2021

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are

In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the Fet

A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s):

A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform ver

Upload of Code Without Integrity Check vulnerability in firmware archive of Secomea GateManager allows authenticated att

A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform ver

A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Plat

A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Plat

The TOTVS Fluig platform allows path traversal through the parameter "file = .. /" encoded in base64. This affects all v

jpeg-xl v0.3.2 is affected by a heap buffer overflow in /lib/jxl/coeff_order.cc ReadPermutation. When decoding a malicou

An issue was discovered in the quinn crate before 0.7.0 for Rust. It may have invalid memory access for certain versions

An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized m

An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read th

A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rancher allows r

SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing m

An issue was discovered in IdentityModel (aka ScottBrady.IdentityModel) before 1.3.0. The Branca implementation allows a

SonLogger before 6.4.1 is affected by user creation with any user permissions profile (e.g., SuperAdmin). An anonymous u

On Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software r

In ytnef 1.9.3, the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potential

In ytnef 1.9.3, the TNEFSubjectHandler function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and

A possible arbitrary memory overwrite vulnerabilities in quram library version prior to SMR Jan-2021 Release 1 allow arb

An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intended for image uploads

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Missing input validation within the template manager.

An improper access control vulnerability in FortiProxy SSL VPN portal 2.0.0, 1.2.9 and below versions may allow an authe

PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote u

Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software rele

An issue was discovered in AdGuard before 0.105.2. An attacker able to get the user's cookie is able to bruteforce their

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connecti

A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting

A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A sp

In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0

Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files, allowi

An uninitialized pointer may be exploited in Fatek FvDesigner Version 1.5.76 and prior while the application is processi

Fatek FvDesigner Version 1.5.76 and prior is vulnerable to a stack-based buffer overflow while project files are being p

A use after free issue has been identified in Fatek FvDesigner Version 1.5.76 and prior in the way the application proce

Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds read while processing project files, allowin

In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r1

IBM Security Verify Bridge contains hard-coded credentials, such as a password or cryptographic key, which it uses for i

A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calc

Tenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 were found to contain a vulnerability that could allow an

A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an p

A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very li

A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a

A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Sec

An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCAD

markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacke

ThinkAdmin v6 has default administrator credentials, which allows attackers to gain unrestricted administratior dashboar

Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a co

Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a co