Archive
August 2021
Vulnerabilities first published in this month (UTC), newest first.
2,107 results · Feed
-
Critical 9.1
OpenStack Neutron vulnerable to hardware address impersonation
OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server inst…
-
High 7.5
XML External Entity Injection in PyWPS
An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.
-
Unscored —
An invalid memory access in the decode function in iptc.cpp of Exiv2 0.27.99.0 allows attackers to cause a denial of se…
-
Unscored —
A float point exception in the printLong function in tags_int.cpp of Exiv2 0.27.99.0 allows attackers to cause a denial…
-
Unscored —
Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn_int.cpp which…
-
Unscored —
An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL algorithm param…
-
Unscored —
An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). The calculations perfo…
-
Unscored —
An issue was discovered in Mbed TLS before 2.24.0. The verification of X.509 certificates when matching the expected co…
-
Unscored —
An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is missing zeroi…
-
High 8.5
XStream is vulnerable to a Remote Command Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affec…
KEV Mar 10, 2023 -
Unscored —
The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointe…
-
Unscored —
Canon Oce Print Exec Workgroup 1.3.2 allows XSS via the lang parameter.
-
Unscored —
Canon Oce Print Exec Workgroup 1.3.2 allows Host header injection.
-
Unscored —
In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects…
-
Unscored —
An XSS issue was discovered in ReCaptcha Solver 5.7. A response from Anti-Captcha.com, RuCaptcha.com, 2captcha.com, DEA…
-
Unscored —
In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSyn…
-
Unscored —
In GNOME libzapojit through 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync o…
-
Unscored —
In GNOME evolution-rss through 0.3.96, network-soup.c does not enable TLS certificate verification on the SoupSessionSy…
-
Unscored —
In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupSessionSync o…
-
Unscored —
adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a …
-
High 8.1
A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs X…
-
High 8.1
A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs X…
-
High 8.1
A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs X…
-
Unscored —
A cross site request forgery (CSRF) vulnerability in the configure.html component of Ponzu 0.11.0 allows attackers to c…
-
Unscored —
An arbitrary file write vulnerability in lib/AjaxHandlers/ajaxEditTemplate.php of rConfig 3.9.6 allows attackers to exe…
-
Unscored —
An insecure update feature in the /updater.php component of rConfig 3.9.6 and below allows attackers to execute arbitra…
-
Unscored —
A remote code execution vulnerability in SEOPanel 4.6.0 has been fixed for 4.7.0. This vulnerability allowed for remote…
-
Unscored —
An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability gave attackers t…
-
Unscored —
A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability allowe…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in the /devices.php function inrConfig 3.9.5 has been fixed for versi…
-
Unscored —
An information disclosure vulnerability in rConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed r…
-
Low 3.3
Adobe Media Encoder FLV File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe Media Encoder version 15.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to read arbitrary file system information in the context of …
-
Low 3.3
Adobe Media Encoder MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability
Adobe Media Encoder version 15.2 (and earlier) is affected by an uninitialized pointer vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to read arbitrary file system information in the context …
-
High 7.8
Adobe Media Encoder Memory Corruption Could Lead To Remote Code Execution
Adobe Media Encoder version 15.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the curr…
-
Low 3.3
Adobe Illustrator SVG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe Illustrator version 25.2.3 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires us…
-
High 8.3
Adobe Illustrator improper neutralization of special elements used in an OS command
Adobe Illustrator version 25.2.3 (and earlier) is affected by a potential Command injection vulnerability when chained with a development and debugging tool for JavaScript scripts. An unauthenticated attacker could leverage this vulnerability to achieve arbit…
-
High 7.8
Adobe Illustrator PDF File Parsing Memory Corruption Remote Code Execution Vulnerability
Adobe Illustrator version 25.2.3 (and earlier) is affected by an memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the cur…
-
Low 3.3
Adobe Illustrator PDF File Parsing Use-After-Free Information Disclosure Vulnerability
Adobe Illustrator version 25.2.3 (and earlier) is affected by an Use-after-free vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to read arbitrary file system information in the context of the …
-
Low 3.3
Adobe Photoshop MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability
Adobe Photoshop versions 21.2.9 (and earlier) and 22.4.2 (and earlier) are affected by an Improper input validation vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory…
-
Low 3.3
Adobe Prelude MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability
Adobe Prelude version 10.0 (and earlier) are affected by an uninitialized variable vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of th…