Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
1,841 results · Feed
-
Unscored —
AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. …
-
Unscored —CVE-2021-25680 Public exploit
The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These…
-
Unscored —CVE-2021-25679 Public exploit
The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues. …
-
Medium 5.5
GlobalProtect App: Windows VPN kernel driver denial of service (DoS)
A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send specifically-crafted input to the GlobalProtect app that results in a Windows blue screen of death (BSOD) error. This issu…
-
Medium 4.4
PAN-OS: Administrator secrets are logged in web server logs when using the PAN-OS XML API incorrectly
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests are logged in cleartext to the web server logs when the API is used incorrectly. This vulnerability applies only to PA…
-
Low 2.3
PAN-OS: Secrets for scheduled configuration exports are logged in system logs
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration export are logged in system logs. Logged information includes the cleartext username, password, and …
-
Medium 6.7
Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution
An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.26. Checkov 1.0 versions are not impacte…
-
Unscored —CVE-2021-29155 Public exploit
An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable out-of-bounds sp…
-
Medium 5.7
The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if th…
-
Unscored —
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a cont…
-
Unscored —
An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in version…
-
Unscored —
If Ethernet communication of the JTEKT Corporation TOYOPUC product series’ (TOYOPUC-PC10 Series: PC10G-CPU TCC-6353: Al…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The serialnumber pa…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The componentStatus…
-
Unscored —
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
-
Unscored —
GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska …
-
Unscored —
A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit str…
-
Unscored —
There is a integer overflow in function filter_core/filter_props.c:gf_props_assign_value in GPAC 1.0.1. In which, the a…
-
Unscored —
There is a integer overflow in media_tools/av_parsers.c in the gf_avc_read_pps_bs_internal in GPAC from 0.5.2 to 1.0.1.…
-
Unscored —
In the adts_dmx_process function in filters/reframe_adts.c in GPAC 1.0.1, a crafted file may cause ctx->hdr.frame_size …
-
Unscored —
There is a integer overflow in media_tools/av_parsers.c in the hevc_parse_slice_segment function in GPAC from v0.9.0-pr…
-
Unscored —
There is a Null Pointer Dereference in function filter_core/filter_pck.c:gf_filter_pck_new_alloc_internal in GPAC 1.0.1…
-
Unscored —
In the function gf_hevc_read_pps_bs_internal function in media_tools/av_parsers.c in GPAC 1.0.1 there is a loop, which …
-
Unscored —
In filters/reframe_latm.c in GPAC 1.0.1 there is a Null Pointer Dereference, when gf_filter_pck_get_data is called. The…
-
High 7.5
Missing validation of JWT signature in `grassrootza/grassroot-platform`
Grassroot Platform is an application to make it faster, cheaper and easier to persistently organize and mobilize people in low-income communities. Grassroot Platform before master deployment as of 2021-04-16 did not properly verify the signature of JSON Web T…
-
Medium 5.7
Denial of service through memory exhaustion
matrix-media-repo is an open-source multi-domain media repository for Matrix. Versions 1.2.6 and earlier of matrix-media-repo do not properly handle malicious images which are crafted to be small in file size, but large in complexity. A malicious user could u…
-
Medium 6.1
Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields
Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user wit…
-
Unscored —
Memory leak in the stbl_GetSampleInfos function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted f…
-
Unscored —
Buffer overflow in the tenc_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or …
-
Unscored —
The HintFile function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a craf…
-
Unscored —
Buffer overflow in the abst_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or …
-
Unscored —
The gf_hinter_track_new function in GPAC 1.0.1 allows attackers to read memory via a crafted file in the MP4Box command.
-
Unscored —
The AV1_DuplicateConfig function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference)…
-
Unscored —
The gf_isom_cenc_get_default_info_internal function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL p…
-
Unscored —
The MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a cr…
-
Unscored —
The gf_isom_set_extraction_slc function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer deref…
-
Medium 6.0
IBM Resilient SOAR V38.0 could allow a privileged user to create create malicious scripts that could be executed as ano…
-
Unscored —
The messaging subsystem in the Online Discussion Forum 1.0 is vulnerable to XSS in the message body. An authenticated u…
-
Unscored —
A user may be tricked into opening a malicious FBX file which may exploit a use-after-free vulnerability in FBX's Revie…
-
Unscored —CVE-2021-27030 EPSS 61%
A user may be tricked into opening a malicious FBX file which may exploit a Directory Traversal Remote Code Execution v…