Archive
20 May 2021
Vulnerabilities first published on this day (UTC), newest first.
61 results · Feed
-
Unscored —
The ECDSA operation of the micro-ecc library 1.0 is vulnerable to simple power analysis attacks which allows an adversa…
-
Unscored —
Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does no…
-
Unscored —
There is a denial of service vulnerability in some versions of ManageOne. In specific scenarios, due to the insufficien…
-
Unscored —
rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of impro…
-
Unscored —
There is a denial of service vulnerability in some versions of ManageOne. There is a logic error in the implementation …
-
Unscored —
In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In so…
-
Unscored —
In function lys_node_free() in libyang <= v1.0.225, it asserts that the value of node->module can't be NULL. But in som…
-
Unscored —
In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. If revisio…
-
Unscored —
A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem(). lyxml_parse_e…
-
Unscored —
In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. …
-
Unscored —
Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user …
-
Unscored —
Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a re…
-
Low —
Local directory executable lookup in sops (Windows-only)
### Impact Windows users using the sops direct editor option (`sops file.yaml`) can have a local executable named either `vi`, `vim`, or `nano` executed if running sops from `cmd.exe` This attack is only viable if an attacker is able to place a malicious bina…
-
Critical 9.6
Various
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an authenticated RCE via .phar file upload. A php web shell can be uploaded via the Documents & Files upload feature. Som…
-
Unscored —
An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, because an empty MET…
-
Unscored —
An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable NULL pointer dereference and crash in …
-
Unscored —
An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large…
-
High 7.7
Remote Memory Exposure
This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.
-
Low 2.4
CSRF allowing modification of commands, modules, banphrases through hidden iFrames
Pajbot is a Twitch chat bot. Pajbot versions prior to 1.52 are vulnerable to cross-site request forgery (CSRF). Hosters of the bot should upgrade to `v1.52` or `stable` to install the patch or, as a workaround, can add one modern dependency.
-
Unscored —
Directory Traversal vulnerability in FusionPBX 4.5.7, which allows a remote malicious user to delete folders on the sys…
-
Unscored —
Directory Traversal vulnerability exists in FusionPBX 4.5.7, which allows a remote malicious user to create folders via…
-
Unscored —
A Directory Traversal vulnerability exists in FusionPBX 4.5.7 allows malicoius users to rename any file of the system.v…
-
Medium 6.1
Plone XSS in User Fullname Property and File Upload
Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web scrip…
-
Unscored —CVE-2020-35580 EPSS 14%
A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated u…
-
Unscored —
OPC Foundation UA .NET Standard versions prior to 1.4.365.48 and OPC UA .NET Legacy are vulnerable to an uncontrolled r…
-
Low 3.1
IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failur…
-
Medium 5.3
IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed techn…
-
Medium 5.9
IBM Security Identity Manager 7.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it …
-
Low 3.7
IBM Security Identity Manager 7.0.2 could allow a remote user to enumerate usernames due to a difference of responses f…
-
Medium 5.4
IBM Security Identity Manager 7.0.2 could allow an authenticated user to bypass security and perform actions that they …
-
Medium 5.3
IBM Security Identity Manager 7.0.2 stores user credentials in plain clear text which can be read by an authenticated u…
-
Medium 5.3
IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed techn…
-
Medium 4.0
IBM Spectrum Scale 1.1.1.0 through 1.1.8.4 Transparent Cloud Tiering could allow a remote attacker to obtain sensitive …
-
Medium 4.8
Cross-site Scripting in OpenNMS Horizon
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable t…
-
High 8.8
Cross-Site Request Forgery in OpenNMS Horizon
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable t…
-
Unscored —
Cross Site Scriptiong (XSS) vulnerability exists in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary w…
-
Medium 4.8
Cross-site Scripting in OpenNMS Horizon
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable t…
-
Medium 4.3
Cross-Site Request Forgery in OpenNMS Horizon
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable t…
-
Unscored —
Products with Unified Automation .NET based OPC UA Client/Server SDK Bundle: Versions V3.0.7 and prior (.NET 4.5, 4.0, …