Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
406 results · Clear filters · Feed
-
Medium 6.5
Windows TCP/IP Information Disclosure Vulnerability
Windows TCP/IP Information Disclosure Vulnerability
-
Medium 6.5
Windows Hyper-V Information Disclosure Vulnerability
Windows Hyper-V Information Disclosure Vulnerability
-
Medium 5.5
Windows Console Driver Denial of Service Vulnerability
Windows Console Driver Denial of Service Vulnerability
-
Medium 5.5
Windows Installer Information Disclosure Vulnerability
Windows Installer Information Disclosure Vulnerability
-
Medium 5.5
Windows Event Tracing Information Disclosure Vulnerability
Windows Event Tracing Information Disclosure Vulnerability
-
Medium 6.5
Windows DNS Information Disclosure Vulnerability
Windows DNS Information Disclosure Vulnerability
-
Medium 5.5
Windows AppX Deployment Server Denial of Service Vulnerability
Windows AppX Deployment Server Denial of Service Vulnerability
-
Medium 6.5CVE-2021-28325 EPSS 64%
Windows SMB Information Disclosure Vulnerability
Windows SMB Information Disclosure Vulnerability
-
Medium 6.5
Windows DNS Information Disclosure Vulnerability
Windows DNS Information Disclosure Vulnerability
-
Medium 5.5
Windows GDI+ Information Disclosure Vulnerability
Windows GDI+ Information Disclosure Vulnerability
-
Medium 5.5
Microsoft Windows Codecs Library Information Disclosure Vulnerability
Microsoft Windows Codecs Library Information Disclosure Vulnerability
-
Medium 4.2
Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability
Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability
-
Medium 6.5
Windows Application Compatibility Cache Denial of Service Vulnerability
Windows Application Compatibility Cache Denial of Service Vulnerability
-
Medium 5.5
Windows Kernel Information Disclosure Vulnerability
Windows Kernel Information Disclosure Vulnerability
-
Medium 4.4
Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability
Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability
-
Medium 5.5
Windows Kernel Information Disclosure Vulnerability
Windows Kernel Information Disclosure Vulnerability
-
Medium 6.8
Azure AD Web Sign-in Security Feature Bypass Vulnerability
Azure AD Web Sign-in Security Feature Bypass Vulnerability
-
Medium 5.7
Windows Media Photo Codec Information Disclosure Vulnerability
Windows Media Photo Codec Information Disclosure Vulnerability
-
Medium 6.5
Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability
Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability
-
Medium 5.5
Windows Overlay Filter Information Disclosure Vulnerability
Windows Overlay Filter Information Disclosure Vulnerability
-
Medium 6.2
Windows Installer Spoofing Vulnerability
Windows Installer Spoofing Vulnerability
-
Medium 4.6
SAP Focused RUN versions 200, 300, does not perform necessary authorization checks for an authenticated user, which all…
-
Medium 4.3
SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an auth…
-
Medium 5.4
SAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malici…
-
Medium 6.4
SAP Manufacturing Execution (System Rules), versions - 15.1, 15.2, 15.3, 15.4, allows an authorized attacker to embed m…
-
Medium 6.5
An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a wor…
-
Medium 4.3
SAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not suff…
-
Medium 4.6
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogs
The Nextcloud dialogs library (npm package @nextcloud/dialogs) before 3.1.2 insufficiently escaped text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability. The vulnerability has been p…
-
Medium 6.5
SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versions - 7.31, 7.40, 7.50, allows an attacker to read so…
-
Medium 5.4
Cross site request forgery vulnerability
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user may be tricked by soci…
-
Medium 4.4
Denial of Service (DoS)
All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash.
-
Medium —
Exposure of .env if project root is configured as web root in shopware/production
### Impact The .env and other sensitive files can be leaked if the project root and not `/public` is configured as the web root. ### Patches We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Update…
-
Medium —
Potential API key leak
If a user is actively blackholing the location or weather APIs, or those APIs become otherwise unavailable, it is possible for the API keys to get leaked to the active IRC channel. This is patched in v1.2.4
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the compnomenclat…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description p…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID pa…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID p…
-
Medium 6.5
Possible limited path traversal vulnerabily in Apache Commons IO
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not furth…
-
Medium 6.3
Open redirect via transitional IPv6 addresses on dual-stack networks
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external …
-
Medium 5.3
Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endp…