Archive
28 May 2021
Vulnerabilities first published on this day (UTC), newest first.
65 results · Feed
-
Unscored —
An exposed remote debugging port in Naver Comic Viewer prior to 1.0.15.0 allowed a remote attacker to execute arbitrary…
-
Unscored —
There is a flaw reported in the Linux kernel in versions before 5.9 in drivers/gpu/drm/nouveau/nouveau_sgdma.c in nouve…
-
Medium 6.5
Kiali Authentication Bypass vulnerability
An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used. When RBAC is enabled, Kiali assumes that some of the token validation is handled by the underlying cluster. When OpenID `imp…
-
Unscored —
A flaw was found in gdk-pixbuf in versions before 2.42.0. An integer wraparound leading to an out of bounds write can o…
-
Unscored —
A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an attacker with a…
-
Unscored —
An uncontrolled resource consumption (memory leak) flaw was found in ZeroMQ's src/xpub.cpp in versions before 4.3.3. Th…
-
Unscored —
A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack bu…
-
Unscored —
A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a d…
-
Critical 9.6
keycloak Self Stored Cross-site Scripting vulnerability
A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The h…
-
Unscored —
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0…
-
Unscored —
A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.…
-
Unscored —
A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0. This flaw all…
-
Unscored —
A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Valida…
-
High 8.8
Authentication Bypass in keycloak
A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular applicati…
-
Unscored —
A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scr…
-
Unscored —
A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet proce…
-
Medium 6.5
SysJust CTS Web - Broken Authentication
The CTS Web transaction system related to authentication management is implemented incorrectly. After login, remote attackers can manipulate cookies to access other accounts and trade in the stock market with spoofed identity.
-
Medium 5.3
SysJust CTS Web - Broken Access Control
The CTS Web transaction system related to authentication and session management is implemented incorrectly, which allows remote unauthenticated attackers can send a large number of valid usernames, and force those logged-in account to log out, causing the use…
-
Medium 4.7
SysJust CTS Web - Reflected XSS
The parameters of the specific functions in the CTS Web trading system do not filter special characters, which allows unauthenticated attackers can remotely perform reflected XSS and obtain the users’ connection token that triggered the attack.
-
Medium 5.4
Hundred Plus 101EIP - Stored XSS-2
Add announcement function in the 101EIP system does not filter special characters, which allows authenticated users to inject JavaScript and perform a stored XSS attack.
-
Medium 5.4
Hundred Plus 101EIP - Stored XSS-1
Add event in calendar function in the 101EIP system does not filter special characters in specific fields, which allows remote authenticated users to inject JavaScript and perform a stored XSS attack.
-
High 7.5
Uncontrolled Resource Consumption in trim-newlines
The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
-
High 7.5
Denial of service in css-what
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
-
Medium 6.5CVE-2021-33620 EPSS 80%
Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to al…
-
Unscored —
When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer dereference using a sp…