Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
406 results · Clear filters · Feed
-
Medium 4.0
Information disclosure through temporary directory permissions
In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote files accessed thro…
-
Medium 5.3
Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endp…
-
Medium 4.2
Cross-site Scripting in quill
A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attribute of an IMG element) in a text field. Note: Researchers have claimed that this issue is not with…
-
Medium 5.4
IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrar…
-
Medium 5.9
IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt…
-
Medium 6.4
IBM Jazz Team Server products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed a…
-
Medium 4.3
IBM Jazz Team Server products contain an undisclosed vulnerability that could allow an authenticated user to present a …
-
Medium 5.5
Same-origin policy vulnerability in Bitdefender Safepay
An Origin Validation Error vulnerability in Bitdefender Safepay allows an attacker to manipulate the browser's file upload capability into accessing other files in the same directory or sub-directories. This issue affects: Bitdefender Safepay versions prior t…
-
Medium 4.2
Specific command line parameter might result in accepting invalid certificate
Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc.…
-
Medium 5.4
A Stack-based Buffer Overflow vulnerability in the HTTPD daemon of FortiOS 6.0.10 and below, 6.2.2 and below and FortiP…
-
Medium 4.3
A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and…
-
Medium 4.3
An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.
-
Medium 5.4
Cross-site scripting in SiCKRAGE
in SiCKRAGE, versions 4.2.0 to 10.0.11.dev1 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly when processed by the server. Therefore, an attacker can inject arbitrary JavaScript code inside the application, an…
-
Medium 6.1
Cross-site scripting in sickrage
In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `quicksearch` feature. Therefore, an attacker can steal a user's sessionID to masquerade as a victim…
-
Medium 5.6CVE-2021-23369 Public exploit
Remote Code Execution (RCE)
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
-
Medium 6.1
subrion CMS Cross Site Scripting (XSS) vulnerability
Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the "payment gateway" column on transactions tab.
-
Medium 5.4
An exploitable SQL injection vulnerability exists in "global_lists/choices" page of the Rukovoditel Project Management …
-
Medium 5.4
An exploitable SQL injection vulnerability exists in the "forms_fields_rules/rules" page of the Rukovoditel Project Man…
-
Medium 5.4
An exploitable SQL injection vulnerability exists in the "access_rules/rules_form" page of the Rukovoditel Project Mana…
-
Medium 5.5
Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android…
-
Medium 5.8
Improper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions …
-
Medium 4.0
Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action.
-
Medium 4.3
Improper access control of certain port in SmartThings prior to version 1.7.63.6 allows remote temporary denial of serv…
-
Medium 6.5
Using predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote attackers to get attac…
-
Medium 5.5
Using unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(…
-
Medium 5.9
An improper exception control in softsimd prior to SMR APR-2021 Release 1 allows unprivileged applications to access th…
-
Medium 4.0
A pendingIntent hijacking vulnerability in Secure Folder prior to SMR APR-2021 Release 1 allows unprivileged applicatio…
-
Medium 6.8
An improper access control in ActivityManagerService prior to SMR APR-2021 Release 1 allows untrusted applications to a…
-
Medium 6.8
An improper permission management in CertInstaller prior to SMR APR-2021 Release 1 allows untrusted applications to del…
-
Medium 4.0
An improper SELinux policy prior to SMR APR-2021 Release 1 allows local attackers to access AP information without prop…
-
Medium 4.0
A vulnerability that stores IMSI values in an improper path prior to SMR APR-2021 Release 1 allows local attackers to a…
-
Medium 5.6
A pendingIntent hijacking vulnerability in Create Movie prior to SMR APR-2021 Release 1 in Android O(8.x) and P(9.0), 3…
-
Medium 4.0
IBM Spectrum Scale 5.1.0.1 could allow a local attacker to bypass the filesystem audit logging mechanism when file audi…
-
Medium 6.1
Wikimedia Parsoid vulnerable to Cross-site Scripting (XSS)
An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a <meta> tag, bypassing sanitization steps, and potentially allowing for XSS.
-
Medium 4.0
A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network inter…
-
Medium 4.3
CSRF vulnerability in Jenkins Micro Focus Application Automation Tools Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow form validation without permission checks.
-
Medium 4.8
SSL/TLS certificate validation unconditionally disabled by Jenkins Micro Focus Application Automation Tools Plugin
Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow unconditionally disabling of SSL/TLS certificates.
-
Medium 4.3
Missing permission checks in Micro Focus Application Automation Tools Plugin
Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow access without permission checks.
-
Medium 4.3
IBM WebSphere Application Server 7.0, 8.0, and 8.5 is vulnerable to server-side request forgery (SSRF). By sending a sp…