Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
38 results · Clear filters · Feed
-
Low 2.7
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated m…
-
Low 3.3
Out-of-bounds read in Exiv2::WebPImage::doWriteMetadata
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write m…
-
Low 3.3
Heap buffer overflow in Exiv2::Jp2Image::encodeJp2Header
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A heap buffer overflow was found in Exiv2 versions v0.27.3 and earlier. The heap overflow is triggered when Exiv2 is used to write metad…
-
Low 3.2
This vulnerability allows local attackers to delete arbitrary files on affected installations of Parallels Desktop 16.1…
-
Low 2.5
Out-of-bounds read in Exiv2::Jp2Image::doWriteMetadata
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, wri…
-
Low 3.1
Potential sensitive data exposure in applications using Vaadin 15
Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. @RestController
-
Low 2.6
Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11
Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.
-
Low 3.3
Automox Agent Sensitive Log Information Disclosure
Automox Agent prior to version 31 logs potentially sensitive information in local log files, which could be used by a locally-authenticated attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Automox Age…
-
Low 3.7
Automox Agent Guessable S3 Bucket Endpoint
Automox Agent prior to version 31 uses an insufficiently protected S3 bucket endpoint for storing sensitive files, which could be brute-forced by an attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Au…
-
Low 3.5
An issue has been discovered in GitLab affecting all versions starting with 12.9. GitLab was vulnerable to a stored XSS…
-
Low 2.7
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions t…
-
Low 2.7
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions t…
-
Low 2.7
Vulnerability in the Oracle Database - Enterprise Edition Unified Audit component of Oracle Database Server. Supported …
-
Low 1.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported vers…
-
Low 3.5
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Frameworks). Th…
-
Low 3.9
Vulnerability in the Hyperion Financial Management product of Oracle Hyperion (component: Task Automation). The support…
-
Low 2.5
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported versio…
-
Low 1.8
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Installation). The supporte…
-
Low 2.0
Vulnerability in the Oracle FLEXCUBE Direct Banking product of Oracle Financial Services Applications (component: Pre L…
-
Low 2.7CVE-2021-2175 Public exploit
Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.1.…
-
Low 2.3
Vulnerability in the Oracle Database - Enterprise Edition component of Oracle Database Server. Supported versions that …
-
Low 2.3
PAN-OS: Secrets for scheduled configuration exports are logged in system logs
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration export are logged in system logs. Logged information includes the cleartext username, password, and …
-
Low 2.6
Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11
Missing check in UIDL request handler in `com.vaadin:flow-server` versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message. - https://vaadin.co…
-
Low 3.1
Potential sensitive data exposure in applications using Vaadin 15
Insecure configuration of default `ObjectMapper` in `com.vaadin:flow-server` versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. `@RestController` - https://vaadin.com/security/cve-2020-36319
-
Low 3.3
Adobe Bridge HEIC File Parsing Out-Of-Bounds Read vulnerability could lead to information disclosure
Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by an Out-of-bounds read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the …
-
Low 3.2
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…
-
Low 3.3
Local DoS of VM live migration due to use of static tmp files in detach_disks.sh in s390-tools
A Insecure Temporary File vulnerability in s390-tools of SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-SP2 allows local attackers to prevent VM live migrations This issue affects: SUSE Linux Enterprise Server 12-SP5 s390-tools versions …
-
Low 3.3CVE-2021-28312 Public exploit
Windows NTFS Denial of Service Vulnerability
Windows NTFS Denial of Service Vulnerability
-
Low —
User (Encrypted) Password Field Being Serialised
### Impact Leaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed. ### Patches Issue has been patched in version 0.3.7-beta and onwards. ### Wo…
-
Low 3.8
Advanced Authentication Improper Session Management
Advanced Authentication versions prior to 6.3 SP4 have a potential broken authentication due to improper session management issue.
-
Low 3.3
Intent redirection in Samsung Experience Service versions 10.8.0.4 in Android P(9.0) below, and 12.2.0.5 in Android Q(1…
-
Low 3.1
An improper synchronization logic in Samsung Email prior to version 6.1.41.0 can leak messages in certain mailbox in pl…
-
Low —
CSRF Vuln can expose user's QRcode
### Impact When a user is setting up two-factor authentication using an authenticator app, a QRcode is generated and made available via a GET request to /tf-qrcode. Since GETs do not have any CSRF protection, it is possible a malicious 3rd party could access …
-
Low 3.8
Dell System Update (DSU) 1.9 and earlier versions contain a denial of service vulnerability. A local authenticated mali…
-
Low 2.4
An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possibl…
-
Low 3.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist whe…
-
Low 3.7
Potential sensitive information disclosed in error reports
django-registration is a user registration package for Django. The django-registration package provides tools for implementing user-account registration flows in the Django web framework. In django-registration prior to 3.1.2, the base user-account registrati…
-
Low 2.7
Directory exposure in jetty
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and…