Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
1,841 results · Feed
-
High 8.0
Account compromise by man-in-the-middle attack
ScratchOAuth2 is an Oauth implementation for Scratch. Any ScratchOAuth2-related data normally accessible and modifiable by a user can be read and modified by a third party. 1. Scratch user visits 3rd party site. 2. 3rd party site asks user for Scratch usernam…
-
Unscored —
In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds read due to an integer overflow. This could lead …
-
Unscored —CVE-2021-0437 Public exploit
In setPlayPolicy of DrmPlugin.cpp, there is a possible double free. This could lead to local escalation of privilege in…
-
Unscored —
In pollOnce of ALooper.cpp, there is possible memory corruption due to a use after free. This could lead to local escal…
-
Unscored —
In updateInfo of android_hardware_input_InputApplicationHandle.cpp, there is a possible control of code flow due to a u…
-
Unscored —
In parseExclusiveStateAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow…
-
Unscored —
In parsePrimaryFieldFirstUidAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer ov…
-
Unscored —
In setPowerModeWithHandle of com_android_server_power_PowerManagerService.cpp, there is a possible out of bounds write …
-
Unscored —CVE-2021-0435 Public exploit
In avrc_proc_vendor_command of avrc_api.cc, there is a possible leak of heap data due to uninitialized data. This could…
-
Unscored —CVE-2021-0431 Public exploit
In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds read due to a missing bounds check. This could lead…
-
Unscored —
In ClearPullerCacheIfNecessary and ForceClearPullerCache of StatsPullerManager.cpp, there is a possible use-after-free …
-
Unscored —
In getSimSerialNumber of TelephonyManager.java, there is a possible way to read a trackable identifier due to a missing…
-
Unscored —
In start of WelcomeActivity.java, there is a possible residual profile due to a confused deputy. This could lead to loc…
-
Unscored —
In ImportVCardActivity, there is a possible way to bypass user consent due to a tapjacking/overlay attack. This could l…
-
Unscored —CVE-2021-0433 Public exploit
In onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when pairing a Bluetooth devi…
-
Unscored —
In several functions of ScreenshotHelper.java and related files, there is a possible incorrectly saved screenshot due t…
-
Unscored —
In several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there is a possible tapjacki…
-
Critical 9.8
An out-of-bounds write vulnerability exists in the JPG format SOF marker processing of Accusoft ImageGear 19.8. A speci…
-
High 8.6
An out-of-bounds read vulnerability exists in the Obj File TriangleMesh::TriangleMesh() functionality of Slic3r libslic…
-
High 8.0
Arbitrary File upload
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability. IPM’s maps_srv.js allows an attacker to upload a malicious NodeJS file using uploadBackgroud action. An attacker can upload a malicious cod…
-
High 8.3
Improper Neutralization of Directives in Dynamically Evaluated Code
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/…
-
Critical 10.0
Remote Code execution
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability. IPM software does not sanitize the date provided via coverterCheckList action in meta_driver_srv.js class. Attackers can send a specially…
-
High 8.0CVE-2021-23279 EPSS 28%
Arbitrary File delete
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validation in meta_driver_srv.js class with saveDriverData action using invalidated driverID. An attacker ca…
-
High 7.1
Improper Neutralization of Special Elements used in an SQL Command
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection. A malicious user can send a specially crafted packet to exploit the vulnerability. Successful exploitation of this vulnerability can allow attackers to add users…
-
High 8.7
Arbitrary File delete
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation at server/maps_srv.js with action removeBackground and server/node_upgrade_srv.js with action remov…
-
High 8.0CVE-2021-29427 Public exploit
Repository content filters do not work in Settings pluginManagement
In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning. Repository content filtering is a security control Gradle introduced to help users specify what repositories are u…
-
High 8.8
Local privilege escalation through system temporary directory
In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. Gradle builds could be vulnerable to a local privilege escalation from an a…
-
Critical 9.1
Unauthenticated SubSonic backend access in Ampache
Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic API. To successfully make the attack you must use a username that is not part of the site to bypass t…
-
Medium 5.4
Cross site request forgery vulnerability
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user may be tricked by soci…
-
High 8.1
Cross-Site Request Forgery (CSRF) in trestle-auth
trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-a…
-
Unscored —
The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input da…
-
Unscored —
An issue was discovered in Wind River VxWorks 7 before 21.03. A specially crafted packet may lead to buffer over-read o…
-
Unscored —
An issue was discovered in Wind River VxWorks through 6.8. There is a possible stack overflow in dhcp server.
-
Unscored —
An issue was discovered in Wind River VxWorks before 6.5. There is a possible heap overflow in dhcp client.
-
Medium 4.4
Denial of Service (DoS)
All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash.
-
Critical —
After order payment process manipulation in shopware/platform and shopware/core
### Impact After order payment process manipulation ### Patches We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download…
-
Medium —
Exposure of .env if project root is configured as web root in shopware/production
### Impact The .env and other sensitive files can be leaked if the project root and not `/public` is configured as the web root. ### Patches We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Update…
-
Critical —
Leak of information via Store-API aggregations in shopware/platform and shopware/core
### Impact Leak of information via Store-API ### Patches We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopw…
-
Unscored —
Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perf…
-
Low —
User (Encrypted) Password Field Being Serialised
### Impact Leaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed. ### Patches Issue has been patched in version 0.3.7-beta and onwards. ### Wo…