Search
Total
6686 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-36226 | 3 Apple, Debian, Openldap | 4 Mac Os X, Macos, Debian Linux and 1 more | 2021-06-29 | 5.0 MEDIUM | 7.5 HIGH |
| A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service. | |||||
| CVE-2018-19203 | 1 Paessler | 1 Prtg Network Monitor | 2021-06-29 | 5.0 MEDIUM | 7.5 HIGH |
| PRTG Network Monitor before 18.2.41.1652 allows remote unauthenticated attackers to terminate the PRTG Core Server Service via a special HTTP request. | |||||
| CVE-2017-13677 | 2 Broadcom, Symantec | 2 Symantec Proxysg, Advanced Secure Gateway | 2021-06-24 | 5.0 MEDIUM | 7.5 HIGH |
| Denial-of-service (DoS) vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A remote attacker can use crafted HTTP/HTTPS requests to cause denial-of-service through management console application crashes. | |||||
| CVE-2021-23845 | 1 Bosch | 8 B426, B426-cn, B426-cn Firmware and 5 more | 2021-06-24 | 6.8 MEDIUM | 8.8 HIGH |
| This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. This vulnerability was discovered by a security researcher in B426 and found during internal product tests in B426-CN/B429-CN, and B426-M and has been fixed already starting from version 3.08 on, which was released on June 2019. | |||||
| CVE-2017-15567 | 1 Idemia | 2 Mso 1300, Mso 1300 Firmware | 2021-06-23 | 7.2 HIGH | 7.8 HIGH |
| ** DISPUTED ** The certificate import component in IDEMIA (formerly Morpho) MorphoSmart 1300 Series (aka MSO 1300 Series) devices allows local users to obtain a command shell, and consequently gain privileges, via unspecified vectors. NOTE: the vendor disputes this because there is no command shell in the product or in the associated SDK. | |||||
| CVE-2021-26996 | 1 Netapp | 1 E-series Santricity Os Controller | 2021-06-22 | 5.0 MEDIUM | 7.5 HIGH |
| E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to discover system configuration and application information which may aid in crafting more complex attacks. | |||||
| CVE-2021-26995 | 1 Netapp | 1 E-series Santricity Os Controller | 2021-06-22 | 6.5 MEDIUM | 8.8 HIGH |
| E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow privileged attackers to execute arbitrary code. | |||||
| CVE-2021-29706 | 1 Ibm | 1 Aix | 2021-06-22 | 3.6 LOW | 7.1 HIGH |
| IBM AIX 7.1 could allow a non-privileged local user to exploit a vulnerability in the trace facility to expose sensitive information or cause a denial of service. IBM X-Force ID: 200663. | |||||
| CVE-2018-6436 | 1 Broadcom | 1 Fabric Operating System | 2021-06-22 | 7.2 HIGH | 7.8 HIGH |
| A Vulnerability in the firmwaredownload command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to escape the restricted shell and, gain root access. | |||||
| CVE-2018-6437 | 1 Broadcom | 1 Fabric Operating System | 2021-06-22 | 7.2 HIGH | 7.8 HIGH |
| A Vulnerability in the help command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to escape the restricted shell and, gain root access. | |||||
| CVE-2018-6438 | 1 Broadcom | 1 Fabric Operating System | 2021-06-22 | 7.2 HIGH | 7.8 HIGH |
| A Vulnerability in the supportsave command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to escape the restricted shell and, gain root access. | |||||
| CVE-2018-6439 | 1 Broadcom | 1 Fabric Operating System | 2021-06-22 | 7.2 HIGH | 7.8 HIGH |
| A Vulnerability in the configdownload command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to escape the restricted shell and, gain root access. | |||||
| CVE-2018-6442 | 1 Broadcom | 1 Fabric Operating System | 2021-06-22 | 6.5 MEDIUM | 8.8 HIGH |
| A vulnerability in the Brocade Webtools firmware update section of Brocade Fabric OS before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow remote authenticated attackers to execute arbitrary commands. | |||||
| CVE-2018-6441 | 1 Broadcom | 1 Fabric Operating System | 2021-06-22 | 7.2 HIGH | 7.8 HIGH |
| A vulnerability in Secure Shell implementation of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to provide arbitrary environment variables, and bypass the restricted configuration shell. | |||||
| CVE-2018-6435 | 1 Broadcom | 1 Fabric Operating System | 2021-06-22 | 7.2 HIGH | 7.8 HIGH |
| A Vulnerability in the secryptocfg command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to escape the restricted shell and, and gain root access. | |||||
| CVE-2019-19603 | 1 Sqlite | 1 Sqlite | 2021-06-18 | 5.0 MEDIUM | 7.5 HIGH |
| SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash. | |||||
| CVE-2020-27402 | 1 Hindotech | 2 Hk1 Box S905x3, Hk1 Box S905x3 Firmware | 2021-06-17 | 7.2 HIGH | 7.8 HIGH |
