Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-27135 | 3 Debian, Fedoraproject, Invisible-island | 3 Debian Linux, Fedora, Xterm | 2022-01-04 | 7.5 HIGH | 9.8 CRITICAL |
| xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence. | |||||
| CVE-2021-3138 | 1 Discourse | 1 Discourse | 2022-01-04 | 5.0 MEDIUM | 7.5 HIGH |
| In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms. | |||||
| CVE-2020-1457 | 1 Microsoft | 1 Windows 10 | 2022-01-04 | 6.8 MEDIUM | 7.8 HIGH |
| A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory, aka 'Microsoft Windows Codecs Library Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1425. | |||||
| CVE-2020-15121 | 2 Fedoraproject, Radare | 2 Fedora, Radare2 | 2022-01-04 | 6.8 MEDIUM | 9.6 CRITICAL |
| In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required to open the executable in radare2 and run idpd to trigger the download. The shell code will execute, and will create a file called pwned in the current directory. | |||||
| CVE-2020-15117 | 2 Fedoraproject, Symless | 2 Fedora, Synergy | 2022-01-04 | 4.0 MEDIUM | 6.5 MEDIUM |
| In Synergy before version 1.12.0, a Synergy server can be crashed by receiving a kMsgHelloBack packet with a client name length set to 0xffffffff (4294967295) if the servers memory is less than 4 GB. It was verified that this issue does not cause a crash through the exception handler if the available memory of the Server is more than 4GB. | |||||
| CVE-2020-16094 | 2 Claws-mail, Fedoraproject | 2 Claws-mail, Fedora | 2022-01-04 | 5.0 MEDIUM | 7.5 HIGH |
| In imap_scan_tree_recursive in Claws Mail through 3.17.6, a malicious IMAP server can trigger stack consumption because of unlimited recursion into subdirectories during a rebuild of the folder tree. | |||||
| CVE-2020-16088 | 1 Openbsd | 1 Openbsd | 2022-01-04 | 7.5 HIGH | 9.8 CRITICAL |
| iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a public key matches. | |||||
| CVE-2021-4118 | 1 Pytorchlightning | 1 Pytorch Lightning | 2022-01-04 | 6.8 MEDIUM | 7.8 HIGH |
| pytorch-lightning is vulnerable to Deserialization of Untrusted Data | |||||
| CVE-2021-24747 | 1 Cleverplugins | 1 Seo Booster | 2022-01-04 | 6.5 MEDIUM | 7.2 HIGH |
| The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX request as the $_REQUEST['order'][0]['dir'] parameter is not properly escaped leading to blind and error-based SQL injections. | |||||
| CVE-2021-29756 | 2 Ibm, Netapp | 2 Cognos Analytics, Oncommand Insight | 2022-01-04 | 6.8 MEDIUM | 8.8 HIGH |
| IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 202167. | |||||
| CVE-2021-20493 | 2 Ibm, Netapp | 2 Cognos Analytics, Oncommand Insight | 2022-01-04 | 4.3 MEDIUM | 6.1 MEDIUM |
| IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 197794. | |||||
| CVE-2021-20470 | 2 Ibm, Netapp | 2 Cognos Analytics, Oncommand Insight | 2022-01-04 | 5.0 MEDIUM | 7.5 HIGH |
| IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 196339. | |||||
| CVE-2021-24646 | 1 Bookingholdings | 1 Booking.com Banner Creator | 2022-01-04 | 3.5 LOW | 4.8 MEDIUM |
| The Booking.com Banner Creator WordPress plugin before 1.4.3 does not properly sanitize inputs when creating banners, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed | |||||
| CVE-2021-24645 | 1 Bookingholdings | 1 Booking.com Product Helper | 2022-01-04 | 3.5 LOW | 4.8 MEDIUM |
| The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed | |||||
| CVE-2021-4048 | 5 Fedoraproject, Julialang, Lapack Project and 2 more | 8 Fedora, Julia, Lapack and 5 more | 2022-01-04 | 6.4 MEDIUM | 9.1 CRITICAL |
| An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory. | |||||
| CVE-2021-41063 | 1 Xylem | 1 Aanderaa Geoview | 2022-01-04 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability was discovered in Aanderaa GeoView Webservice prior to version 2.1.3 that could allow an unauthenticated attackers to execute arbitrary commands. | |||||
| CVE-2021-38909 | 2 Ibm, Netapp | 2 Cognos Analytics, Oncommand Insight | 2022-01-04 | 3.5 LOW | 5.4 MEDIUM |
| IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209706. | |||||
