Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
1,841 results · Feed
-
Unscored —
In FreeBSD 13.0-STABLE before n245117, 12.2-STABLE before r369551, 11.4-STABLE before r369559, 13.0-RC5 before p1, 12.2…
-
Unscored —CVE-2021-29627 Public exploit
In FreeBSD 13.0-STABLE before n245050, 12.2-STABLE before r369525, 13.0-RC4 before p0, and 12.2-RELEASE before p6, list…
-
Unscored —
In FreeBSD 13.0-STABLE before n245118, 12.2-STABLE before r369552, 11.4-STABLE before r369560, 13.0-RC5 before p1, 12.2…
-
Unscored —
The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platfo…
-
Medium 4.3
CSRF vulnerability in Jenkins promoted builds Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows attackers to to promote builds.
-
Medium 4.3
View name validation bypass in Jenkins
Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names.
-
Medium 4.3
Lack of type validation in agent related REST API in Jenkins
Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with Computer/Configure permission to replace a node with one …
-
High 7.5
Indico Tampering with links (e.g. password reset) in sent emails
CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link.
-
Unscored —
`sass-rs` has been deprecated
The `sass-rs` crate is not maintained anymore as libsass is deprecated. Consider using https://github.com/connorskees/grass or https://github.com/kaj/rsass instead. (Author's recommendation.)
-
Unscored —
GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN (Portable Game Notation) data. This is relat…
-
Unscored —
fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Director…
-
Unscored —
There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execu…
-
Unscored —CVE-2021-26709 EPSS 40%
D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthenticate…
-
High 7.5
Denial of service while processing RTCP packets containing multiple SDES reports due to memory for last SDES packet is …
-
High 8.4
Memory corruption due to improper input validation while processing IO control which is nonstandard in Snapdragon Compu…
-
High 7.2
Trustzone initialization code will disable xPU`s when memory dumps are enabled and lead to information disclosure in Sn…
-
High 8.2
Out of bound memory read while unpacking data due to lack of offset length check in Snapdragon Auto, Snapdragon Compute…
-
High 8.2
Out-of-bounds read vulnerability while accessing DTMF payload due to lack of check of buffer length before copying in S…
-
High 8.4
A double free condition can occur when the device moves to suspend mode during secure playback in Snapdragon Auto, Snap…
-
High 8.4
Unintended reads and writes by NS EL2 in access control driver due to lack of check of input validation in Snapdragon A…
-
High 7.5
RRC sends a connection establishment success to NAS even though connection setup validation returns failure and leads t…
-
High 8.4
User could gain access to secure memory due to incorrect argument into address range validation api used in SDI to capt…
-
High 8.4
Memory crash when accessing histogram type KPI input received due to lack of check of histogram definition before acces…
-
High 8.4
Memory corruption due to invalid value of total dimension in the non-histogram type KPI could lead to a denial of servi…
-
High 8.4
When sending a socket event message to a user application, invalid information will be passed if socket is freed by oth…
-
Medium 6.7
Two threads call one or both functions concurrently leading to corruption of pointers and reference counters which in t…
-
Critical 9.3
Possible memory corruption in RPM region due to improper XPU configuration in Snapdragon Connectivity, Snapdragon Indus…
-
High 8.2
Out of bound read occurs while processing crafted SDP due to lack of check of null string in Snapdragon Auto, Snapdrago…
-
Unscored —
Directory traversal vulnerability in Archive collectively operation utility Ver.2.10.1.0 and earlier allows an attacker…
-
Unscored —
Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via uns…
-
Unscored —
Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via uns…
-
Unscored —
Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via uns…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Kagemai 0.8.8 allows remote attackers to hijack the authentication o…
-
Unscored —
Cross-site scripting vulnerability in Click Ranker Ver.3.5 allows remote attackers to inject an arbitrary script via un…
-
Unscored —
Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecifi…
-
Unscored —
Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecifi…
-
Unscored —
Cross-site scripting vulnerability in MagazinegerZ v.1.01 allows remote attackers to inject an arbitrary script via uns…
-
Unscored —CVE-2021-30147 Public exploit
DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts such as adding new manager accounts via admin.php.
-
Unscored —
An issue was discovered in the Linux kernel before 5.8. arch/x86/kvm/svm/svm.c allows a set_memory_region_test infinite…
-
Unscored —
An issue was discovered in the Linux kernel through 5.11.11. synic_get in arch/x86/kvm/hyperv.c has a NULL pointer dere…