Archive
May 2021
Vulnerabilities first published in this month (UTC), newest first.
1,521 results · Feed
-
Medium 6.5
Arbitrary redirects under /new endpoint
Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an att…
-
High 8.1
Improper Neutralization of Script-Related HTML Tags in Notes
HedgeDoc is a platform to write and share markdown. HedgeDoc before version 1.8.2 is vulnerable to a cross-site scripting attack using the YAML-metadata of a note. An attacker with write access to a note can embed HTML tags in the Open Graph metadata section …
-
Medium 5.3
IBM Control Center 6.2.0.0 could allow a user to obtain sensitive version information that could be used in further att…
-
Medium 6.5
IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting. This vulnerability allows use…
-
Medium 5.4
IBM Control Center 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja…
-
Medium 4.0
IBM Cloud Pak for Multicloud Management prior to 2.3 allows web pages to be stored locally which can be read by another…
-
Medium 4.3
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5, 6.0.0.0 through 6.0.3.3, and 6.1.0.0 through 6.1.…
-
Unscored —
An issue was discovered in Couchbase Server 6.x through 6.6.1. The Couchbase Server UI is insecurely logging session co…
-
Unscored —CVE-2020-36365 Scanner template
Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication,…
-
Unscored —
An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1. When using the View Engine and Auditing is e…
-
Unscored —
An issue was discovered in Smartstore (aka SmartStoreNET) before 4.1.0. Administration/Controllers/ImportController.cs …
-
Unscored —
An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST AP…
-
Unscored —
In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correct…
-
Unscored —
In the pg_partman (aka PG Partition Manager) extension before 4.5.1 for PostgreSQL, arbitrary code execution can be ach…
-
Unscored —
Persistent cross-site scripting (XSS) in the web interface of Concerto through 2.3.6 allows an unauthenticated remote a…
-
High 8.6CVE-2021-3517 EPSS 17%
Nokogiri contains libxml Out-of-bounds Write vulnerability
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds …
-
Unscored —
A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attack…
-
Unscored —
A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim t…
-
Unscored —
BMC Remedy 9.1SP3 is affected by authenticated code execution. Authenticated users that have the right to create report…
-
Unscored —
BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allow…
-
Unscored —
BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting (XSS). A DOM-based cross-site scripting vulnerability wa…
-
Unscored —
BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can …
-
Unscored —
Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/dot1x proce…
-
Unscored —
Mikrotik RouterOs before 6.47 (stable tree) in the /ram/pckg/advanced-tools/nova/bin/netwatch process. An authenticated…
-
Unscored —
The management system of ZXCDN is impacted by the information leak vulnerability. Attackers can make further analysis a…
-
Unscored —
A mobile phone of ZTE is impacted by improper access control vulnerability. Due to improper permission settings, third-…
-
Unscored —
Buffer access with incorrect length value vulnerability in GOT2000 series GT27 model communication driver versions 01.1…
-
Unscored —
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in th…
-
Unscored —
The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST para…
-
Unscored —
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDas…
-
Unscored —
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTC…
-
Unscored —
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the L…
-
Unscored —
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in th…
-
Unscored —
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in th…
-
Unscored —
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in th…
-
Unscored —
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in th…
-
Unscored —
The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root …
-
Unscored —
In Boostnote 0.12.1, exporting to PDF contains opportunities for XSS attacks.
-
Unscored —
Mikrotik RouterOs stable 6.46.3 suffers from a memory corruption vulnerability in the log process. An authenticated rem…
-
Unscored —
Mikrotik RouterOs stable 6.46.3 suffers from a memory corruption vulnerability in the mactel process. An authenticated …