| The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to escalate to root using the /system/xbin/su binary via a serial port (UART) connection or using adb. | |||||
| CVE-2017-3156 | 1 Apache | 1 Cxf | 2021-06-16 | 5.0 MEDIUM | 7.5 HIGH |
| The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks. | |||||
| CVE-2021-23392 | 1 Locutus | 1 Locutus | 2021-06-15 | 5.0 MEDIUM | 7.5 HIGH |
| The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function. | |||||
| CVE-2019-17075 | 1 Linux | 1 Linux Kernel | 2021-06-14 | 7.1 HIGH | 7.5 HIGH |
| An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The cxgb4 driver is directly calling dma_map_single (a DMA function) from a stack variable. This could allow an attacker to trigger a Denial of Service, exploitable if this driver is used on an architecture for which this stack/DMA interaction has security relevance. | |||||
| CVE-2019-1241 | 1 Microsoft | 8 Windows 10, Windows 7, Windows 8.1 and 5 more | 2021-06-14 | 9.3 HIGH | 7.8 HIGH |
| A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1240, CVE-2019-1242, CVE-2019-1243, CVE-2019-1246, CVE-2019-1247, CVE-2019-1248, CVE-2019-1249, CVE-2019-1250. | |||||
| CVE-2021-20380 | 1 Ibm | 1 Qradar Advisor With Watson | 2021-06-11 | 5.0 MEDIUM | 7.5 HIGH |
| IBM QRadar Advisor With Watson App 1.1 through 2.5 as used on IBM QRadar SIEM 7.4 could allow a remote user to obtain sensitive information from HTTP requests that could aid in further attacks against the system. IBM X-Force ID: 195712. | |||||
| CVE-2021-31702 | 1 Frontiersoftware | 1 Ichris | 2021-06-09 | 5.0 MEDIUM | 7.5 HIGH |
| Frontier ichris through 5.18 mishandles making a DNS request for the hostname in the HTTP Host header, as demonstrated by submitting 127.0.0.1 multiple times for DoS. | |||||
| CVE-2020-36009 | 1 Obottle Project | 1 Obottle | 2021-06-09 | 5.0 MEDIUM | 7.5 HIGH |
| OBottle 2.0 in \c\g.php contains an arbitrary file download vulnerability. | |||||
| CVE-2020-36008 | 1 Obottle Project | 1 Obottle | 2021-06-09 | 5.5 MEDIUM | 8.1 HIGH |
| OBottle 2.0 in \c\t.php contains an arbitrary file write vulnerability. | |||||
| CVE-2019-4031 | 1 Ibm | 1 Tivoli Workload Scheduler | 2021-06-07 | 7.2 HIGH | 7.8 HIGH |
| IBM Workload Scheduler Distributed 9.2, 9.3, 9.4, and 9.5 contains a vulnerability that could allow a local user to write files as root in the file system, which could allow the attacker to gain root privileges. IBM X-Force ID: 155997. | |||||
| CVE-2019-0215 | 2 Apache, Fedoraproject | 2 Http Server, Fedora | 2021-06-06 | 6.0 MEDIUM | 7.5 HIGH |
| In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions. | |||||
| CVE-2021-20576 | 1 Ibm | 2 Application Gateway, Security Verify Access | 2021-06-04 | 5.0 MEDIUM | 7.5 HIGH |
| IBM Security Verify Access 20.07 could allow a remote attacker to send a specially crafted HTTP GET request that could cause the application to crash. | |||||
| CVE-2021-21205 | 3 Debian, Fedoraproject, Google | 3 Debian Linux, Fedora, Chrome | 2021-06-03 | 5.8 MEDIUM | 8.1 HIGH |
| Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. | |||||
| CVE-2021-33500 | 2 Microsoft, Putty | 2 Windows, Putty | 2021-05-27 | 5.0 MEDIUM | 7.5 HIGH |
| PuTTY before 0.75 on Windows allows remote servers to cause a denial of service (Windows GUI hang) by telling the PuTTY window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. NOTE: the same attack methodology may affect some OS-level GUIs on Linux or other platforms for similar reasons. | |||||
| CVE-2020-27209 | 1 Micro-ecc Project | 1 Micro-ecc | 2021-05-27 | 5.0 MEDIUM | 7.5 HIGH |
| The ECDSA operation of the micro-ecc library 1.0 is vulnerable to simple power analysis attacks which allows an adversary to extract the private ECC key. | |||||
| CVE-2021-24189 | 1 Wp-buy | 1 Captchinoo | 2021-05-26 | 6.5 MEDIUM | 8.8 HIGH |
| Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress plugin before 2.4, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE. | |||||
| CVE-2021-20385 | 1 Ibm | 1 Security Guardium | 2021-05-25 | 9.0 HIGH | 7.2 HIGH |
| IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 195766. | |||||
| CVE-2021-27737 | 1 Apache | 1 Traffic Server | 2021-05-25 | 5.0 MEDIUM | 7.5 HIGH |
| Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin. | |||||
| CVE-2020-27150 | 1 Moxa | 6 Nport Ia5150a, Nport Ia5150a Firmware, Nport Ia5250a and 3 more | 2021-05-24 | 5.0 MEDIUM | 7.5 HIGH |
| In multiple versions of NPort IA5000A Series, the result of exporting a device’s configuration contains the passwords of all users on the system and other sensitive data in the original form if “Pre-shared key” doesn’t set. | |||||
