Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
406 results · Clear filters · Feed
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - Active Directory configuration function
The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage t…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - Generate SSL certificate function
The specific function in ASUS BMC’s firmware Web management page (Generate SSL certificate function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - Radius configuration function
The Radius configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormal…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - Remote image configuration setting
The specific function in ASUS BMC’s firmware Web management page (Remote image configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers us…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - SMTP configuration function
The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - Remote video storage function
The specific function in ASUS BMC’s firmware Web management page (Remote video storage function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - Firmware update function
The Firmware update function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally te…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - Generate new certificate function
The specific function in ASUS BMC’s firmware Web management page (Generate new certificate function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - SMTP configuration function
The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - Generate new SSL certificate
The specific function in ASUS BMC’s firmware Web management page (Generate new SSL certificate) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the …
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - Modify user’s information function
The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers us…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - ActiveX configuration-2 acquisition
The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-2 acquisition) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers u…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - ActiveX configuration-1 acquisition
The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-1 acquisition) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers u…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - Active Directory configuration function
The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage t…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - Web Service configuration function
The Web Service configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abn…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - Web License configuration setting
The specific function in ASUS BMC’s firmware Web management page (Web License configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - Remote video configuration setting
The specific function in ASUS BMC’s firmware Web management page (Remote video configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers us…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - Media support configuration setting
The specific function in ASUS BMC’s firmware Web management page (Media support configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers u…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - Audit log configuration setting
The specific function in ASUS BMC’s firmware Web management page (Audit log configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use t…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - UEFI configuration function
The UEFI configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - LDAP configuration function
The LDAP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally…
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - DNS configuration function
The DNS configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally …
-
Medium 4.9
ASUS BMC's firmware: buffer overflow - Radius configuration function
The Radius configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormal…
-
Medium 4.3
The Dashboard plugin through 1.0.2 for GLPI allows remote low-privileged users to bypass access control on viewing info…
-
Medium 6.1CVE-2021-30151 Scanner template
Cross-site Scripting in Sidekiq
Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.
-
Medium 5.4
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed …
-
Medium 5.4
IBM Edge 4.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code …
-
Medium 6.1CVE-2021-30109 Public exploit
Cross-site Scripting in Froala Editor
Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS). Under certain conditions, a base64 crafted string leads to persistent Cross-site scripting (XSS) vulnerability within the hyperlink creation module.
-
Medium 4.3
Wyse Management Suite versions up to 3.2 contains a vulnerability wherein a malicious authenticated user can cause a de…
-
Medium 5.0
Dell Wyse ThinOS 8.6 MR9 contains remediation for an improper management server validation vulnerability that could be …
-
Medium 6.1
Docsify vulnerable to cross-site scripting due to mishandled encoding
docsify 4.12.1 is affected by Cross Site Scripting (XSS) because the search component does not appropriately encode Code Blocks and mishandles the " character.
-
Medium 6.1CVE-2021-1879 Exploited
This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and …
KEV Nov 3, 2021 -
Medium 5.9
An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6. Under a special condition it wa…
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions from 13.8 and above allowing an authenticated user …
-
Medium 6.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a st…
-
Medium 6.7CVE-2021-28113 EPSS 23%
A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3…
-
Medium 6.1
pomerium_signature is not verified in middleware in github.com/pomerium/pomerium
Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process
-
Medium 6.3
JWT leak via Open Redirect in Programmatic access
Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2).
-
Medium 4.3
In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in t…
-
Medium 6.6
Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data expo…