Archive
May 2021
Vulnerabilities first published in this month (UTC), newest first.
1,521 results · Feed
-
High 7.8
Windows Container Manager Service Elevation of Privilege Vulnerability
Windows Container Manager Service Elevation of Privilege Vulnerability
-
High 7.8
Windows Graphics Component Elevation of Privilege Vulnerability
Windows Graphics Component Elevation of Privilege Vulnerability
-
High 7.8
Windows Container Manager Service Elevation of Privilege Vulnerability
Windows Container Manager Service Elevation of Privilege Vulnerability
-
High 7.8
Windows Container Manager Service Elevation of Privilege Vulnerability
Windows Container Manager Service Elevation of Privilege Vulnerability
-
Critical 9.8
HTTP Protocol Stack Remote Code Execution Vulnerability
HTTP Protocol Stack Remote Code Execution Vulnerability
KEV Apr 6, 2022 -
High 7.8
Windows Container Manager Service Elevation of Privilege Vulnerability
Windows Container Manager Service Elevation of Privilege Vulnerability
-
Medium 5.5
Windows CSC Service Information Disclosure Vulnerability
Windows CSC Service Information Disclosure Vulnerability
-
High 7.6
Microsoft SharePoint Server Spoofing Vulnerability
Microsoft SharePoint Server Spoofing Vulnerability
-
Critical 9.9
Windows Hyper-V Remote Code Execution Vulnerability
Windows Hyper-V Remote Code Execution Vulnerability
-
High 8.8CVE-2021-28474 EPSS 51%
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
-
High 7.8
Web Media Extensions Remote Code Execution Vulnerability
Web Media Extensions Remote Code Execution Vulnerability
-
Medium 6.1
Dynamics Finance and Operations Cross-site Scripting Vulnerability
Dynamics Finance and Operations Cross-site Scripting Vulnerability
-
High 8.8
Microsoft Jet Red Database Engine and Access Connectivity Engine Remote Code Execution Vulnerability
Microsoft Jet Red Database Engine and Access Connectivity Engine Remote Code Execution Vulnerability
-
High 8.8CVE-2021-27068 EPSS 54%
Visual Studio Remote Code Execution Vulnerability
Visual Studio Remote Code Execution Vulnerability
-
High 7.2
Skype for Business and Lync Remote Code Execution Vulnerability
Skype for Business and Lync Remote Code Execution Vulnerability
-
Medium 6.5
Skype for Business and Lync Spoofing Vulnerability
Skype for Business and Lync Spoofing Vulnerability
-
High 7.5CVE-2021-26419 EPSS 23%
Scripting Engine Memory Corruption Vulnerability
Scripting Engine Memory Corruption Vulnerability
-
Medium 4.6
Microsoft SharePoint Server Spoofing Vulnerability
Microsoft SharePoint Server Spoofing Vulnerability
-
Unscored —
Cross Site Request Forgery (CSRF) Vulnerability in ForestBlog latest version via the website Management background, whi…
-
High 7.5
Keepalive Connections Causing Denial Of Service in puma
Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections…
-
Unscored —
The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin) via a user input field for prod…
-
Critical 9.1
Insecure deserialization in Wire
Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer. e.g. using a surrogate on the sender end, an attacker can pass information about a different type for the receiving end. And by doing so …
-
Medium 4.3
IBM OpenPages GRC Platform 8.1 could allow a remote attacker to obtain sensitive information when a detailed technical …
-
Medium 5.4
IBM OpenPages GRC Platform 8.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrar…
-
Low 3.7
Denial of service in Matrix Synapse
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, i…
-
Unscored —
Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /ram/pckg/wireless/no…
-
Unscored —
Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/resolver pr…
-
Low 3.4
In specific situations SAP GUI for Windows until and including 7.60 PL9, 7.70 PL0, forwards a user to specific maliciou…
-
High 8.2
SAP NetWeaver AS ABAP, versions - 700, 701, 702, 730, 731, allow a high privileged attacker to inject malicious code by…
-
Medium 6.5
SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for a…
-
High 7.8
Under certain conditions, SAP Business One Chef cookbook, version - 9.2, 9.3, 10.0, used to install SAP Business One, a…
-
Medium 4.9
The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does …
-
High 7.3
SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One on SAP…
-
Medium 4.9
The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does …
-
High 7.8
Under certain conditions, SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to insta…
-
High 7.1
Cross-Site Request Forgery in Jenkins P4 Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified Perforce server using attacker-specified username and password.
-
High 7.1
XML external entity (XXE) attacks in Jenkins Xcode integration Plugin
Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Medium 4.3
Missing Authorization in Jenkins P4 plugin
Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password.
-
High 7.1
CSRF vulnerability in Jenkins Xray - Test Management for Jira Plugin allows capturing credentials
A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing …
-
Medium 4.3
Missing Authorization in jenkins xray-connector
Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.