Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
1,841 results · Feed
-
Medium 5.5
Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android…
-
Medium 5.8
Improper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions …
-
Medium 4.0
Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action.
-
Medium 4.3
Improper access control of certain port in SmartThings prior to version 1.7.63.6 allows remote temporary denial of serv…
-
Low 3.3
Intent redirection in Samsung Experience Service versions 10.8.0.4 in Android P(9.0) below, and 12.2.0.5 in Android Q(1…
-
Low 3.1
An improper synchronization logic in Samsung Email prior to version 6.1.41.0 can leak messages in certain mailbox in pl…
-
Medium 6.5
Using predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote attackers to get attac…
-
High 8.6CVE-2021-25374 Public exploit
An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in…
-
Medium 5.5
Using unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(…
-
Medium 5.9
An improper exception control in softsimd prior to SMR APR-2021 Release 1 allows unprivileged applications to access th…
-
Medium 4.0
A pendingIntent hijacking vulnerability in Secure Folder prior to SMR APR-2021 Release 1 allows unprivileged applicatio…
-
Medium 6.8
An improper access control in ActivityManagerService prior to SMR APR-2021 Release 1 allows untrusted applications to a…
-
Medium 6.8
An improper permission management in CertInstaller prior to SMR APR-2021 Release 1 allows untrusted applications to del…
-
High 7.9
An improper access control vulnerability in stickerCenter prior to SMR APR-2021 Release 1 allows local attackers to rea…
-
Critical 9.0
An improper input validation vulnerability in libswmfextractor library prior to SMR APR-2021 Release 1 allows attackers…
-
Medium 4.0
An improper SELinux policy prior to SMR APR-2021 Release 1 allows local attackers to access AP information without prop…
-
Medium 4.0
A vulnerability that stores IMSI values in an improper path prior to SMR APR-2021 Release 1 allows local attackers to a…
-
Medium 5.6
A pendingIntent hijacking vulnerability in Create Movie prior to SMR APR-2021 Release 1 in Android O(8.x) and P(9.0), 3…
-
High 7.1
An improper caller check vulnerability in Managed Provisioning prior to SMR APR-2021 Release 1 allows unprivileged appl…
-
Unscored —
A ZTE product has a configuration error vulnerability. Because a certain port is open by default, an attacker can consu…
-
Unscored —CVE-2021-20080 EPSS 93%
Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer b…
-
Medium 4.0
IBM Spectrum Scale 5.1.0.1 could allow a local attacker to bypass the filesystem audit logging mechanism when file audi…
-
High 7.6
Improper Input Validation in sopel-plugins.channelmgnt
sopel-channelmgnt is a channelmgnt plugin for sopel. In versions prior to 2.0.1, on some IRC servers, restrictions around the removal of the bot using the kick/kickban command could be bypassed when kicking multiple users at once. We also believe it may have …
-
Unscored —
A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. By adding files to an …
-
Unscored —
Skyworth Digital Technology RN510 V.3.1.0.4 RN510 V.3.1.0.4 contains a buffer overflow vulnerability in /cgi-bin/app-st…
-
Unscored —
Skyworth Digital Technology RN510 V.3.1.0.4 contains a cross-site request forgery (CSRF) vulnerability in /cgi-bin/net-…
-
Unscored —
Skyworth Digital Technology RN510 V.3.1.0.4 is affected by an incorrect access control vulnerability in/cgi-bin/test_ve…
-
Unscored —
Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF…
-
Unscored —
Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a OS command injection vulnerabil…
-
Unscored —
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended …
-
Unscored —
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Special:Contributions can …
-
Unscored —
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. ContentModelChange does no…
-
Unscored —
An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki A…
-
Medium 6.1
Wikimedia Parsoid vulnerable to Cross-site Scripting (XSS)
An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a <meta> tag, bypassing sanitization steps, and potentially allowing for XSS.
-
Unscored —CVE-2020-36287 Public exploit
The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center befo…
-
Unscored —
A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0. A credential leak was i…
-
Medium 4.0
A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network inter…
-
Unscored —
A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size pr…
-
Unscored —
Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information di…
-
Medium 4.3
CSRF vulnerability in Jenkins Micro Focus Application Automation Tools Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow form validation without permission checks.