Archive
May 2021
Vulnerabilities first published in this month (UTC), newest first.
217 results · Clear filters · Feed
-
High 7.5
Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addres…
-
High 8.6
ArcGIS GeoEvent Server has a Directory Traversal security vulnerability.
ArcGIS GeoEvent Server versions 10.8.1 and below has a read-only directory path traversal vulnerability that could allow an unauthenticated, remote attacker to perform directory traversal attacks and read arbitrary files on the system.
-
High 7.1
IBM QRadar SIEM 7.3 and 7.4 may vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A …
-
High 7.5
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to insecure inter-deployment communication. An attacker that is able to compr…
-
High 7.6
Options structure open to XSS if passed unfiltered
Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in …
-
High 7.8
ArcGIS Earth has a File Parsing Directory Traversal Vulnerability
A path traversal vulnerability exists in Esri ArcGIS Earth versions 1.11.0 and below which allows arbitrary file creation on an affected system through crafted input. An attacker could exploit this vulnerability to gain arbitrary code execution under security…
-
High 8.8CVE-2020-13664 Public exploit
Drupal Core Arbitrary PHP code execution vulnerability
Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in…
-
High 7.8
virtualbox: missing sticky bit for /etc/vbox allows local root exploit for members of vboxusers group
A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to root. This issue affects: openSUSE Factory virtualbox version 6.1.20-1.1 and prior versions.
-
High 7.5
Path Traversal in Django
In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
-
High 7.8
Arbitrary code execution in ExifTool
### Impact Arbitrary code execution can occur when running `exiftool` against files with hostile metadata payloads. ### Patches ExifTool has already been patched in version 12.24. exiftool-vendored, which vendors ExifTool, includes this patch in v14.3.0. ### …
-
High 7.5
Vulnerability in the COPY command for large intsets
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis 6.2 before 6.2.3 could be exploited to corrupt the heap and potentially result with remote code execution. …
-
High 8.8
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privil…
KEV Mar 31, 2022 -
High 7.5
Vulnerability in the STRALGO LCS command
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially…
-
High 7.5
Apache Unomi log injection
Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements.
-
High 7.5
CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).
-
High 7.1
Use of Potentially Dangerous Function in mixme
In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability…
-
High 7.5
Double free in algorithmica
An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. There is a double free in merge_sort::merge().