Archive

11 May 2021

Vulnerabilities first published on this day (UTC), newest first.

← April 2021 2021 / May /11 June 2021 →

All Critical High Medium Low Exploited only Public exploit

36 results · Clear filters · Feed

Medium 5.3

CVE-2020-26146

An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fr…

linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu

May 11, 2021
Medium 6.5

CVE-2021-31209

Microsoft Exchange Server Spoofing Vulnerability

Microsoft Exchange Server Spoofing Vulnerability

Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 8 Microsoft Exchange Server 2016 Cumulative Update 19

May 11, 2021
Medium 6.6

CVE-2021-31207 Exploited · Ransomware Public exploit EPSS 100%

Microsoft Exchange Server Security Feature Bypass Vulnerability

Microsoft Exchange Server Security Feature Bypass Vulnerability

Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Update 19 Microsoft Exchange Server 2019 Cumulative Update 8

May 11, 2021
KEV Nov 3, 2021
Medium 6.5

CVE-2021-31205

Windows SMB Client Security Feature Bypass Vulnerability

Windows SMB Client Security Feature Bypass Vulnerability

Microsoft Windows 10 Version 20H2 Windows Server version 20H2 Windows 10 Version 2004 Windows

May 11, 2021
Medium 6.5

CVE-2021-31195 EPSS 74%

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 8 Microsoft Exchange Server 2016 Cumulative Update 19

May 11, 2021
Medium 5.5

CVE-2021-31191

Windows Projected File System FS Filter Driver Information Disclosure Vulnerability

Windows Projected File System FS Filter Driver Information Disclosure Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

May 11, 2021
Medium 5.5

CVE-2021-31185

Windows Desktop Bridge Denial of Service Vulnerability

Windows Desktop Bridge Denial of Service Vulnerability

Microsoft Windows 10 Version 20H2 Windows Server version 20H2 Windows 10 Version 2004 Windows

May 11, 2021
Medium 5.5

CVE-2021-31184 Public exploit

Microsoft Windows Infrared Data Association (IrDA) Information Disclosure Vulnerability

Microsoft Windows Infrared Data Association (IrDA) Information Disclosure Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

May 11, 2021
Medium 5.5

CVE-2021-31178 EPSS 16%

Microsoft Office Information Disclosure Vulnerability

Microsoft Office Information Disclosure Vulnerability

Microsoft Microsoft 365 Apps for Enterprise Microsoft Office 2019 Microsoft Excel 2016

May 11, 2021
Medium 5.5

CVE-2021-31174

Microsoft Excel Information Disclosure Vulnerability

Microsoft Excel Information Disclosure Vulnerability

Microsoft Microsoft 365 Apps for Enterprise Microsoft Office 2019 Microsoft Excel 2016

May 11, 2021
Medium 5.3

CVE-2021-31173

Microsoft SharePoint Server Information Disclosure Vulnerability

Microsoft SharePoint Server Information Disclosure Vulnerability

Microsoft Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Foundation 2013 Service Pack 1

May 11, 2021
Medium 4.1

CVE-2021-31171

Microsoft SharePoint Information Disclosure Vulnerability

Microsoft SharePoint Information Disclosure Vulnerability

Microsoft Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Foundation 2013 Service Pack 1

May 11, 2021
Medium 5.5

CVE-2021-28479

Windows CSC Service Information Disclosure Vulnerability

Windows CSC Service Information Disclosure Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

May 11, 2021
Medium 6.1

CVE-2021-28461

Dynamics Finance and Operations Cross-site Scripting Vulnerability

Dynamics Finance and Operations Cross-site Scripting Vulnerability

Microsoft Dynamics 365 for Finance and Operations

May 11, 2021
Medium 6.5

CVE-2021-26421

Skype for Business and Lync Spoofing Vulnerability

Skype for Business and Lync Spoofing Vulnerability

Microsoft Microsoft Lync Server 2013 CU10 Skype for Business Server 2015 CU11

May 11, 2021
Medium 4.6

CVE-2021-26418

Microsoft SharePoint Server Spoofing Vulnerability

Microsoft SharePoint Server Spoofing Vulnerability

Microsoft Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Foundation 2013 Service Pack 1

