Archive
May 2021
Vulnerabilities first published in this month (UTC), newest first.
1,521 results · Feed
-
Unscored —
COVID19 Testing Management System 1.0 is vulnerable to SQL Injection via the admin panel.
-
Unscored —
COVID19 Testing Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the "Admin name" parameter.
-
Unscored —
Buffer Overflow vulnerability in FFmpeg 4.2 in mov_write_video_tag due to the out of bounds in libavformat/movenc.c, wh…
-
Medium 6.5
IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injectio…
-
High 8.0
IBM Power9 Self Boot Engine(SBE) could allow a privileged user to inject malicious code and compromise the integrity of…
-
Medium 5.3
IBM Cloud Pak for Data 3.0 could allow an authenticated user to obtain sensitive information when installed with additi…
-
High 7.4
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local u…
-
Unscored —
Cross Site Scripting (XSS) in Typora v0.9.65 and earlier allows remote attackers to execute arbitrary code by injecting…
-
High 7.5
golang.org/x/net/html Infinite Loop vulnerability
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
-
Unscored —
jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrict_room_creation is set by default. This …
-
Unscored —
Buffer Overflow vulnerability in FFMpeg 4.2.3 in dnn_execute_layer_pad in libavfilter/dnn/dnn_backend_native_layer_pad.…
-
Critical 9.8
Prototype pollution vulnerability in js-extend
Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
-
Unscored —CVE-2021-21986 EPSS 13%
The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Ch…
-
Critical 9.8
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtua…
KEV Nov 3, 2021 -
High 7.5
Exposure of sensitive information to an unauthorized actor in HyperKitty
An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty through 1.3.4. When importing a private mailing list's archives, these archives are publicly visible for the duration of the import. For example, sensitive information might be …
-
Unscored —
Trend Micro Home Network Security version 6.6.604 and earlier is vulnerable to an iotcl stack-based buffer overflow vul…
-
Critical 9.8CVE-2021-22160 EPSS 53%
Authentication with JWT allows use of “none”-algorithm
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as…
-
Unscored —CVE-2020-27815 Public exploit
A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set e…
-
Unscored —
A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw…
-
Unscored —
Any user logged in to a vFairs 3.3 virtual conference or event can perform SQL injection with a malicious query to the …
-
Unscored —
In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile informatio…
-
Unscored —
vFairs 3.3 is affected by Insecure Permissions. Any user logged in to a vFairs virtual conference or event can modify a…
-
Unscored —
vFairs 3.3 is affected by Remote Code Execution. Any user logged in to a vFairs virtual conference or event can abuse t…
-
Unscored —
A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrup…
-
Unscored —
A vulnerability was found that the 3scale dev portal does not employ mechanisms for protection against login CSRF. An a…
-
Unscored —
A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading …
-
Unscored —
A vulnerability was found in Linux kernel where non-blocking socket in llcp_sock_connect() leads to leak and eventually…
-
Unscored —
A vulnerability was found in Linux Kernel, where a refcount leak in llcp_sock_connect() causing use-after-free which mi…
-
High 8.7
Improper memory handling in Linux KVM
An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to …
-
Unscored —
A vulnerability was found in Linux Kernel where refcount leak in llcp_sock_bind() causing use-after-free which might le…
-
Unscored —
[20210502] - Core - CSRF in AJAX reordering endpoint
An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint.
-
Unscored —
[20210503] - Core - CSRF in data download endpoints
An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in com_banners and com_sysinfo.
-
Unscored —
[20210501] - Core - Adding HTML to the executable block list of MediaHelper::canUpload
An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors.
-
Medium 5.4
Cross-site scripting in Centreon
Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notific…
-
Medium 5.1
The Tableau integration in RSA Archer 6.4 P1 (6.4.0.1) through 6.9 P2 (6.9.0.2) is affected by an insecure credential s…
-
Medium 5.4
RSA Archer before 6.9 SP1 P1 (6.9.1.1) contains a stored XSS vulnerability. A remote authenticated malicious Archer use…
-
Unscored —
A flaw was found in libcaca. A heap buffer overflow in export.c in function export_tga might lead to memory corruption …
-
Unscored —
Insufficiently Protected Credentials vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior tha…
-
Medium 5.5
Insertion of Sensitive Information into Log File in ansible
A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest t…
-
Medium 5.5
Insertion of Sensitive Information into Log File in ansible
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials.…