Archive
6 May 2021
Vulnerabilities first published on this day (UTC), newest first.
106 results · Feed
-
Unscored —
Primary Source Verification in VerityStream MSOW Solutions before 3.1.1 allows an anonymous internet user to discover S…
-
High 8.8
Cross-Site Request Forgery in forkcms
Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication of logged administrators.
-
Medium 6.1
Cross-site scripting in forkcms
Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the "navigation_title" parameter and the "title" parameter in /private/en/pages/add.
-
Unscored —
Unconstrained Web access to the device's private encryption key in the QR code pairing mode in the eWeLink mobile appli…
-
Unscored —CVE-2021-29203 EPSS 68%
A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Inf…
-
Unscored —
emlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of database backup file in admin…
-
Medium 6.5
Kennnyshiwa-cogs vulnerable to Remote Code Execution in Tickets Module
Kennnyshiwa-cogs contains cogs for Red Discordbot. An RCE exploit has been found in the Tickets module of kennnyshiwa-cogs. This exploit allows discord users to craft a message that can reveal sensitive and harmful information. Users can upgrade to version 5a…
-
Unscored —
Stormshield SNS with versions before 3.7.18, 3.11.6 and 4.1.6 has a memory-management defect in the SNMP plugin that ca…
-
Unscored —
The 'id' parameter of IBM Tivoli Storage Manager Version 5 Release 2 (Command Line Administrative Interface, dsmadmc.ex…
-
Unscored —
An SSRF issue in Open Distro for Elasticsearch (ODFE) before 1.13.1.0 allows an existing privileged user to enumerate l…
-
Unscored —
Arbitrary File Deletion vulnerability in puppyCMS v5.1 allows remote malicious attackers to delete the file/folder via …
-
Unscored —
Rmote Code Execution (RCE) vulnerability in puppyCMS v5.1 due to insecure permissions, which could let a remote malicio…
-
Unscored —
Cross Site Request Forgery (CSRF) vulnerability in puppyCMS v5.1 that can change the admin's password via /admin/settin…
-
Unscored —
An issue exists on NightOwl WDB-20-V2 WDB-20-V2_20190314 devices that allows an unauthenticated user to gain access to …
-
Unscored —
ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string index out of range" error …
-
Unscored —
A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to a…
-
Unscored —
An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver …
-
Medium 6.1
Header injection possible in Django
In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injec…
-
Unscored —
kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading to disclosure …
-
High —
Unauthorized access through URL manipulation
### Impact The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. ### Patches The vulnerability has been patched in version 1.2.65 of the `master` branch, version 1.1.113 of the 1.1.x series, and …
-
Medium 6.3
Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19
Insecure temporary directory usage in frontend build functionality of `com.vaadin:flow-server` versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4)…
-
Unscored —
A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could occur in fdctrl_…
-
Unscored —CVE-2021-28149 EPSS 15%
Hongdian H8922 3.0.5 devices allow Directory Traversal. The /log_download.cgi log export handler does not validate user…
-
Unscored —
Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the administrator password and ot…
-
Unscored —
Hongdian H8922 3.0.5 devices have an undocumented feature that allows access to a shell as a superuser. To connect, the…
-
Unscored —CVE-2021-28151 EPSS 28%
Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) …
-
Critical 9.8
The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630…
KEV Jun 2, 2025 -
Critical 9.8
A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously cr…
-
Unscored —
An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel version v5.12-r…
-
High 8.1
Weak Password Recovery Mechanism for Forgotten Password in Strapi
In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password.
-
High 7.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validat…
-
Medium 4.3
An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7. Improper permission check co…
-
Medium 6.8CVE-2021-22206 Public exploit
An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed t…
-
Medium 5.3CVE-2021-22210 Public exploit
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. When querying the repository br…
-
Medium 5.3
Cisco SD-WAN vManage Information Disclosure Vulnerability
A vulnerability in the cluster management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. To be affected by this vulnerability, the Cisco SD-WAN vManage Software m…
-
Medium 6.5
Cisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Read Vulnerability
A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an authenticated, remote attacker to read arbitrary files from the underlying operating system. This vulnerabilit…
-
Medium 5.4
Cisco BroadWorks Messaging Server XML External Entity Injection Vulnerability
A vulnerability in the web-based management interface of Cisco BroadWorks Messaging Server Software could allow an authenticated, remote attacker to access sensitive information or cause a partial denial of service (DoS) condition on an affected system. This …
-
Medium 6.5
Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Denial of Service Vulnerability
A vulnerability in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to cause an affected IP camera to reload. This vulnerability is due to missing checks when pro…
-
Medium 6.7
Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Local Privilege Escalation Vulnerability
A vulnerability in the internal message processing of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, local attacker to run arbitrary commands with root privileges on the underlying operating system (OS). This…
-
Medium 4.7
Cisco AnyConnect Secure Mobility Client Profile Modification Vulnerability
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacker to overwrite VPN profiles on an affected device. The vulnerability is due to insufficient validati…