Archive
May 2021
Vulnerabilities first published in this month (UTC), newest first.
56 results · Clear filters · Feed
-
Critical 10.0
IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This …
-
Critical 9.0
IBM Security Verify Access 20.07 is vulnerable to a stack based buffer overflow, caused by improper bounds checking whi…
-
Critical 9.8
Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)
Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo custom…
-
Critical 9.8
Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter
Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invo…
-
Critical 9.8
Dragonfly contains remote code execution vulnerability
An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because t…
-
Critical 9.8
Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)
Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dub…
-
Critical 9.8
Dubbo Zookeeper does not check serialization id
Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byt…
-
Critical 9.8
Static imports inside dynamically imported modules do not adhere to permission checks
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, modules that are dynamically imported through `import()` or `new Worker` might have been able to bypass network and file system permission che…
-
Critical 10.0
Authentication bypassed with malformed request URI
Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngx_http_auth_request_module with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It …
-
Critical 9.8
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open C…
-
Critical 9.6
keycloak Self Stored Cross-site Scripting vulnerability
A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The h…
-
Critical 9.8
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote …
KEV Apr 11, 2022 -
Critical 9.8
Prototype pollution vulnerability in js-extend
Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtua…
KEV Nov 3, 2021 -
Critical 9.8CVE-2021-22160 EPSS 53%
Authentication with JWT allows use of “none”-algorithm
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as…
-
Critical 9.8
Remote code execution in ruby-jss
The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load during XML document processing.
-
Critical 9.8
Prototype pollution in nconf-toml
Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
deep-defaults vulnerable to prototype pollution
Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.1
XML external entity vulnerability in Jenkins Nuget Plugin
Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Critical 9.0
Possible read out of bounds in dns read
Possible read out of bounds in dns read. Zephyr versions >= 1.14.2, >= 2.3.0 contain Out-of-bounds Read (CWE-125). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mm57-9hqw-qh44
-
Critical 9.1
Server-Side Request Forgery in Feehi CMS
Feehi CMS 2.1.1 is affected by a Server-side request forgery (SSRF) vulnerability. When the user modifies the HTTP Referer header to any url, the server can make a request to it.
-
Critical —
Signature Validation Bypass
### Impact Given a valid SAML Response, an attacker can potentially modify the document, bypassing signature validation in order to pass off the altered document as a signed one. This enables a variety of attacks, including users accessing accounts other than…
-
Critical —
Signature Validation Bypass
### Impact An authentication bypass exists in the [goxmldsig](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7) this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that woul…
-
Critical 9.8
Command Injection in @ronomon/opened
The @ronomon/opened library before 1.5.2 is vulnerable to a command injection vulnerability which would allow a remote attacker to execute commands on the system if the library was used with untrusted input.
-
Critical 9.1
WAGO: PFC200 Access to files outside the home directory
On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges.
-
Critical 9.1
Path Traversal in Dutchcoders transfer.sh
Dutchcoders transfer.sh before 1.2.4 allows Directory Traversal for deleting files.
-
Critical 9.9
Incorrect Permission Assignment for Critical Resource in Plone
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.
-
Critical 9.8CVE-2021-31474 EPSS 94%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Pe…
-
Critical 9.6
Various
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an authenticated RCE via .phar file upload. A php web shell can be uploaded via the Documents & Files upload feature. Som…
-
Critical 9.6
SITEL CAP/PRX hardcoded credentials
SITEL CAP/PRX firmware version 5.2.01 makes use of a hardcoded password. An attacker with access to the device could modify these credentials, leaving the administrators of the device without access.
-
Critical 9.8
Prototype Pollution in deep-override
Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution in 101
Prototype pollution vulnerability in '101' versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8CVE-2021-33026 Public exploit
Deserialization of Untrusted Data in Flask-Caching
The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can c…
-
Critical 9.4
WEIDMUELLER: Accidentally open network port in u-controls and IoT-Gateways
In Weidmüller u-controls and IoT-Gateways in versions up to 1.12.1 a network port intended only for device-internal usage is accidentally accessible via external network interfaces. By exploiting this vulnerability the device may be manipulated or the operati…
-
Critical 10.0
WAGO: Managed Switches: Unauthorized creation of user accounts
In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users.
-
Critical 10.0
Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.…
KEV Mar 31, 2022 -
Critical 9.8
A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All v…
-
Critical 9.8
HTTP Protocol Stack Remote Code Execution Vulnerability
HTTP Protocol Stack Remote Code Execution Vulnerability
KEV Apr 6, 2022 -
Critical 9.9
Windows Hyper-V Remote Code Execution Vulnerability
Windows Hyper-V Remote Code Execution Vulnerability
-
Critical 9.1
Insecure deserialization in Wire
Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer. e.g. using a surrogate on the sender end, an attacker can pass information about a different type for the receiving end. And by doing so …