an Oauth implementation for Scratch. Any ScratchOAuth2-related data normally accessible and modifiable by a user can be read and modified by a third party. 1. Scratch user visits 3rd party site. 2. 3rd party site asks user for Scratch usernam…
-
High 8.6
An out-of-bounds read vulnerability exists in the Obj File TriangleMesh::TriangleMesh() functionality of Slic3r libslic…
-
High 8.0
Arbitrary File upload
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability. IPM’s maps_srv.js allows an attacker to upload a malicious NodeJS file using uploadBackgroud action. An attacker can upload a malicious cod…
-
High 8.3
Improper Neutralization of Directives in Dynamically Evaluated Code
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/…
-
High 8.0CVE-2021-23279 EPSS 28%
Arbitrary File delete
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validation in meta_driver_srv.js class with saveDriverData action using invalidated driverID. An attacker ca…
-
High 7.1
Improper Neutralization of Special Elements used in an SQL Command
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection. A malicious user can send a specially crafted packet to exploit the vulnerability. Successful exploitation of this vulnerability can allow attackers to add users…
-
High 8.7
Arbitrary File delete
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation at server/maps_srv.js with action removeBackground and server/node_upgrade_srv.js with action remov…
-
High 8.0CVE-2021-29427 Public exploit
Repository content filters do not work in Settings pluginManagement
In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning. Repository content filtering is a security control Gradle introduced to help users specify what repositories are u…
-
High 8.8
Local privilege escalation through system temporary directory
In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. Gradle builds could be vulnerable to a local privilege escalation from an a…
-
High 8.1
Cross-Site Request Forgery (CSRF) in trestle-auth
trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-a…
-
High 8.8CVE-2020-13568 EPSS 30%
SQL injection vulnerability exists in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An a…
-
High 8.8
SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An …
-
High 8.8
An incorrect default permissions vulnerability exists in the installation functionality of OpenClinic GA 5.173.3. Overw…
-
High 7.5
Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings
When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a se…
-
High 7.1
SSRF vulnerability with the Replication handler
The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the loc…
-
High 7.8
Dell Peripheral Manager 1.3.1 or greater contains remediation for a local privilege escalation vulnerability that could…
-
High 8.5
A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT …
-
High 7.5