Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
1,841 results · Feed
-
Medium 4.8
SSL/TLS certificate validation unconditionally disabled by Jenkins Micro Focus Application Automation Tools Plugin
Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow unconditionally disabling of SSL/TLS certificates.
-
High 8.8
Reflected XSS vulnerability in Jenkins Micro Focus Application Automation Tools Plugin
Reflected XSS vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects all version 6.7 and earlier versions.
-
Medium 4.3
Missing permission checks in Micro Focus Application Automation Tools Plugin
Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow access without permission checks.
-
Unscored —
The application in the mobile phone can unauthorized access to the list of running processes in the mobile phone, Xiaom…
-
Unscored —
The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.
-
Unscored —
The Dolby Audio X2 (DAX2) API service before 0.8.8.90 on Windows allows local users to gain privileges.
-
Unscored —
There is a memory leak vulnerability in some Huawei products. An authenticated remote attacker may exploit this vulnera…
-
Unscored —
On Xiaomi router AX1800 rom version < 1.0.336 and RM1800 root version < 1.0.26, the encryption scheme for a user's back…
-
Unscored —
A RACE CONDITION on XQBACKUP causes a decompression path error on Xiaomi router AX3600 with ROM version =1.0.50.
-
Unscored —
Authentication bypass vulnerability in Micro Focus Operations Bridge Manager affects versions 2019.05, 2019.11, 2020.05…
-
Unscored —
Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging confi…
-
Unscored —
An issue was discovered in Aprelium Abyss Web Server X1 2.12.1 and 2.14. A crafted HTTP request can lead to an out-of-b…
-
Unscored —
The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting (XSS) vulnerability affecting versions 2.0…
-
Low —
CSRF Vuln can expose user's QRcode
### Impact When a user is setting up two-factor authentication using an authenticator app, a QRcode is generated and made available via a GET request to /tf-qrcode. Since GETs do not have any CSRF protection, it is possible a malicious 3rd party could access …
-
Unscored —
An issue was discovered in Realtek rtl8723de BLE Stack <= 4.1 that allows remote attackers to cause a Denial of Service…
-
Unscored —
Learnsite 1.2.5.0 contains a remote privilege escalation vulnerability in /Manager/index.aspx through the JudgIsAdmin()…
-
Unscored —
zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows a…
-
Unscored —
VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration does not r…
-
Unscored —
VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissi…
-
Unscored —CVE-2021-28924 EPSS 10%
Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page.
-
Unscored —
SQL injection vulnerability in Nagios Network Analyzer before 2.4.3 via the o[col] parameter to api/checks/read/.
-
Medium 4.3
IBM WebSphere Application Server 7.0, 8.0, and 8.5 is vulnerable to server-side request forgery (SSRF). By sending a sp…
-
Unscored —
A stored XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in the event name and description fields. An…
-
Unscored —
Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create…
-
Unscored —
A blind XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in event name and description fields. An atta…
-
Unscored —
Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create…
-
Unscored —
AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to trigger a stack-based bu…
-
Unscored —
AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to interact directly with p…
-
Unscored —
A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remo…
-
High 7.5
Clam AntiVirus (ClamAV) Email Parser Denial of Service Vulnerability
A vulnerability in the PDF parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper buffe…
-
High 7.5
Clam AntiVirus (ClamAV) PDF Parser Denial of Service Vulnerability
A vulnerability in the email parsing module in Clam AntiVirus (ClamAV) Software version 0.103.1 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to im…
-
High 7.5
Clam AntiVirus (ClamAV) Excel XLM Parser Denial of Service Vulnerability
A vulnerability in the Excel XLM macro parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to im…
-
Medium 6.6
Cisco IOS XR Software Command Injection Vulnerability
A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges on the underlying Linux operating system (OS) of an affected device. This vulnerability is due…
-
High 7.8CVE-2021-1480 Public exploit
Cisco SD-WAN vManage Software Vulnerabilities
Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gain escalated privileges on an affected system. For more information about these …
-
High 7.8
Cisco SD-WAN vManage Software Vulnerabilities
Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gain escalated privileges on an affected system. For more information about these …
-
Medium 6.5
Cisco Umbrella Link and CSV Formula Injection Vulnerabilities
Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more information about these …
-
Medium 6.5
Cisco Umbrella Link and CSV Formula Injection Vulnerabilities
Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more information about these …
-
Medium 5.3
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about thes…
-
Medium 5.3
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about thes…
-
Medium 4.3
Cisco Webex Meetings for Android Avatar Modification Vulnerability
A vulnerability in Cisco Webex Meetings for Android could allow an authenticated, remote attacker to modify the avatar of another user. This vulnerability is due to improper authorization checks. An attacker could exploit this vulnerability by sending a craft…