Archive
26 May 2021
Vulnerabilities first published on this day (UTC), newest first.
105 results · Feed
-
Unscored —
Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 a…
-
Unscored —
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in homeLYnk (Wiser …
-
Unscored —
Improper Verification of Cryptographic Signature vulnerability exists inhomeLYnk (Wiser For KNX) and spaceLYnk V2.60 an…
-
Unscored —
Improper Verification of Cryptographic Signature vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 a…
-
Unscored —
Improper Privilege Management vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which coul…
-
Unscored —
Improper Privilege Management vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which coul…
-
Unscored —
Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSE…
-
Unscored —
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of…
-
Unscored —
Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that c…
-
Unscored —
Buffer Overflow vulnerability in FFmpeg 4.2 at convolution_y_10bit in libavfilter/vf_vmafmotion.c, which could let a re…
-
Unscored —
Buffer Overflow vulnerability in FFmpeg 4.2 in the build_diff_map function in libavfilter/vf_fieldmatch.c, which could …
-
Unscored —
In VOS and overly permissive "umask" may allow for authorized users of the server to gain unauthorized access through i…
-
Unscored —
In VOS user session identifier (authentication token) is issued to the browser prior to authentication but is not chang…
-
Unscored —
In Versa Director, the un-authentication request found.
-
Unscored —
In Versa Analytics, the cron jobs are used for scheduling tasks by executing commands at specific dates and times on th…
-
Unscored —
In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within config…
-
Unscored —
In VOS compromised, an attacker at network endpoints can possibly view communications between an unsuspecting user and …
-
Unscored —
In Versa Director, Versa Analytics and VOS, Passwords are not hashed using an adaptive cryptographic hash function or k…
-
Unscored —
In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host …
-
Unscored —
Private Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical files it should not hav…
-
Unscored —
redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, all…
-
Unscored —
Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an …
-
Unscored —
It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it…
-
Unscored —
It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it…
-
Unscored —
It was discovered that redhat-certification 7 is not properly configured and it lists all files and directories in the …
-
Unscored —
COVID19 Testing Management System 1.0 is vulnerable to SQL Injection via the admin panel.
-
Unscored —
COVID19 Testing Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the "Admin name" parameter.
-
Unscored —
Buffer Overflow vulnerability in FFmpeg 4.2 in mov_write_video_tag due to the out of bounds in libavformat/movenc.c, wh…
-
Medium 6.5
IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injectio…
-
High 8.0
IBM Power9 Self Boot Engine(SBE) could allow a privileged user to inject malicious code and compromise the integrity of…
-
Medium 5.3
IBM Cloud Pak for Data 3.0 could allow an authenticated user to obtain sensitive information when installed with additi…
-
High 7.4
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local u…
-
Unscored —
Cross Site Scripting (XSS) in Typora v0.9.65 and earlier allows remote attackers to execute arbitrary code by injecting…
-
High 7.5
golang.org/x/net/html Infinite Loop vulnerability
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
-
Unscored —
jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrict_room_creation is set by default. This …
-
Unscored —
Buffer Overflow vulnerability in FFMpeg 4.2.3 in dnn_execute_layer_pad in libavfilter/dnn/dnn_backend_native_layer_pad.…
-
Critical 9.8
Prototype pollution vulnerability in js-extend
Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
-
Unscored —CVE-2021-21986 EPSS 13%
The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Ch…
-
Critical 9.8
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtua…
KEV Nov 3, 2021 -
High 7.5
Exposure of sensitive information to an unauthorized actor in HyperKitty
An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty through 1.3.4. When importing a private mailing list's archives, these archives are publicly visible for the duration of the import. For example, sensitive information might be …