| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-31179 | Hig | 0.52 | 7.8 | 0.13 | May 11, 2021 | Microsoft Office Remote Code Execution Vulnerability | ||
| CVE-2021-31177 | Hig | 0.51 | 7.8 | 0.03 | May 11, 2021 | Microsoft Office Remote Code Execution Vulnerability | ||
| CVE-2021-31176 | Hig | 0.51 | 7.8 | 0.03 | May 11, 2021 | Microsoft Office Remote Code Execution Vulnerability | ||
| CVE-2021-31175 | Hig | 0.51 | 7.8 | 0.03 | May 11, 2021 | Microsoft Office Remote Code Execution Vulnerability | ||
| CVE-2021-31172 | Hig | 0.46 | 7.1 | 0.02 | May 11, 2021 | Microsoft SharePoint Server Spoofing Vulnerability | ||
| CVE-2021-31170 | Hig | 0.51 | 7.8 | 0.01 | May 11, 2021 | Windows Graphics Component Elevation of Privilege Vulnerability | ||
| CVE-2021-31169 | Hig | 0.51 | 7.8 | 0.01 | May 11, 2021 | Windows Container Manager Service Elevation of Privilege Vulnerability | ||
| CVE-2021-31168 | Hig | 0.51 | 7.8 | 0.01 | May 11, 2021 | Windows Container Manager Service Elevation of Privilege Vulnerability | ||
| CVE-2021-31167 | Hig | 0.51 | 7.8 | 0.01 | May 11, 2021 | Windows Container Manager Service Elevation of Privilege Vulnerability | ||
| CVE-2021-31165 | Hig | 0.51 | 7.8 | 0.01 | May 11, 2021 | Windows Container Manager Service Elevation of Privilege Vulnerability | ||
| CVE-2021-28478 | Hig | 0.50 | 7.6 | 0.02 | May 11, 2021 | Microsoft SharePoint Server Spoofing Vulnerability | ||
| CVE-2021-28474 | Hig | 0.61 | 8.8 | 0.51 | May 11, 2021 | Microsoft SharePoint Server Remote Code Execution Vulnerability | ||
| CVE-2021-28465 | Hig | 0.51 | 7.8 | 0.04 | May 11, 2021 | Web Media Extensions Remote Code Execution Vulnerability | ||
| CVE-2021-28455 | Hig | 0.57 | 8.8 | 0.02 | May 11, 2021 | Microsoft Jet Red Database Engine and Access Connectivity Engine Remote Code Execution Vulnerability | ||
| CVE-2021-27068 | Hig | 0.61 | 8.8 | 0.54 | May 11, 2021 | Visual Studio Remote Code Execution Vulnerability | ||
| CVE-2021-26422 | Hig | 0.47 | 7.2 | 0.02 | May 11, 2021 | Skype for Business and Lync Remote Code Execution Vulnerability | ||
| CVE-2021-26419 | Hig | 0.51 | 7.5 | 0.23 | May 11, 2021 | Scripting Engine Memory Corruption Vulnerability | ||
| CVE-2020-18964 | Hig | 0.57 | 8.8 | 0.01 | May 11, 2021 | Cross Site Request Forgery (CSRF) Vulnerability in ForestBlog latest version via the website Management background, which could let a remote malicious gain privileges. | ||
| CVE-2021-29509 | Hig | 0.49 | 7.5 | 0.02 | May 11, 2021 | Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all… | ||
| CVE-2021-27616 | Hig | 0.51 | 7.8 | 0.00 | May 11, 2021 | Under certain conditions, SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One for SAP HANA, allows an attacker to exploit an insecure temporary backup path and to access information which would otherwise be restricted,… | ||
| CVE-2021-27614 | Hig | 0.46 | 7.1 | 0.00 | May 11, 2021 | SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One on SAP HANA, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application thereby… | ||
| CVE-2021-27613 | Hig | 0.51 | 7.8 | 0.00 | May 11, 2021 | Under certain conditions, SAP Business One Chef cookbook, version - 9.2, 9.3, 10.0, used to install SAP Business One, allows an attacker to exploit an insecure temporary folder for incoming & outgoing payroll data and to access information which would otherwise be restricted,… | ||
| CVE-2021-21656 | Hig | 0.39 | 7.1 | 0.02 | May 11, 2021 | Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | ||
| CVE-2021-21655 | Hig | 0.39 | 7.1 | 0.01 | May 11, 2021 | A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified Perforce server using attacker-specified username and password. | ||
| CVE-2021-21652 | Hig | 0.46 | 7.1 | 0.01 | May 11, 2021 | A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored… | ||
| CVE-2021-31913 | Hig | 0.49 | 7.5 | 0.01 | May 11, 2021 | In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirect_uri were made during GitHub SSO token exchange. | ||
| CVE-2021-31912 | Hig | 0.57 | 8.8 | 0.01 | May 11, 2021 | In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset. | ||
| CVE-2021-31910 | Hig | 0.49 | 7.5 | 0.01 | May 11, 2021 | In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible. | ||
| CVE-2021-31898 | Hig | 0.49 | 7.5 | 0.01 | May 11, 2021 | In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS. | ||
| CVE-2021-30482 | Hig | 0.49 | 7.5 | 0.01 | May 11, 2021 | In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctly | ||
| CVE-2021-31905 | Hig | 0.49 | 7.5 | 0.02 | May 11, 2021 | In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible. | ||
| CVE-2021-31902 | Hig | 0.49 | 7.5 | 0.01 | May 11, 2021 | In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly. | ||
| CVE-2021-31901 | Hig | 0.49 | 7.5 | 0.01 | May 11, 2021 | In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group. | ||
| CVE-2021-31899 | Hig | 0.57 | 8.8 | 0.01 | May 11, 2021 | In JetBrains Code With Me bundled to the compatible IDEs before version 2021.1, the client could execute code in read-only mode. | ||
| CVE-2021-30504 | Hig | 0.49 | 7.5 | 0.02 | May 11, 2021 | In JetBrains IntelliJ IDEA before 2021.1, DoS was possible because of unbounded resource allocation. | ||
| CVE-2021-30006 | Hig | 0.49 | 7.5 | 0.01 | May 11, 2021 | In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure. | ||
| CVE-2021-30005 | Hig | 0.51 | 7.8 | 0.01 | May 11, 2021 | In JetBrains PyCharm before 2020.3.4, local code execution was possible because of insufficient checks when getting the project from VCS. | ||
| CVE-2021-29263 | Hig | 0.51 | 7.8 | 0.00 | May 11, 2021 | In JetBrains IntelliJ IDEA 2020.3.3, local code execution was possible because of insufficient checks when getting the project from VCS. | ||
| CVE-2021-26310 | Hig | 0.49 | 7.5 | 0.02 | May 11, 2021 | In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible. | ||
| CVE-2020-27246 | Hig | 0.57 | 8.8 | 0.01 | May 11, 2021 | An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoComment parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP… | ||
| CVE-2020-27245 | Hig | 0.57 | 8.8 | 0.01 | May 11, 2021 | An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoBuyer parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request… | ||
| CVE-2020-27244 | Hig | 0.57 | 8.8 | 0.01 | May 11, 2021 | An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoCode parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request… | ||
| CVE-2020-27243 | Hig | 0.57 | 8.8 | 0.01 | May 11, 2021 | An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoService parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP… | ||
| CVE-2020-27242 | Hig | 0.57 | 8.8 | 0.01 | May 11, 2021 | An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoLocation parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP… | ||
| CVE-2020-23575 | Hig | 0.52 | 7.5 | 0.36 | May 10, 2021 | A directory traversal vulnerability exists in Kyocera Printer d-COPIA253MF plus. Successful exploitation of this vulnerability could allow an attacker to retrieve or view arbitrary files from the affected server. | ||
| CVE-2021-32399 | Hig | 0.46 | 7.0 | 0.01 | May 10, 2021 | net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller. | ||
| CVE-2020-28600 | Hig | 0.51 | 7.8 | 0.01 | May 10, 2021 | An out-of-bounds write vulnerability exists in the import_stl.cc:import_stl() functionality of Openscad openscad-2020.12-RC2. A specially crafted STL file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. | ||
| CVE-2020-27232 | Hig | 0.57 | 8.8 | 0.01 | May 10, 2021 | An exploitable SQL injection vulnerability exists in ‘manageServiceStocks.jsp’ page of OpenClinic GA 5.173.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. | ||
| CVE-2020-27231 | Hig | 0.57 | 8.8 | 0.01 | May 10, 2021 | A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. The findDistrict parameter in ‘‘patientslist.do’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP… | ||
| CVE-2020-27230 | Hig | 0.57 | 8.8 | 0.01 | May 10, 2021 | A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. The findSector parameter in ‘‘patientslist.do’ page is vulnerable to authenticated SQL injection An attacker can make an authenticated HTTP… |
- risk 0.52cvss 7.8epss 0.13
Microsoft Office Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.03
Microsoft Office Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.03
Microsoft Office Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.03
Microsoft Office Remote Code Execution Vulnerability
- risk 0.46cvss 7.1epss 0.02
Microsoft SharePoint Server Spoofing Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows Graphics Component Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows Container Manager Service Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows Container Manager Service Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows Container Manager Service Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows Container Manager Service Elevation of Privilege Vulnerability
- risk 0.50cvss 7.6epss 0.02
Microsoft SharePoint Server Spoofing Vulnerability
- risk 0.61cvss 8.8epss 0.51
Microsoft SharePoint Server Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.04
Web Media Extensions Remote Code Execution Vulnerability
- risk 0.57cvss 8.8epss 0.02
Microsoft Jet Red Database Engine and Access Connectivity Engine Remote Code Execution Vulnerability
- risk 0.61cvss 8.8epss 0.54
Visual Studio Remote Code Execution Vulnerability
- risk 0.47cvss 7.2epss 0.02
Skype for Business and Lync Remote Code Execution Vulnerability
- risk 0.51cvss 7.5epss 0.23
Scripting Engine Memory Corruption Vulnerability
- risk 0.57cvss 8.8epss 0.01
Cross Site Request Forgery (CSRF) Vulnerability in ForestBlog latest version via the website Management background, which could let a remote malicious gain privileges.
- risk 0.49cvss 7.5epss 0.02
Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all…
- risk 0.51cvss 7.8epss 0.00
Under certain conditions, SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One for SAP HANA, allows an attacker to exploit an insecure temporary backup path and to access information which would otherwise be restricted,…
- risk 0.46cvss 7.1epss 0.00
SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One on SAP HANA, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application thereby…
- risk 0.51cvss 7.8epss 0.00
Under certain conditions, SAP Business One Chef cookbook, version - 9.2, 9.3, 10.0, used to install SAP Business One, allows an attacker to exploit an insecure temporary folder for incoming & outgoing payroll data and to access information which would otherwise be restricted,…
- risk 0.39cvss 7.1epss 0.02
Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- risk 0.39cvss 7.1epss 0.01
A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified Perforce server using attacker-specified username and password.
- risk 0.46cvss 7.1epss 0.01
A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored…
- risk 0.49cvss 7.5epss 0.01
In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirect_uri were made during GitHub SSO token exchange.
- risk 0.57cvss 8.8epss 0.01
In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset.
- risk 0.49cvss 7.5epss 0.01
In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible.
- risk 0.49cvss 7.5epss 0.01
In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS.
- risk 0.49cvss 7.5epss 0.01
In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctly
- risk 0.49cvss 7.5epss 0.02
In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible.
- risk 0.49cvss 7.5epss 0.01
In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly.
- risk 0.49cvss 7.5epss 0.01
In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group.
- risk 0.57cvss 8.8epss 0.01
In JetBrains Code With Me bundled to the compatible IDEs before version 2021.1, the client could execute code in read-only mode.
- risk 0.49cvss 7.5epss 0.02
In JetBrains IntelliJ IDEA before 2021.1, DoS was possible because of unbounded resource allocation.
- risk 0.49cvss 7.5epss 0.01
In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure.
- risk 0.51cvss 7.8epss 0.01
In JetBrains PyCharm before 2020.3.4, local code execution was possible because of insufficient checks when getting the project from VCS.
- risk 0.51cvss 7.8epss 0.00
In JetBrains IntelliJ IDEA 2020.3.3, local code execution was possible because of insufficient checks when getting the project from VCS.
- risk 0.49cvss 7.5epss 0.02
In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible.
- risk 0.57cvss 8.8epss 0.01
An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoComment parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP…
- risk 0.57cvss 8.8epss 0.01
An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoBuyer parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request…
- risk 0.57cvss 8.8epss 0.01
An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoCode parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request…
- risk 0.57cvss 8.8epss 0.01
An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoService parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP…
- risk 0.57cvss 8.8epss 0.01
An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoLocation parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP…
- risk 0.52cvss 7.5epss 0.36
A directory traversal vulnerability exists in Kyocera Printer d-COPIA253MF plus. Successful exploitation of this vulnerability could allow an attacker to retrieve or view arbitrary files from the affected server.
- risk 0.46cvss 7.0epss 0.01
net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller.
- risk 0.51cvss 7.8epss 0.01
An out-of-bounds write vulnerability exists in the import_stl.cc:import_stl() functionality of Openscad openscad-2020.12-RC2. A specially crafted STL file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
- risk 0.57cvss 8.8epss 0.01
An exploitable SQL injection vulnerability exists in ‘manageServiceStocks.jsp’ page of OpenClinic GA 5.173.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- risk 0.57cvss 8.8epss 0.01
A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. The findDistrict parameter in ‘‘patientslist.do’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP…
- risk 0.57cvss 8.8epss 0.01
A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. The findSector parameter in ‘‘patientslist.do’ page is vulnerable to authenticated SQL injection An attacker can make an authenticated HTTP…