Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
406 results · Clear filters · Feed
-
Medium 6.4
Dell EMC Unity, UnityVSA, and Unity XT versions prior to 5.0.7.0.5.008 contain a plain-text password storage vulnerabil…
-
Medium 4.8
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. A remote aut…
-
Medium 4.8
Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. A remote aut…
-
Medium 5.9
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability. A remote authenticated attac…
-
Medium 6.1
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthent…
-
Medium 5.9
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability.…
-
Medium 6.2
Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacke…
-
Medium 6.2
Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacke…
-
Medium 4.0
Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacke…
-
Medium 6.7
IBM Informix Dynamic Server 14.10 is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A…
-
Medium 5.5
Improper input validation in CNCF Cortex
The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanag…
-
Medium 6.5
Specially crafted query may result in a denial of service of mongod
A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.4.
-
Medium 6.8
DOM XSS in Theme Preview
Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users …
-
Medium 5.5
NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin), which could allow an attacker to …
-
Medium 5.8
Multiple Cisco Products Snort HTTP Detection Engine File Policy Bypass Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect handling of specific HTTP header para…
-
Medium 4.9
Cisco Firepower Device Manager Software Filesystem Space Exhaustion Denial of Service Vulnerability
A vulnerability in filesystem usage management for Cisco Firepower Device Manager (FDM) Software could allow an authenticated, remote attacker to exhaust filesystem resources, resulting in a denial of service (DoS) condition on an affected device. This vulner…
-
Medium 6.7
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software for Firepower 1000 and 2100 Series Appliances Command Injection Vulnerability
A vulnerability in the upgrade process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject commands that could be executed with root privileges on the und…
-
Medium 4.3
Cisco Firepower Management Center Software Policy Vulnerability
A vulnerability in an access control mechanism of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to access services beyond the scope of their authorization. This vulnerability is due to insufficient enforcement …
-
Medium 6.7
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Command Injection Vulnerability
A vulnerability in the CLI of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system (OS) of an affected …
-
Medium 4.8
Cisco Firepower Management Center Software Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabil…
-
Medium 4.8
Cisco Firepower Management Center Software Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabil…
-
Medium 4.8
Cisco Firepower Management Center Software Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabil…
-
Medium 5.4
Cisco Firepower Device Manager On-Box Software XML External Entity Vulnerability
A vulnerability in the REST API of Cisco Firepower Device Manager (FDM) On-Box Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected device. This vulnerability is due to the improper …
-
Medium 6.0
Cisco Firepower Threat Defense Software Command File Overwrite Vulnerability
A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to overwrite files on the file system of an affected device by using directory traversal techniques. A successful exploit could cause syst…
-
Medium 6.0
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…
-
Medium 6.0
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…
-
Medium 6.0
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…
-
Medium 6.0
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…
-
Medium 6.5
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…
-
Medium 6.5
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…
-
Medium 6.5
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…
-
Medium 6.5
A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly
In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vu…
-
Medium 6.5
Regular expression Denial of Service in multiple packages
CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. F…
-
Medium 6.0
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
-
Medium 5.3
MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-2
The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential.
-
Medium 6.4
Server-Side Request Forgery in yoast_seo
The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.
-
Medium 6.4
Cross-site scripting in media2click
The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account.
-
Medium 4.0
Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin
OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using `File.createTempFile` in JDK will result in creating and using insecure temporary files that can leave applic…
-
Medium 5.4
Cross-Site Scripting in Content Rendering
Bootstrap Package is a theme for TYPO3. It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. Users of the extension, who have overwri…