Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
1,841 results · Feed
-
Medium 6.5
A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly
In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vu…
-
High 7.7
Command injection vulnerability in @prisma/sdk in getPackedPackage function
Prisma is an open source ORM for Node.js & TypeScript. As of today, we are not aware of any Prisma users or external consumers of the `@prisma/sdk` package who are affected by this security vulnerability. This issue may lead to remote code execution if a clie…
-
Medium 6.5
Regular expression Denial of Service in multiple packages
CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. F…
-
Unscored —
Aviatrix VPN Client before 2.14.14 on Windows has an unquoted search path that enables local privilege escalation to th…
-
High 7.5
Denial of Service vulnerability in django-filter
django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS fr…
-
Unscored —
In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buf…
-
Critical 9.8
A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3…
KEV Nov 3, 2021 -
Unscored —CVE-2021-20294 Public exploit
A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a…
-
High 7.5
Avaya Meetings Server Information Disclosure vulnerability
A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote attacker to gain access to screen sharing and whiteboard sessions. The affected versions of Management component of Av…
-
High 8.1
Avaya Equinox Conferencing XXE vulnerability
An XML External Entities (XXE) vulnerability in Media Server component of Avaya Equinox Conferencing could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system or even potentially lead to a denial of …
-
Critical 9.4
wikiconfig API leaked private config variables set through ManageWiki
ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af1…
-
Medium 6.0
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Unscored —
Unauthenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to gain admin privile…
-
Unscored —
Authenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to execute codeby injec…
-
Unscored —
In Etherpad < 1.8.3, a specially crafted URI would raise an unhandled exception in the cache mechanism and cause a deni…
-
Unscored —
Etherpad < 1.8.3 is affected by a denial of service in the import functionality. Upload of binary file to the import en…
-
Unscored —
Etherpad <1.8.3 stored passwords used by users insecurely in the database and in log files. This affects every database…
-
Unscored —
In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrie…
-
Unscored —
Etherpad < 1.8.3 is affected by a missing lock check which could cause a denial of service. Aggressively targeting rand…
-
Unscored —
A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.…
-
Unscored —
A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.…
-
Unscored —
A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to…
-
Unscored —
A remote SQL injection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. …
-
Unscored —
A remote escalation of privilege vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to …
-
Unscored —CVE-2021-25151 EPSS 12%
A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to…
-
High 7.5
denial of service in github.com/ulikunitz/xz
xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a…
-
Unscored —
The [SAML Authentication module](https://www.drupal.org/project/samlauth) allows users to authenticate against a SAML i…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
-
Unscored —
Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via…
-
Unscored —
Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obta…
-
Unscored —
AVE DOMINAplus <=1.10.x suffers from an unauthenticated reboot command execution. Attackers can exploit this issue to c…
-
Unscored —
AVE DOMINAplus <=1.10.x suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated att…
-
Unscored —
In WEMS Limited Enterprise Manager 2.58, input passed to the GET parameter 'email' is not properly sanitized before bei…
-
Unscored —
A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s)…
-
Unscored —
A local escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.…
-
Unscored —
AVE DOMINAplus <=1.10.x suffers from an authentication bypass vulnerability due to missing control check when directly …
-
Unscored —
A flaw was found in PDFResurrect in version 0.22b. There is an infinite loop in get_xref_linear_skipped() in pdf.c via …
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in SourceCodester Budget Management System 1.0 allows users to inject…
-
Unscored —
SQL Injection in Xinhu OA System v1.8.3 allows remote attackers to obtain sensitive information by injecting arbitrary …
-
Unscored —
SQL Injection in PHPSHE Mall System v1.7 allows remote attackers to execute arbitrary code by injecting SQL commands in…