Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
1,841 results · Feed
-
Unscored —
MERCUSYS Mercury X18G 1.0.5 devices allow Denial of service via a crafted value to the POST listen_http_lan parameter. …
-
Unscored —
Command injection vulnerability in China Mobile An Lianbao WF-1 1.01 via the 'ip' parameter with a POST request to /api…
-
Unscored —
Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury X18G 1.0.5 devices, via crafted values to the 'src_dport_s…
-
High 7.5
Ansible Exposes Sensitive Information
A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The…
-
Unscored —
SQL injection in the getip function in conn/function.php in 发货100-设计素材下载系统 1.1 allows remote attackers to inject arbitr…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in the article comments feature in emlog 6.0.
-
Unscored —
CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject a…
-
Unscored —
Cross Site Request Forgery (CSRF) in Rukovoditel v2.8.3 allows attackers to create an admin user with an arbitrary cred…
-
Critical 9.8
In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to by…
-
Unscored —
md_analyze_line in md4c.c in md4c 0.4.7 allows attackers to trigger use of uninitialized memory, and cause a denial of …
-
Unscored —
samurai 1.2 has a NULL pointer dereference in writefile() in util.c via a crafted build file.
-
Unscored —
samurai 1.2 has a NULL pointer dereference in printstatus() function in build.c via a crafted build file.
-
Unscored —CVE-2021-20092 Scanner template
The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not p…
-
Unscored —CVE-2021-20091 Scanner template
The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not p…
-
Unscored —
An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/S…
-
Unscored —
Smartwares HOME easy <=1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vu…
-
Unscored —
Inim Electronics Smartliving SmartLAN/G/SI <=6.x uses default hardcoded credentials. An attacker could exploit this to …
-
Unscored —
Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMedia…
-
Unscored —
Inim Electronics SmartLiving SmartLAN/G/SI <=6.x suffers from an authenticated remote command injection vulnerability. …
-
Unscored —
Emmanuel MyDomoAtHome (MDAH) REST API REST API Domoticz ISS Gateway 0.2.40 is affected by an information disclosure vul…
-
Unscored —
A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s) …
-
Unscored —
A remote cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to …
-
Unscored —
A remote disclosure of privileged information vulnerability was discovered in Aruba ClearPass Policy Manager version(s)…
-
Unscored —
A remote XML external entity (XXE) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to …
-
Unscored —
A remote cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to …
-
Unscored —
`aes-ctr` has been merged into the `aes` crate
Please use the `aes` crate going forward. The new repository location is at: <https://github.com/RustCrypto/block-ciphers/tree/master/aes> The `aes` crate now has an optional `ctr` feature which autodetects SIMD features on `i686`/`x86-64` targets and uses th…
-
Unscored —
`aes-soft` has been merged into the `aes` crate
Please use the `aes` crate going forward. The new repository location is at: <https://github.com/RustCrypto/block-ciphers/tree/master/aes> AES-NI is now autodetected at runtime on `i686`/`x86-64` platforms. If AES-NI is not present, the `aes` crate will fallb…
-
Unscored —
`aesni` has been merged into the `aes` crate
Please use the `aes` crate going forward. The new repository location is at: <https://github.com/RustCrypto/block-ciphers/tree/master/aes> AES-NI is now autodetected at runtime on `i686`/`x86-64` platforms. If AES-NI is not present, the `aes` crate will fallb…
-
Unscored —
A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to…
-
Unscored —
A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s) …
-
Unscored —
A remote server side request forgery (SSRF) remote code execution vulnerability was discovered in Aruba ClearPass Polic…
-
Unscored —
A remote cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to …
-
Unscored —
A remote URL redirection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1…
-
Unscored —
A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.…
-
Unscored —
A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.…
-
Unscored —
A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.…
-
Unscored —
GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue t…
-
High 8.8
Dependency Confusion in Bundler
Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a …
-
High 8.1CVE-2021-25216 EPSS 83%
A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack
In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch, BIND servers are vulnerable…
-
High 7.5CVE-2021-25215 EPSS 12%
An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself
In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version o…