Archive
May 2021
Vulnerabilities first published in this month (UTC), newest first.
1,521 results · Feed
-
Unscored —
A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated u…
-
Unscored —
OPC Foundation UA .NET Standard versions prior to 1.4.365.48 and OPC UA .NET Legacy are vulnerable to an uncontrolled r…
-
Low 3.1
IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failur…
-
Medium 5.3
IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed techn…
-
Medium 5.9
IBM Security Identity Manager 7.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it …
-
Low 3.7
IBM Security Identity Manager 7.0.2 could allow a remote user to enumerate usernames due to a difference of responses f…
-
Medium 5.4
IBM Security Identity Manager 7.0.2 could allow an authenticated user to bypass security and perform actions that they …
-
Medium 5.3
IBM Security Identity Manager 7.0.2 stores user credentials in plain clear text which can be read by an authenticated u…
-
Medium 5.3
IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed techn…
-
Medium 4.0
IBM Spectrum Scale 1.1.1.0 through 1.1.8.4 Transparent Cloud Tiering could allow a remote attacker to obtain sensitive …
-
Medium 4.8
Cross-site Scripting in OpenNMS Horizon
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable t…
-
High 8.8
Cross-Site Request Forgery in OpenNMS Horizon
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable t…
-
Unscored —
Cross Site Scriptiong (XSS) vulnerability exists in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary w…
-
Medium 4.8
Cross-site Scripting in OpenNMS Horizon
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable t…
-
Medium 4.3
Cross-Site Request Forgery in OpenNMS Horizon
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable t…
-
Unscored —
Products with Unified Automation .NET based OPC UA Client/Server SDK Bundle: Versions V3.0.7 and prior (.NET 4.5, 4.0, …
-
Unscored —CVE-2021-3438 Public exploit
A potential buffer overflow in the software drivers for certain HP LaserJet products and Samsung product printers could…
-
Unscored —
Draeger X-Dock Firmware before 03.00.13 has Active Debug Code on a debug port, leading to remote code execution by an a…
-
Unscored —
Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Credentials, leading to remote code execution by an authenticate…
-
Unscored —
The USB firmware update script of homee Brain Cube v2 (2.28.2 and 2.28.4) devices allows an attacker with physical acce…
-
Unscored —
homee Brain Cube v2 (2.28.2 and 2.28.4) devices have sensitive SSH keys within downloadable and unencrypted firmware im…
-
Unscored —
ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure. Due to a bug in …
-
Low 3.8
Cross-site Scripting in Wildfly
A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.
-
Unscored —
A flaw was found in slapi-nis in versions before 0.56.7. A NULL pointer dereference during the parsing of the Binding D…
-
Unscored —
Crate `twoway` deprecated by the author
The commit [`e99b3c7`](https://github.com/bluss/twoway/commit/e99b3c718df1117ad7f54c33f6540c8f46cc17dd) releasing version 0.2.2 explicitly deprecates `twoway` in favour of [`memchr`](https://crates.io/crates/memchr) crate.
-
Unscored —
A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected webserver…
-
Unscored —
A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The webserver of the a…
-
Unscored —
A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected products …
-
Medium 5.1
Timing based private key exposure in Bouncy Castle
Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing i…
-
Unscored —
A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected product’s…
-
Unscored —
A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected applicati…
-
Unscored —
A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected applicati…
-
Unscored —
KonaWiki2 versions prior to 2.2.4 allows a remote attacker to upload arbitrary files via unspecified vectors. If the fi…
-
Unscored —
SQL injection vulnerability in the KonaWiki2 versions prior to 2.2.4 allows remote attackers to execute arbitrary SQL c…
-
Unscored —
mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified v…
-
Unscored —
RFNTPS firmware versions System_01000004 and earlier, and Web_01000004 and earlier allow an attacker on the same networ…
-
Medium 5.7
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or …
-
Medium —
Denial of service (via resource exhaustion) due to improper input validation in third-party identifier endpoint
### Impact Missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. ### Patches The issue is fixed by https://github.com/matrix-org/…
-
High 7.5CVE-2021-29625 Scanner template
XSS in doc_link
Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only excep…
-
Medium 6.5
Lack of protection against cookie tossing attacks in fastify-csrf
fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "her…