Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
1,841 results · Feed
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.
-
Medium 5.4
Cross-site scripting in SiCKRAGE
in SiCKRAGE, versions 4.2.0 to 10.0.11.dev1 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly when processed by the server. Therefore, an attacker can inject arbitrary JavaScript code inside the application, an…
-
Medium 6.1
Cross-site scripting in sickrage
In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `quicksearch` feature. Therefore, an attacker can steal a user's sessionID to masquerade as a victim…
-
Unscored —
An authorization bypass vulnerability in Monitorr v1.7.6m in Monitorr/assets/config/_installation/_register.php allows …
-
High 7.5
-
Medium 5.6CVE-2021-23369 Public exploit
Remote Code Execution (RCE)
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
-
High 7.5
Regular Expression Denial of Service (ReDoS)
This affects the package chrono-node before 2.2.4. It hangs on a date-like string with lots of embedded spaces.
-
Unscored —CVE-2020-24285 Scanner template
INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 allows an attacker to obtain sensitive information through /cgi-bin/cg…
-
Unscored —
An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play (UPnP) is enabled by defa…
-
Unscored —
In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent …
-
Unscored —
In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation…
-
Unscored —
In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than…
-
Unscored —
An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd(), while parsing a crafted XML fi…
-
Unscored —
In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same ind…
-
Unscored —CVE-2021-28879 Public exploit
In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer ov…
-
Unscored —
In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe …
-
Unscored —
In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get…
-
Unscored —
In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once f…
-
High 8.0CVE-2021-30481 Public exploit
Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arb…
-
Unscored —
A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate pri…
-
High 8.5
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary co…
-
Unscored —
Use after free in Aura in Google Chrome on Linux prior to 89.0.4389.114 allowed a remote attacker who had compromised t…
-
Unscored —
Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially explo…
-
Unscored —
Out of bounds read in IPC in Google Chrome prior to 89.0.4389.114 allowed a remote attacker who had compromised the ren…
-
Unscored —
Heap buffer overflow in TabStrip in Google Chrome on Windows prior to 89.0.4389.114 allowed a remote attacker to potent…
-
Unscored —
Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corr…
-
Unscored —
Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially explo…
-
High 7.5
Reject unauthorized access with GitHub PATs
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` fi…
-
Critical 9.9
Remote code execution on discord-recon .dirsearch and .arjun commands due to improper input validation
Discord Recon Server is a bot that allows you to do your reconnaissance process from your Discord. Remote code execution in version 0.0.1 would allow remote users to execute commands on the server resulting in serious issues. This flaw is patched in 0.0.2.
-
Unscored —
SQL injection in admin.php in Online Book Store 1.0 allows remote attackers to execute arbitrary SQL commands and bypas…
-
High 7.2
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload …
KEV Nov 3, 2021 -
Critical 9.8
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account…
KEV Nov 3, 2021 -
Critical 9.3
A privilege escalation vulnerability exists in Dream Report 5 R20-2. In the default configuration, the Syncfusion Dashb…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in the Larsens Calender plugin Version <= 1.2 for WordPress allows remote atta…
-
Critical 9.3
A privilege escalation vulnerability exists in Dream Report 5 R20-2. IIn the default configuration, the following regis…
-
Critical 9.3
A privilege escalation vulnerability exists in Dream Report 5 R20-2. COM Class Identifiers (CLSID), installed by Dream …
-
Medium 6.1
subrion CMS Cross Site Scripting (XSS) vulnerability
Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the "payment gateway" column on transactions tab.
-
Medium 5.4
An exploitable SQL injection vulnerability exists in "global_lists/choices" page of the Rukovoditel Project Management …
-
Medium 5.4
An exploitable SQL injection vulnerability exists in the "forms_fields_rules/rules" page of the Rukovoditel Project Man…
-
Medium 5.4
An exploitable SQL injection vulnerability exists in the "access_rules/rules_form" page of the Rukovoditel Project Mana…