| CVE-2021-32819 | 1 Squirrelly | 1 Squirrelly | 2021-05-20 | 6.8 MEDIUM | 8.8 HIGH |
| Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. There is currently no fix for these issues as of the publication of this CVE. The latest version of squirrelly is currently 8.0.8. For complete details refer to the referenced GHSL-2021-023. | |||||
| CVE-2021-23010 | 1 F5 | 1 Big-ip Application Security Manager | 2021-05-19 | 5.0 MEDIUM | 7.5 HIGH |
| On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and 12.1.x before 12.1.5.3, when the BIG-IP ASM/Advanced WAF system processes WebSocket requests with JSON payloads using the default JSON Content Profile in the ASM Security Policy, the BIG-IP ASM bd process may produce a core file. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |||||
| CVE-2019-19023 | 2 Linuxfoundation, Pivotal | 2 Harbor, Vmware Harbor Registry | 2021-05-19 | 6.5 MEDIUM | 8.8 HIGH |
| Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the Pivotal Platform. | |||||
| CVE-2021-26310 | 1 Jetbrains | 1 Teamcity | 2021-05-19 | 5.0 MEDIUM | 7.5 HIGH |
| In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible. | |||||
| CVE-2020-1108 | 1 Microsoft | 14 .net Core, .net Framework, Powershell and 11 more | 2021-05-18 | 5.0 MEDIUM | 7.5 HIGH |
| A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Core & .NET Framework Denial of Service Vulnerability'. | |||||
| CVE-2021-31899 | 1 Jetbrains | 1 Code With Me | 2021-05-18 | 6.5 MEDIUM | 8.8 HIGH |
| In JetBrains Code With Me bundled to the compatible IDEs before version 2021.1, the client could execute code in read-only mode. | |||||
| CVE-2021-29263 | 1 Jetbrains | 1 Intellij Idea | 2021-05-17 | 4.6 MEDIUM | 7.8 HIGH |
| In JetBrains IntelliJ IDEA 2020.3.3, local code execution was possible because of insufficient checks when getting the project from VCS. | |||||
| CVE-2021-31517 | 1 Trendmicro | 1 Home Network Security | 2021-05-12 | 7.8 HIGH | 7.5 HIGH |
| Trend Micro Home Network Security 6.5.599 and earlier is vulnerable to a file-parsing vulnerability which could allow an attacker to exploit the vulnerability and cause a denial-of-service to the device. This vulnerability is similar, but not identical to CVE-2021-31518. | |||||
| CVE-2020-11858 | 1 Microfocus | 2 Operations Bridge, Operations Bridge Manager | 2021-05-12 | 4.6 MEDIUM | 7.8 HIGH |
| Code execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Bridge (containerized). The vulneravility affects: 1.) Operation Bridge Manager versions: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) versions: 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. The vulnerability could allow local attackers to execute code with escalated privileges. | |||||
| CVE-2020-11853 | 2 Hp, Microfocus | 7 Universal Cmbd Foundation, Application Performance Management, Data Center Automation and 4 more | 2021-05-12 | 6.5 MEDIUM | 8.8 HIGH |
| Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code. | |||||
| CVE-2021-29240 | 1 Codesys | 1 Development System | 2021-05-11 | 6.8 MEDIUM | 7.8 HIGH |
| The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before installation and may be used to install CODESYS packages with malicious content. | |||||
| CVE-2021-28899 | 1 Live555 | 1 Streaming Media | 2021-05-11 | 5.0 MEDIUM | 7.5 HIGH |
| Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubsession subclasses in Networks LIVE555 Streaming Media before 2021.3.16. | |||||
| CVE-2021-31518 | 1 Trendmicro | 1 Home Network Security | 2021-05-11 | 7.8 HIGH | 7.5 HIGH |
| Trend Micro Home Network Security 6.5.599 and earlier is vulnerable to a file-parsing vulnerability which could allow an attacker to exploit the vulnerability and cause a denial-of-service to the device. This vulnerability is similar, but not identical to CVE-2021-31517. | |||||
| CVE-2020-8583 | 1 Netapp | 2 Element Os, Hci | 2021-05-10 | 5.0 MEDIUM | 7.5 HIGH |
| Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an attacker to discover sensitive information by intercepting its transmission within an https session. | |||||
| CVE-2021-25811 | 1 Mercusys | 2 Mercury X18g, Mercury X18g Firmware | 2021-05-08 | 7.8 HIGH | 7.5 HIGH |
| MERCUSYS Mercury X18G 1.0.5 devices allow Denial of service via a crafted value to the POST listen_http_lan parameter. Upon subsequent device restarts after this vulnerability is exploted the device will not be able to access the webserver unless the listen_http_lan parameter to uhttpd.json is manually fixed. | |||||