Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
1,841 results · Feed
-
Medium —
Potential API key leak
If a user is actively blackholing the location or weather APIs, or those APIs become otherwise unavailable, it is possible for the API keys to get leaked to the active IRC channel. This is patched in v1.2.4
-
Unscored —
A ZTE product is impacted by improper access control vulnerability. The attacker could exploit this vulnerability to ac…
-
Unscored —
A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused because the management …
-
High 8.8CVE-2020-13568 EPSS 30%
SQL injection vulnerability exists in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An a…
-
High 8.8
SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An …
-
Critical 10.0
An exploitable unatuhenticated command injection exists in the OpenClinic GA 5.173.3. Specially crafted web requests ca…
-
High 8.8
An incorrect default permissions vulnerability exists in the installation functionality of OpenClinic GA 5.173.3. Overw…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the compnomenclat…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description p…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID pa…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID p…
-
Unscored —
Escalation of privileges vulnerability in Micro Focus Operations Agent, affects versions 12.0x, 12.10, 12.11, 12.12, 12…
-
Unscored —CVE-2021-30176 EPSS 29%
The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/de…
-
Unscored —CVE-2021-30175 Scanner template
ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page.
-
Unscored —
Trend Micro Password Manager version 5 (Consumer) is vulnerable to a DLL Hijacking vulnerability which could allow an a…
-
Unscored —
An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could a…
-
Unscored —
An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 c…
-
Unscored —CVE-2021-25253 Public exploit
An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG S…
-
Unscored —
An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG S…
-
Medium 6.5
Possible limited path traversal vulnerabily in Apache Commons IO
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not furth…
-
Critical 9.1
Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections
When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization res…
-
High 7.5
Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings
When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a se…
-
High 7.1
SSRF vulnerability with the Replication handler
The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the loc…
-
Unscored —
Siren Federate before 6.8.14-10.3.9, 6.9.x through 7.6.x before 7.6.2-20.2, 7.7.x through 7.9.x before 7.9.3-21.6, 7.10…
-
Unscored —
Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacte…
-
Unscored —
Certain Papoo products are affected by: Cross Site Request Forgery (CSRF) in the admin interface. This affects Papoo CM…
-
Unscored —CVE-2021-30637 Public exploit
htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php.
-
Unscored —
The unofficial GLSL Linting extension before 1.4.0 for Visual Studio Code allows remote code execution via a crafted gl…
-
Unscored —CVE-2021-30030 Public exploit
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Full Name field on register-patient.php.
-
Unscored —CVE-2021-30034 Public exploit
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Symptons field on patients/register-report.php.
-
Unscored —CVE-2021-30044 Public exploit
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php.
-
Unscored —CVE-2021-30042 Public exploit
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Clinic Name", "Clinic Address", "Clinic City", or "Clinic Con…
-
Unscored —CVE-2021-30039 Public exploit
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Fever" or "Blood Pressure" field on the patients/register-rep…
-
Medium 6.3
Open redirect via transitional IPv6 addresses on dual-stack networks
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external …
-
Medium 5.3
Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endp…
-
Medium 4.0
Information disclosure through temporary directory permissions
In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote files accessed thro…
-
Low 3.8
Advanced Authentication Improper Session Management
Advanced Authentication versions prior to 6.3 SP4 have a potential broken authentication due to improper session management issue.
-
Medium 5.3
Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endp…
-
Medium 4.2
Cross-site Scripting in quill
A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attribute of an IMG element) in a text field. Note: Researchers have claimed that this issue is not with…
-
High 7.8
Dell Peripheral Manager 1.3.1 or greater contains remediation for a local privilege escalation vulnerability that could…