Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
1,841 results · Feed
-
Unscored —
Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the…
-
Unscored —
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The page_recent_contributors leaked …
-
Unscored —
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly logged sensitive supp…
-
Unscored —
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. Its AbuseFilterCheckMatch API reveal…
-
Unscored —
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. A MediaWiki user who is partially bl…
-
Unscored —
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The Special:AbuseFilter/examine form…
-
Unscored —
An issue was discovered in the CommentBox extension for MediaWiki through 1.35.2. Via crafted configuration variables, …
-
Unscored —
An issue was discovered in the PageForms extension for MediaWiki through 1.35.2. Crafted payloads for Token-related que…
-
Unscored —
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly executed certain rule…
-
Unscored —
An issue was discovered in the CheckUser extension for MediaWiki through 1.35.2. MediaWiki usernames with trailing whit…
-
Unscored —
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It improperly handled account blocks…
-
Unscored —
An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. It did not validate the oarc_version (aka …
-
Medium 6.5
Path Traversal at Discord-Recon .recon Command Path
Discord-Recon is a bot for the Discord chat service. In versions of Discord-Recon 0.0.3 and prior, a remote attacker is able to read local files from the server that can disclose important information. As a workaround, a bot maintainer can locate the file `ap…
-
High 8.3
Remote file overwrite on discord-recon can result in DoS and Remote Code Execution
Discord-Recon is a bot for the Discord chat service. Versions of Discord-Recon 0.0.3 and prior contain a vulnerability in which a remote attacker is able to overwrite any file on the system with the command results. This can result in remote code execution wh…
-
Medium 6.1
Self-XSS
Wrongthink is an encrypted peer-to-peer chat program. A user could check their fingerprint into the service and enter a script to run arbitrary JavaScript on the site. No workarounds exist, but a patch exists in version 2.4.1.
-
Unscored —
A heap-based buffer overflow was found in jhead in version 3.06 in Get16u() in exif.c when processing a crafted file.
-
Low 2.7CVE-2021-2175 Public exploit
Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.1.…
-
Medium 4.1CVE-2021-2173 Public exploit
Vulnerability in the Recovery component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 1…
-
Low 2.3
Vulnerability in the Oracle Database - Enterprise Edition component of Oracle Database Server. Supported versions that …
-
Medium 5.5
NVIDIA Windows GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel driver (nvlddmkm.sy…
-
High 7.3
NVIDIA Windows GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer (nvlddmk…
-
High 7.3
NVIDIA GPU Display Driver for Windows installer contains a vulnerability where an attacker with local unprivileged syst…
-
Unscored —
Arbitrary File Write exists in Aviatrix VPN Client 2.8.2 and earlier. The VPN service writes logs to a location that is…
-
Unscored —
Insecure File Permissions exist in Aviatrix Controller 5.3.1516. Several world writable files and directories were foun…
-
Critical 9.1
Backport for CVE-2021-21024 Blind SQLi from Magento 2
Magento-lts is a long-term support alternative to Magento Community Edition (CE). A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021…
-
Critical 9.8
Fixes a bug in Zend Framework's Stream HTTP Wrapper
Magento-lts is a long-term support alternative to Magento Community Edition (CE). In magento-lts versions 19.4.12 and prior and 20.0.8 and prior, there is a vulnerability caused by the unsecured deserialization of an object. A patch in versions 19.4.13 and 20…
-
Unscored —
Wikimedia Quarry analytics-quarry-web before 2020-12-15 allows Reflected XSS because app.py does not explicitly set the…
-
Unscored —
The ABUS Secvest wireless alarm system FUAA50000 (v3.01.17) fails to properly authenticate some requests to its built-i…
-
Medium 5.7
Authelia allows open redirects on the logout endpoint
Authelia is an open-source authentication and authorization server providing 2-factor authentication and single sign-on (SSO) for your applications via a web portal. In versions 4.27.4 and earlier, utilizing a HTTP query parameter an attacker is able to redir…
-
Unscored —
The Debian xscreensaver 5.42+dfsg1-1 package for XScreenSaver has cap_net_raw enabled for the /usr/libexec/xscreensaver…
-
Unscored —
An issue was discovered in gpac before 1.0.1. The abst_box_read function in box_code_adobe.c has a heap-based buffer ov…
-
Unscored —
An issue was discovered in gpac before 1.0.1. A NULL pointer dereference exists in the function dump_isom_sdp located i…
-
Unscored —
An issue was discovered in gpac through 20200801. A NULL pointer dereference exists in the function nhmldump_send_heade…
-
Unscored —
An issue was discovered in fast_ber through v0.4. yy::yylex() in asn_compiler.hpp has a heap-based buffer over-read.
-
Unscored —
An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over-read.
-
Unscored —
An issue was discovered in retdec v3.3. In function canSplitFunctionOn() of ir_modifications.cpp, there is a possible o…
-
Unscored —
An issue was discovered in gpac before 1.0.1. The abst_box_read function in box_code_adobe.c has a heap-based buffer ov…
-
Unscored —
An issue was discovered in cpp-peglib through v0.1.12. A NULL pointer dereference exists in the peg::AstOptimizer::opti…
-
Unscored —
An issue was discovered in Bento4 through v1.6.0-637. A NULL pointer dereference exists in the function AP4_StszAtom::G…
-
Unscored —
An issue was discovered in cpp-peglib through v0.1.12. peg::resolve_escape_sequence() in peglib.h has a heap-based buff…