Archive
19 May 2021
Vulnerabilities first published on this day (UTC), newest first.
30 results · Feed
-
Medium —
Denial of service (via resource exhaustion) due to improper input validation in third-party identifier endpoint
### Impact Missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. ### Patches The issue is fixed by https://github.com/matrix-org/…
-
High 7.5
XSS in doc_link
Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only excep…
-
Medium 6.5
Lack of protection against cookie tossing attacks in fastify-csrf
fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "her…
-
Medium 6.5CVE-2021-29622 EPSS 20%
Arbitrary redirects under /new endpoint
Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an att…
-
High 8.1
Improper Neutralization of Script-Related HTML Tags in Notes
HedgeDoc is a platform to write and share markdown. HedgeDoc before version 1.8.2 is vulnerable to a cross-site scripting attack using the YAML-metadata of a note. An attacker with write access to a note can embed HTML tags in the Open Graph metadata section …
-
Medium 5.3
IBM Control Center 6.2.0.0 could allow a user to obtain sensitive version information that could be used in further att…
-
Medium 6.5
IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting. This vulnerability allows use…
-
Medium 5.4
IBM Control Center 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja…
-
Medium 4.0
IBM Cloud Pak for Multicloud Management prior to 2.3 allows web pages to be stored locally which can be read by another…
-
Medium 4.3
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5, 6.0.0.0 through 6.0.3.3, and 6.1.0.0 through 6.1.…
-
Unscored —
An issue was discovered in Couchbase Server 6.x through 6.6.1. The Couchbase Server UI is insecurely logging session co…
-
Unscored —
Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication,…
-
Unscored —
An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1. When using the View Engine and Auditing is e…
-
Unscored —
An issue was discovered in Smartstore (aka SmartStoreNET) before 4.1.0. Administration/Controllers/ImportController.cs …
-
Unscored —
An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST AP…
-
Unscored —
In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correct…
-
Unscored —
In the pg_partman (aka PG Partition Manager) extension before 4.5.1 for PostgreSQL, arbitrary code execution can be ach…
-
Unscored —
Persistent cross-site scripting (XSS) in the web interface of Concerto through 2.3.6 allows an unauthenticated remote a…
-
High 8.6CVE-2021-3517 EPSS 17%
Nokogiri contains libxml Out-of-bounds Write vulnerability
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds …
-
Unscored —
A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attack…
-
Unscored —
A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim t…
-
Unscored —
BMC Remedy 9.1SP3 is affected by authenticated code execution. Authenticated users that have the right to create report…
-
Unscored —
BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allow…
-
Unscored —
BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting (XSS). A DOM-based cross-site scripting vulnerability wa…
-
Unscored —
BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can …
-
Unscored —
Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/dot1x proce…
-
Unscored —
Mikrotik RouterOs before 6.47 (stable tree) in the /ram/pckg/advanced-tools/nova/bin/netwatch process. An authenticated…
-
Unscored —
The management system of ZXCDN is impacted by the information leak vulnerability. Attackers can make further analysis a…
-
Unscored —
A mobile phone of ZTE is impacted by improper access control vulnerability. Due to improper permission settings, third-…
-
Unscored —
Buffer access with incorrect length value vulnerability in GOT2000 series GT27 model communication driver versions 01.1…