May 11, 2021
Medium 4.3

CVE-2020-4536

IBM OpenPages GRC Platform 8.1 could allow a remote attacker to obtain sensitive information when a detailed technical …

IBM OpenPages GRC Platform

May 11, 2021
Medium 5.4

CVE-2020-4535

IBM OpenPages GRC Platform 8.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrar…

IBM OpenPages GRC Platform

May 11, 2021
Medium 6.5

CVE-2021-27619

SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for a…

SAP_SE SAP Commerce (Backoffice Search)

May 11, 2021
Medium 4.9

CVE-2021-27617

The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does …

SAP_SE SAP Process Integration (Integration Builder Framework)

May 11, 2021
Medium 4.9

CVE-2021-27618

The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does …

SAP_SE SAP Process Integration (Integration Builder Framework)

May 11, 2021
Medium 4.3

CVE-2021-21654

Missing Authorization in Jenkins P4 plugin

Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password.

Jenkins Project Jenkins P4 Plugin org.jenkins-ci.plugins:p4 Web / CMS Maven

May 11, 2021
Medium 4.3

CVE-2021-21653

Missing Authorization in jenkins xray-connector

Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Jenkins Project Jenkins Xray - Test Management for Jira Plugin org.jenkins-ci.plugins:xray-connector Web / CMS Maven

May 11, 2021
Medium 4.3

CVE-2021-21651

Missing Authorization in Jenkins S3 publisher Plugin

Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain the list of configured profiles.

Jenkins Project Jenkins S3 publisher Plugin org.jenkins-ci.plugins:s3 Web / CMS Maven

May 11, 2021
Medium 5.4

CVE-2021-21649 EPSS 73%

Cross-site Scripting in Jenkins Dashboard View Plugin

Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.

Jenkins Project Jenkins Dashboard View Plugin org.jenkins-ci.plugins:dashboard-view Web / CMS Maven

May 11, 2021
Medium 4.3

CVE-2021-21650

Missing Authorization in Jenkins S3 publisher Plugin

Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Ar…

Jenkins Project Jenkins S3 publisher Plugin org.jenkins-ci.plugins:s3 Web / CMS Maven

May 11, 2021
Medium 6.1

CVE-2021-21648 EPSS 11%

Cross-Site Request Forgery in Jenkins Credentials Plugin

Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (XSS) vulnerability.

Jenkins Project Jenkins Credentials Plugin org.jenkins-ci.plugins:credentials Web / CMS Maven

May 11, 2021
Medium 6.1

CVE-2021-32561

OctoPrint API Error Messages vulnerable to XSS

OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters.

octoprint PyPI

May 11, 2021
Medium 6.5

CVE-2021-32560

OctoPrint Incorrect Access Control

The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files.

octoprint PyPI

May 11, 2021
Medium 6.4

CVE-2020-27246

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. Th…

May 11, 2021
Medium 6.4

CVE-2020-27245

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. Th…

May 11, 2021
Medium 6.4

CVE-2020-27244

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. Th…

May 11, 2021
Medium 6.4

CVE-2020-27243

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. Th…

May 11, 2021
Medium 6.4

CVE-2020-27242

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. Th…

May 11, 2021
Medium 5.4

CVE-2021-32544

Intelligent global technology Ltd, igt+ - DOM-based Cross-Site Scripting

Special characters of IGT search function in igt+ are not filtered in specific fields, which allow remote authenticated attackers can inject malicious JavaScript and carry out DOM-based XSS (Cross-site scripting) attacks.

Intelligent global technology igt+

May 11, 2021
Medium 5.4

CVE-2021-30174

RiyaLab Co., Ltd. CloudISO - Stored XSS

RiyaLab CloudISO event item is added, special characters in specific field of time management page are not properly filtered, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) att…

RiyaLab CloudISO

May 11, 2021