Archive
26 May 2021
Vulnerabilities first published on this day (UTC), newest first.
105 results · Feed
-
Unscored —
Trend Micro Home Network Security version 6.6.604 and earlier is vulnerable to an iotcl stack-based buffer overflow vul…
-
Critical 9.8CVE-2021-22160 EPSS 53%
Authentication with JWT allows use of “none”-algorithm
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as…
-
Unscored —CVE-2020-27815 Public exploit
A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set e…
-
Unscored —
A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw…
-
Unscored —
Any user logged in to a vFairs 3.3 virtual conference or event can perform SQL injection with a malicious query to the …
-
Unscored —
In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile informatio…
-
Unscored —
vFairs 3.3 is affected by Insecure Permissions. Any user logged in to a vFairs virtual conference or event can modify a…
-
Unscored —
vFairs 3.3 is affected by Remote Code Execution. Any user logged in to a vFairs virtual conference or event can abuse t…
-
Unscored —
A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrup…
-
Unscored —
A vulnerability was found that the 3scale dev portal does not employ mechanisms for protection against login CSRF. An a…
-
Unscored —
A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading …
-
Unscored —
A vulnerability was found in Linux kernel where non-blocking socket in llcp_sock_connect() leads to leak and eventually…
-
Unscored —
A vulnerability was found in Linux Kernel, where a refcount leak in llcp_sock_connect() causing use-after-free which mi…
-
High 8.7
Improper memory handling in Linux KVM
An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to …
-
Unscored —
A vulnerability was found in Linux Kernel where refcount leak in llcp_sock_bind() causing use-after-free which might le…
-
Unscored —
[20210502] - Core - CSRF in AJAX reordering endpoint
An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint.
-
Unscored —
[20210503] - Core - CSRF in data download endpoints
An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in com_banners and com_sysinfo.
-
Unscored —
[20210501] - Core - Adding HTML to the executable block list of MediaHelper::canUpload
An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors.
-
Medium 5.4
Cross-site scripting in Centreon
Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notific…
-
Medium 5.1
The Tableau integration in RSA Archer 6.4 P1 (6.4.0.1) through 6.9 P2 (6.9.0.2) is affected by an insecure credential s…
-
Medium 5.4
RSA Archer before 6.9 SP1 P1 (6.9.1.1) contains a stored XSS vulnerability. A remote authenticated malicious Archer use…
-
Unscored —
A flaw was found in libcaca. A heap buffer overflow in export.c in function export_tga might lead to memory corruption …
-
Unscored —
Insufficiently Protected Credentials vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior tha…
-
Medium 5.5
Insertion of Sensitive Information into Log File in ansible
A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest t…
-
Medium 5.5
Insertion of Sensitive Information into Log File in ansible
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials.…