Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
1,841 results · Feed
-
Unscored —CVE-2021-28242 Public exploit
SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive da…
-
Medium 5.5
Adobe Bridge Genuine Software Service Incorrect Permission Assignment could lead to Denial-of-Service
Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by an Improper Authorization vulnerability in the Genuine Software Service. A low-privileged attacker could leverage this vulnerability to achieve application denial-of-service i…
-
High 7.8
Adobe Bridge PDF File Parsing Out-Of-Bounds Write vulnerability could lead to arbitrary code execution
Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by an Out-of-bounds write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution i…
-
High 8.1
A unauthenticated backdoor exists in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-A…
-
High 8.1
A heap-based buffer overflow vulnerability exists in the configuration server functionality of the Cosori Smart 5.8-Qua…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The assetStatus par…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The code parameter …
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The code parameter …
-
Unscored —
Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background with…
-
Unscored —
In pb_write of pb_encode.c, there is a possible out of bounds write due to a missing bounds check. This could lead to l…
-
Unscored —
SQL Injection in the "add-services.php" component of PHPGurukul Beauty Parlour Management System v1.0 allows remote att…
-
Unscored —
Cross Site Scripting (XSS) in the "add-services.php" component of PHPGurukul Beauty Parlour Management System v1.0 allo…
-
Unscored —
CASAP Automated Enrollment System version 1.0 contains a cross-site scripting (XSS) vulnerability through the Students …
-
Medium 4.9
Sensitive Information Exposure in McAfee ATD
Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense (ATD) prior to 4.12.2 allows remote authenticated users to view sensitive unencrypted information via a carefully crafted HTTP request parameter. The risk is partially mi…
-
Medium 4.9
Sensitive Information Exposure in McAfee ATD
Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense (ATD) prior to 4.12.2 allows remote authenticated users to view sensitive unencrypted information via a carefully crafted HTTP request parameter. The risk is partially mi…
-
High 7.8
Privilege escalation in McAfee DLP Endpoint for Windows
Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to write to arbitrary controlled kernel addresses. This is achieved by launching applications, suspending t…
-
Medium 5.5
Local Denial of Service in McAfee DLP Endpoint for Windows
Denial of Service vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to cause a BSoD through suspending a process, modifying the processes memory and restarting it. This is trigge…
-
Medium 4.8
Transmission of data in clear text by McAfee ENS
Cleartext Transmission of Sensitive Information between McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update and McAfee Global Threat Intelligence (GTI) servers using DNS allows a remote attacker to view the requests from ENS and re…
-
Critical —
Bypass of the fix for CVE-2019-0195
A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Befor…
-
Medium 4.3
Clear text exposure of password in McAfee CSR ePO extension
Cleartext Transmission of Sensitive Information vulnerability in the ePO Extension of McAfee Content Security Reporter (CSR) prior to 2.8.0 allows an ePO administrator to view the unencrypted password of the McAfee Web Gateway (MWG) or the password of the McA…
-
Unscored —
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KE…
-
Unscored —
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the all_public_streams API feature r…
-
Unscored —
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (pre…
-
Unscored —
The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, fr…
-
Unscored —
The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from …
-
Unscored —
The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before ve…
-
Unscored —
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing…
-
Unscored —
In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to strea…
-
Unscored —
An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary …
-
Unscored —
An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClien…
-
Unscored —
An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the…
-
Unscored —CVE-2021-27180 Public exploit
An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webmail (aka WorldClient). It can be exploi…
-
Medium 6.3CVE-2021-29449 Public exploit
Multiple Privilege Escalation Vulnerabilities Pihole
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in version 5.2.4 of Pi-hole core. See the referenced GitHub security advisory for details.
-
Unscored —
An SQL Injection issue in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows an admini…
-
Unscored —
An overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows…
-
Unscored —
AjaxSearchPro before 4.20.8 allows Deserialization of Untrusted Data (in the import database feature of the administrat…
-
Unscored —
[20210402] - Core - Inadequate filters on module layout settings
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate filters on module layout settings could lead to an LFI.
-
Unscored —CVE-2021-26030 EPSS 83%
[20210401] - Core - Escape xss in logo parameter error pages
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page
-
Critical 9.8
SQL Injection via in django-debug-toolbar
A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form.
-
Unscored —
The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover crede…