Archive
7 May 2021
Vulnerabilities first published on this day (UTC), newest first.
105 results · Feed
-
High 7.8
Out of bound write can occur in playready while processing command due to lack of input validation in Snapdragon Auto, …
-
High 8.4
Locked memory can be unlocked and modified by non secure boot loader through improper system call sequence making the m…
-
High 8.2
Buffer over-read while unpacking the RTCP packet we may read extra byte if wrong length is provided in RTCP packets in …
-
High 7.5
Memory corruption while processing crafted SDES packets due to improper length check in sdes packets recieved in Snapdr…
-
High 7.5
Histogram type KPI was teardown with the assumption of the existence of histogram binning info and will lead to null po…
-
High 7.5
Denial of service in MODEM due to assert to the invalid configuration in Snapdragon Auto, Snapdragon Compute, Snapdrago…
-
High 7.5
Potential UE reset while decoding a crafted Sib1 or SIB1 that schedules unsupported SIBs and can lead to denial of serv…
-
Medium 6.2
Memory corruption during buffer allocation due to dereferencing session ctx pointer without checking if pointer is vali…
-
Medium 4.3
Affected versions of Confluence Server before 7.4.8, and versions from 7.5.0 before 7.11.0 allow attackers to identify …
-
Medium 5.4
Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javas…
-
High 7.5
Vault GitHub Action did not correctly mask multi-line secrets in output
HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking.
-
Critical 9.8
Command injection in LocalStack
The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter.
-
Medium 6.1
Cross-site scripting in LocalStack
A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6.
-
Unscored —
A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S. National Security Agency (NSA) Emiss…
-
Unscored —
The ConfigFileAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to re…
-
Unscored —
U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files.
-
Unscored —
U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files.
-
Unscored —
The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in …
-
Unscored —
Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization.
-
Unscored —
A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated atta…
-
Unscored —
A remote file inclusion vulnerability exists in Artica Pandora FMS 742, exploitable by the lowest privileged user.
-
Unscored —
The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_confi…
-
Unscored —
A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php in OpenEMR 5.0.2.1.
-
Unscored —
A Stored XSS vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.1 allows a admin authenti…
-
Unscored —
A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1.