Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
1,841 results · Feed
-
Unscored —
An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. A crash and reboot can be …
-
Unscored —
A man-in-the-middle vulnerability in Cohesity DataPlatform support channel in version 6.3 up to 6.3.1g, 6.4 up to 6.4.1…
-
High 7.1
Entering code in App Lock modal sends input to conversation
wire-webapp is an open-source front end for Wire, a secure collaboration platform. In wire-webapp before version 2021-03-15-production.0, when being prompted to enter the app-lock passphrase, the typed passphrase will be sent into the most recently used chat …
-
Unscored —
Undocumented Default Cryptographic Key Vulnerability in Cohesity DataPlatform version 6.3 prior 6.3.1g, 6.4 up to 6.4.1…
-
Medium 6.7CVE-2021-28113 EPSS 23%
A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3…
-
Medium 6.1
pomerium_signature is not verified in middleware in github.com/pomerium/pomerium
Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process
-
Medium 6.3
JWT leak via Open Redirect in Programmatic access
Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2).
-
Unscored —
DMA Softlab Radius Manager 4.4.0 is affected by Cross Site Scripting (XSS) via the description, name, or address field …
-
Unscored —
DMA Softlab Radius Manager 4.4.0 assigns the same session cookie to every admin session. The cookie is valid when the a…
-
Unscored —
Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the /magnoliaPublic/trav…
-
Unscored —
Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the setText parameter of…
-
High 7.5
OAuth 2 authorization service vulnerable to DDos attacks
CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, t…
-
Unscored —
An issue was discovered in LATRIX 0.6.0. SQL injection in the txtaccesscode parameter of inandout.php leads to informat…
-
Unscored —
An issue was discovered on Nokia G-120W-F 3FE46606AGAB91 devices. There is Stored XSS in the administrative interface v…
-
Unscored —
An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/…
-
Medium 4.3
In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in t…
-
High 8.1
ApiKey secret could be revelated on network issue
node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too This is fixed in node-etsy-client v0.3.0 and later.
-
Unscored —
An issue was discovered in Devolutions Remote Desktop Manager before 2020.2.12. There is a cross-site scripting (XSS) v…
-
Unscored —
An issue was discovered in Devolutions Server before 2020.3. There is a cross-site scripting (XSS) vulnerability in ent…
-
Unscored —
An issue was discovered in Devolutions Server before 2020.3. There is an exposure of sensitive information in diagnosti…
-
Unscored —
An issue was discovered in Devolutions Server before 2020.3. There is broken access control on Password List entry elem…
-
Unscored —
An issue was discovered in Devolutions Server before 2020.3. There is Broken Authentication with Windows domain users.
-
High 7.5
Vulnerability in Stripe for Visual Studio Code < 1.7.3
vscode-stripe is an extension for Visual Studio Code. A vulnerability in Stripe for Visual Studio Code extension exists when it loads an untrusted source-code repository containing malicious settings. An attacker who successfully exploited the vulnerability c…
-
Low 3.7
Potential sensitive information disclosed in error reports
django-registration is a user registration package for Django. The django-registration package provides tools for implementing user-account registration flows in the Django web framework. In django-registration prior to 3.1.2, the base user-account registrati…
-
Unscored —
Cross-Site Scripting (XSS) in Administrative Reports in Devolutions Remote Desktop Manager before 2021.1 allows remote …
-
Unscored —
eMPS 9.0.1.923211 on the Central Management of FireEye EX 3500 devices allows remote authenticated users to conduct SQL…
-
Unscored —
eMPS 9.0.1.923211 on FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.
-
Unscored —
Server Side Request Forgery (SSRF) vulnerability in saveUrlAs function in ImagesService.java in sunkaifei FlyCMS versio…
-
Unscored —
VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a…
-
Unscored —
A potential security vulnerability has been identified in HPE Superdome Flex server. A denial of service attack can be …
-
Unscored —
A potential security vulnerability has been identified in HPE iLO Amplifier Pack. The vulnerability could be remotely e…
-
Medium 6.6
Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data expo…
-
Unscored —
The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attacker…
-
Unscored —CVE-2021-20078 EPSS 59%
Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path tr…
-
Unscored —
KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus …
-
Unscored —
In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `…