2021

models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.

eMPS 9.0.1.923211 on the Central Management of FireEye EX 3500 devices allows remote authenticated users to conduct SQL

eMPS 9.0.1.923211 on FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the

Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile.

Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.

Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data expos

KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus p

A potential security vulnerability has been identified in HPE Superdome Flex server. A denial of service attack can be r

A potential security vulnerability has been identified in HPE iLO Amplifier Pack. The vulnerability could be remotely ex

The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers

VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a

Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path tra

Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.

Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.

Server Side Request Forgery (SSRF) vulnerability in saveUrlAs function in ImagesService.java in sunkaifei FlyCMS version

A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged

In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Acto

Client side code execution in gitlab-vscode-extension v3.15.0 and earlier allows attacker to execute code on user system

A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image

An application error verification vulnerability exists in a component interface of Huawei Smartphone. Local attackers ca

An application bypass mechanism vulnerability exists in a component interface of Huawei Smartphone. Local attackers can

A memory buffer error vulnerability exists in a component interface of Huawei Smartphone. Local attackers may exploit th

A memory buffer error vulnerability exists in a component interface of Huawei Smartphone. Local attackers can exploit th

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon re

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contai

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps director

Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike

An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UP

Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and e

Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and e

A flaw was found in OpenEXR in versions before 3.0.0-beta. A crafted input file supplied by an attacker, that is process

There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp. The decoder static allocator

An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4.3.3 in src/p

Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attacke

Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Man

An issue was discovered in the reorder crate through 2021-02-24 for Rust. swap_index can return uninitialized values if

An issue was discovered in the reorder crate through 2021-02-24 for Rust. swap_index has an out-of-bounds write if an it

An issue was discovered in the through crate through 2021-02-18 for Rust. There is a double free (in through and through

An issue was discovered in the stackvector crate through 2021-02-19 for Rust. There is an out-of-bounds write in StackVe

An issue was discovered in the slice-deque crate through 2021-02-19 for Rust. A double drop can occur in SliceDeque::dra

An issue was discovered in the telemetry crate through 2021-02-17 for Rust. There is a drop of uninitialized memory if a

An issue was discovered in the adtensor crate through 2021-01-11 for Rust. There is a drop of uninitialized memory via t

An issue was discovered in the rocket crate before 0.4.7 for Rust. uri::Formatter can have a use-after-free if a user-pr

An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust. Attackers can read the contents of un

An issue was discovered in the insert_many crate through 2021-01-26 for Rust. Elements may be dropped twice if a .next()

An issue was discovered in the parse_duration crate through 2021-03-18 for Rust. It allows attackers to cause a denial o

An issue was discovered in the arenavec crate through 2021-01-12 for Rust. A double drop can sometimes occur upon a pani

An issue was discovered in the arenavec crate through 2021-01-12 for Rust. A drop of uninitialized memory can sometimes