Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
1,841 results · Feed
-
Medium 6.5
Infinite loop in Yubico yubihsm-connector
An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04). The handler did not validate the length of the request, which can lead to a state where yubihsm-connector becomes stuck in…
-
Unscored —
Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmwa…
-
Unscored —
Cross Site Scripting (XSS) in Monica before 2.19.1 via the journal page.
-
Medium 5.4
Cross Site Scripting (XSS) in LavaLite 5.8.0
Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field.
-
High 8.8
TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge Windows Platform Installation vulnerability
The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Community Edition and TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Enterprise Edition contains a vulnerability that theoreti…
-
High 8.8
TIBCO Messaging - Eclipse Mosquitto Distribution - Core Windows Platform Installation vulnerability
The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Community Edition and TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Enterprise Edition contains a vulnerability that theoreticall…
-
Unscored —
A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET reques…
-
Unscored —
Cross Site Scripting (XSS) in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file.
-
Unscored —
Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter.
-
Unscored —
In Deark before 1.5.8, a specially crafted input file can cause a NULL pointer dereference in the dbuf_write function (…
-
Unscored —
In Deark before v1.5.8, a specially crafted input file can cause a division by zero in (src/fmtutil.c) because of the v…
-
Low 3.2
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…
-
High 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-…
-
Critical 9.8
This vulnerability allows remote attackers to execute escalate privileges on affected installations of SolarWinds Orion…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nig…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R78…
-
Medium 6.5CVE-2021-27250 EPSS 67%
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-L…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nig…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-…
-
Medium 6.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tencent WeCha…
-
High 8.0CVE-2021-27246 Public exploit
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Arc…
-
Unscored —
Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmwa…
-
High 7.8
hawk: Insecure file permissions
A Creation of Temporary File With Insecure Permissions vulnerability in hawk2 of SUSE Linux Enterprise High Availability 12-SP3, SUSE Linux Enterprise High Availability 12-SP5, SUSE Linux Enterprise High Availability 15-SP2 allows local attackers to escalate …
-
Unscored —
Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote attackers to execute arbitr…
-
Unscored —
Online Reviewer System 1.0 contains a SQL injection vulnerability through authentication bypass, which may lead to a re…
-
Unscored —
An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in …
-
Unscored —
Buffer Overflow in Tenda G1 and G3 routers with firmware version V15.11.0.17(9502)_CN allows remote attackers to execut…
-
Unscored —
Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote attackers to execute arbitr…
-
Unscored —
Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entrie…
-
Unscored —
Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entrie…
-
Unscored —
An issue was discovered in Orchard before 1.10. The Media Settings Allowed File Types list field allows an attacker to …
-
High 7.5
An unquoted service path in SAPSetup, version - 9.0, could lead to privilege escalation during the installation process…
-
Unscored —
An issue was discovered in Orchard before 1.10. A broken access control issue in Orchard components that use the TinyMC…
-
Medium 6.5
SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Integration Builder Framework), versions - 7.10, 7.3…
-
High 7.7
In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integrati…
-
Unscored —
Appspace 6.2.4 is vulnerable to a broken authentication mechanism where pages such as /medianet/mail.aspx can be called…
-
Unscored —
Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. This…
-
Unscored —
Incorrect Access Control in Shopxo v1.4.0 and v1.5.0 allows remote attackers to gain privileges in "/index.php" by mani…
-
Unscored —CVE-2021-27114 EPSS 25%
An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/addassignment…