Archive
April 2021
Vulnerabilities first published in this month (UTC), newest first.
1,841 results · Feed
-
Unscored —
OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password …
-
Unscored —
A weak password requirement vulnerability exists in the Create New User function of MintHCM RELEASE 3.0.8, which could …
-
Unscored —
The Import function in MintHCM RELEASE 3.0.8 allows an attacker to execute a cross-site scripting (XSS) payload in file…
-
Unscored —
OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data o…
-
Unscored —
NETGEAR R7000 1.0.11.116 devices have a heap-based Buffer Overflow that is exploitable from the local network without a…
-
Unscored —CVE-2021-28079 Public exploit
Jamovi <=1.6.18 is affected by a cross-site scripting (XSS) vulnerability. The column-name is vulnerable to XSS in the …
-
Unscored —
An access control vulnerability in Hame SD1 Wi-Fi firmware <=V.20140224154640 allows an attacker to get system administ…
-
Critical 9.8
Prototype pollution in safe-obj
Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution in safe-flat
Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Medium 4.8
Authentication Bypass
The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip …
-
Unscored —
cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).
-
Unscored —
LeoCAD before 21.03 sometimes allows a use-after-free during the opening of a new document.
-
Unscored —
Improper access control vulnerability in NEC Aterm WG2600HS firmware Ver1.5.1 and earlier, and Aterm WX3000HP firmware …
-
Unscored —
Aterm WG2600HS firmware Ver1.5.1 and earlier allows an attacker to execute arbitrary OS commands via unspecified vector…
-
Unscored —
Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.5.1 and earlier allows remote attackers to inject an…
-
Unscored —
Improper validation of integrity check value vulnerability in NEC Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm W…
-
Unscored —
NEC Aterm devices (Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Ater…
-
Unscored —
Missing authentication for critical function in DAP-1880AC firmware version 1.21 and earlier allows a remote attacker t…
-
Unscored —
DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to execute arbitrary OS commands by…
-
Unscored —
Improper access control vulnerability in DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated att…
-
Unscored —
Improper following of a certificate's chain of trust vulnerability in DAP-1880AC firmware version 1.21 and earlier allo…
-
Unscored —
Improper access control vulnerability in Gurunavi App for Android ver.10.0.10 and earlier and for iOS ver.11.1.2 and ea…
-
Unscored —
Cross-site scripting vulnerability in NEC Aterm devices (Aterm WG1900HP2 firmware Ver.1.3.1 and earlier, Aterm WG1900HP…
-
Low 2.5
Out-of-bounds read in Exiv2::Jp2Image::doWriteMetadata
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, wri…
-
High 8.8
Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to p…
KEV Nov 3, 2021 -
Unscored —
The server in npupnp before 4.1.4 is affected by DNS rebinding in the embedded web server (including UPnP SOAP and GENA…
-
Unscored —CVE-2021-31762 Public exploit
Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users fe…
-
Unscored —
Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's r…
-
Unscored —CVE-2021-31760 Public exploit
Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to achieve Remote Command Execution (RCE) through Webmin'…
-
Unscored —
Akuvox C315 115.116.2613 allows remote command Injection via the cfgd_server service. The attack vector is sending a pa…
-
Unscored —
The unofficial vscode-ghc-simple (aka Simple Glasgow Haskell Compiler) extension before 0.2.3 for Visual Studio Code al…
-
Medium 5.4
Cross-site Scripting in React Draft Wysiwyg
react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is shared across users, leading to XSS.
-
Unscored —
Settings.aspx?view=About in Directum 5.8.2 allows XSS via the HTTP User-Agent header.
-
Unscored —
The PowerVR GPU kernel driver in pvrsrvkm.ko through 2021-04-24 for the Linux kernel, as used on Alcatel 1S phones, all…
-
Unscored —
An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_decode() performs incorrect memory handling wh…
-
Unscored —
In Hardware Sentry KM before 10.0.01 for BMC PATROL, a cleartext password may be discovered after a failure or timeout …
-
High 8.1
XXE in Avaya Callback Assist Administration
An XML External Entities (XXE)vulnerability in Callback Assist could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Callback Assist includes all 4.0.x versions before 4…
-
High 8.1
XXE in Avaya Aura Orchestration Designer
An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Or…
-
Unscored —
Sipwise C5 NGCP www_csc version 3.6.4 up to and including platform NGCP CE mr3.8.13 allows call/click2dial CSRF attacks…
-
Unscored —
Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated sto…