| CVE-2021-40858 | 1 Auerswald | 20 Commander 6000r Ip, Commander 6000r Ip Firmware, Commander 6000rx Ip and 17 more | 2022-01-04 | 6.8 MEDIUM | 4.9 MEDIUM |
| Auerswald COMpact 5500R devices before 8.2B allow Arbitrary File Disclosure. A sub-admin can read the cleartext Admin password via the fileName=../../etc/passwd substring. | |||||
| CVE-2021-3817 | 1 Wbce | 1 Wbce Cms | 2022-01-04 | 7.5 HIGH | 9.8 CRITICAL |
| wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command | |||||
| CVE-2020-35873 | 1 Rusqlite Project | 1 Rusqlite | 2022-01-04 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because sessions.rs has a use-after-free. | |||||
| CVE-2020-35871 | 1 Rusqlite Project | 1 Rusqlite | 2022-01-04 | 6.8 MEDIUM | 8.1 HIGH |
| An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API data race. | |||||
| CVE-2020-35869 | 1 Rusqlite Project | 1 Rusqlite | 2022-01-04 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings. | |||||
| CVE-2021-41028 | 1 Fortinet | 2 Forticlient, Forticlient Endpoint Management Server | 2022-01-04 | 5.4 MEDIUM | 7.5 HIGH |
| A combination of a use of hard-coded cryptographic key vulnerability [CWE-321] in FortiClientEMS 7.0.1 and below, 6.4.6 and below and an improper certificate validation vulnerability [CWE-297] in FortiClientWindows, FortiClientLinux and FortiClientMac 7.0.1 and below, 6.4.6 and below may allow an unauthenticated and network adjacent attacker to perform a man-in-the-middle attack between the EMS and the FCT via the telemetry protocol. | |||||
| CVE-2021-36884 | 1 Backupbliss | 1 Backup Migration | 2022-01-04 | 3.5 LOW | 5.4 MEDIUM |
| Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions. | |||||
| CVE-2020-35872 | 1 Rusqlite Project | 1 Rusqlite | 2022-01-04 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via the repr(Rust) type. | |||||
| CVE-2020-35870 | 1 Rusqlite Project | 1 Rusqlite | 2022-01-04 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API use-after-free. | |||||
| CVE-2020-35868 | 1 Rusqlite Project | 1 Rusqlite | 2022-01-04 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via UnlockNotification. | |||||
| CVE-2020-35867 | 1 Rusqlite Project | 1 Rusqlite | 2022-01-04 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via create_module. | |||||
| CVE-2020-35866 | 1 Rusqlite Project | 1 Rusqlite | 2022-01-04 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via VTab / VTabCursor. | |||||
| CVE-2017-13835 | 1 Apple | 1 Mac Os X | 2022-01-04 | 6.8 MEDIUM | 7.8 HIGH |
| A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS High Sierra 10.13. An application may be able to execute arbitrary code with elevated privileges. | |||||
| CVE-2021-45531 | 1 Netgear | 2 D6220, D6220 Firmware | 2022-01-04 | 6.5 MEDIUM | 8.8 HIGH |
| NETGEAR D6220 devices before 1.0.0.76 are affected by command injection by an authenticated user. | |||||
| CVE-2021-45532 | 1 Netgear | 2 R8000, R8000 Firmware | 2022-01-04 | 4.6 MEDIUM | 7.8 HIGH |
| NETGEAR R8000 devices before 1.0.4.76 are affected by command injection by an authenticated user. | |||||
| CVE-2021-42808 | 2 Microsoft, Thalesgroup | 2 Windows, Sentinel Protection Installer | 2022-01-04 | 7.2 HIGH | 6.7 MEDIUM |
| Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges. | |||||
| CVE-2021-42809 | 2 Microsoft, Thalesgroup | 2 Windows, Sentinel Protection Installer | 2022-01-04 | 6.9 MEDIUM | 7.8 HIGH |
| Improper Access Control of Dynamically-Managed Code Resources (DLL) in Thales Sentinel Protection Installer could allow the execution of arbitrary code. | |||||
| CVE-2020-11988 | 2 Apache, Fedoraproject | 2 Xmlgraphics Commons, Fedora | 2022-01-04 | 6.4 MEDIUM | 8.2 HIGH |
| Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later. | |||||
| CVE-2021-43535 | 2 Debian, Mozilla | 4 Debian Linux, Firefox, Firefox Esr and 1 more | 2022-01-04 | 6.8 MEDIUM | 8.8 HIGH |
| A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 93, Thunderbird < 91.3, and Firefox ESR < 91.3. | |||||
| CVE-2021-43534 | 2 Debian, Mozilla | 4 Debian Linux, Firefox, Firefox Esr and 1 more | 2022-01-04 | 6.8 MEDIUM | 8.8 HIGH |
| Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. | |||||
| CVE-2021-43528 | 1 Mozilla | 1 Thunderbird | 2022-01-04 | 4.3 MEDIUM | 6.5 MEDIUM |
| Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level privileges, but could be used as a stepping stone to further an attack with other vulnerabilities. This vulnerability affects Thunderbird < 91.4.0. | |||||
| CVE-2021-38500 | 1 Mozilla | 3 Firefox, Firefox Esr, Thunderbird | 2022-01-04 | 6.8 MEDIUM | 8.8 HIGH |
| Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.15, Thunderbird < 91.2, Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93. | |||||
| CVE-2021-38496 | 1 Mozilla | 3 Firefox, Firefox Esr, Thunderbird | 2022-01-04 | 6.8 MEDIUM | 8.8 HIGH |
| During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.15, Thunderbird < 91.2, Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93. | |||||
| CVE-2021-45817 | 2022-01-04 | N/A | N/A | ||
| ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-11689. Reason: This candidate is a duplicate of CVE-2018-11689. Notes: All CVE users should reference CVE-2018-11689 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. | |||||
| CVE-2021-40612 | 1 Opmantek | 1 Open-audit | 2022-01-03 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Opmantek Open-AudIT after 3.5.0. Without authentication, a vulnerability in code_igniter/application/controllers/util.php allows an attacker perform command execution without echoes. | |||||
| CVE-2021-45418 | 1 Starcharge | 4 Nova 360 Cabinet, Nova 360 Cabinet Firmware, Titan 180 Premium and 1 more | 2022-01-03 | 6.5 MEDIUM | 8.8 HIGH |
| Certain Starcharge products are vulnerable to Directory Traversal via main.cgi. The affected products include: Nova 360 Cabinet <=1.3.0.0.6 - Fixed: 1.3.0.0.9 and Titan 180 Premium <=1.3.0.0.7b102 - Fixed: Beta1.3.0.1.0. | |||||
| CVE-2021-43804 | 1 Teluu | 1 Pjsip | 2022-01-03 | 7.5 HIGH | 7.3 HIGH |
| PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming RTCP BYE message contains a reason's length, this declared length is not checked against the actual received packet size, potentially resulting in an out-of-bound read access. This issue affects all users that use PJMEDIA and RTCP. A malicious actor can send a RTCP BYE message with an invalid reason length. Users are advised to upgrade as soon as possible. There are no known workarounds. | |||||
| CVE-2021-34426 | 2 Keybase, Microsoft | 2 Keybase, Windows | 2022-01-03 | 7.2 HIGH | 7.8 HIGH |
| A vulnerability was discovered in the Keybase Client for Windows before version 5.6.0 when a user executed the "keybase git lfs-config" command on the command-line. In versions prior to 5.6.0, a malicious actor with write access to a user\'s Git repository could leverage this vulnerability to potentially execute arbitrary Windows commands on a user\'s local system. | |||||
| CVE-2021-34425 | 5 Apple, Google, Linux and 2 more | 6 Iphone Os, Macos, Android and 3 more | 2022-01-03 | 4.0 MEDIUM | 6.1 MEDIUM |
| The Zoom Client for Meetings before version 5.7.3 (for Android, iOS, Linux, macOS, and Windows) contain a server side request forgery vulnerability in the chat\'s "link preview" functionality. In versions prior to 5.7.3, if a user were to enable the chat\'s "link preview" feature, a malicious actor could trick the user into potentially sending arbitrary HTTP GET requests to URLs that the actor cannot reach directly. | |||||
| CVE-2021-45519 | 1 Netgear | 2 Xr1000, Xr1000 Firmware | 2022-01-03 | 6.1 MEDIUM | 6.5 MEDIUM |
| NETGEAR XR1000 devices before 1.0.0.58 are affected by denial of service. | |||||
| CVE-2021-45518 | 1 Netgear | 2 Xr1000, Xr1000 Firmware | 2022-01-03 | 6.1 MEDIUM | 6.5 MEDIUM |
| NETGEAR XR1000 devices before 1.0.0.58 are affected by denial of service. | |||||
| CVE-2021-45517 | 1 Netgear | 2 Xr1000, Xr1000 Firmware | 2022-01-03 | 6.1 MEDIUM | 6.5 MEDIUM |
| NETGEAR XR1000 devices before 1.0.0.58 are affected by denial of service. | |||||
| CVE-2021-45662 | 1 Netgear | 2 R7000, R7000 Firmware | 2022-01-03 | 3.5 LOW | 5.4 MEDIUM |
| NETGEAR R7000 devices before 1.0.9.88 are affected by stored XSS. | |||||