CVEs

130,167 total · page 1918 of 2,604

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	KEV	Published	Description
CVE-2021-22997	—	Hig	0.49	7.5	0.01		Mar 31, 2021	On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of…
CVE-2021-22996	—	Hig	0.49	7.5	0.01		Mar 31, 2021	On all 7.x versions (fixed in 8.0.0), when set up for auto failover, a BIG-IQ Data Collection Device (DCD) cluster member that receives an undisclosed message may cause the corosync process to abort. This behavior may lead to a denial-of-service (DoS) and impact the stability of…
CVE-2021-22993	F5, Inc. Big IP	Hig	0.57	8.8	0.01		Mar 31, 2021	On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, DOM-based XSS on DoS Profile properties page. Note: Software versions which have reached End of Software…
CVE-2021-21975	VMware Vrealize Operations Manager	Hig	0.76	7.5	0.78	KEV	Mar 31, 2021	Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
CVE-2021-29658	Visual Studio Code vscode-rufo	Hig	0.57	8.8	0.01		Mar 31, 2021	The unofficial vscode-rufo extension before 0.0.4 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted workspace folder.
CVE-2021-22995	F5, Inc. BIG-IQ	Hig	0.49	7.5	0.01		Mar 31, 2021	On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not implement any form of authentication with the Corosync daemon. Note: Software versions which have reached End of Software Development (EoSD) are…
CVE-2021-22990	F5, Inc. Big IP	Hig	0.48	7.2	0.09		Mar 31, 2021	On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, on systems with Advanced WAF or BIG-IP ASM provisioned, the Traffic Management User Interface (TMUI), also…
CVE-2021-22988	F5, Inc. Big IP	Hig	0.58	8.8	0.10		Mar 31, 2021	On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability…
CVE-2021-28245	Pbootcmspro Pbootcms	Hig	0.49	7.5	0.01		Mar 31, 2021	PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensitive information through adding an admin account.
CVE-2021-23988	Mozilla Corporation Firefox	Hig	0.57	8.8	0.01		Mar 31, 2021	Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 87.
CVE-2021-23987	Mozilla Corporation Firefox	Hig	0.57	8.8	0.01		Mar 31, 2021	Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This…
CVE-2021-23981	Mozilla Corporation Firefox	Hig	0.53	8.1	0.01		Mar 31, 2021	A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and…
CVE-2021-21782	Accusoft Imagegear	Hig	0.57	8.8	0.01		Mar 31, 2021	An out-of-bounds write vulnerability exists in the SGI format buffer size processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2021-21776	Accusoft Imagegear	Hig	0.57	8.8	0.01		Mar 31, 2021	An out-of-bounds write vulnerability exists in the SGI Format Buffer Size Processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2021-21773	Accusoft Imagegear	Hig	0.51	7.8	0.01		Mar 31, 2021	An out-of-bounds write vulnerability exists in the TIFF header count-processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2020-28173	Simple College Website Simple College Website	Hig	0.47	7.2	0.03		Mar 31, 2021	Simple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax.php?action=save_settings when uploading a malicious file using the image upload functionality, which is stored in /alumni/admin/assets/uploads/.
CVE-2021-21413	laverdet isolated-vm	Hig	0.45	8.0	0.01		Mar 30, 2021	isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate. Reference…
CVE-2020-24995	FFmpeg Ffmpeg	Hig	0.51	7.8	0.01		Mar 30, 2021	Buffer overflow vulnerability in sniff_channel_order function in aacdec_template.c in ffmpeg 3.1.2, allows attackers to execute arbitrary code (local).
CVE-2021-20502	IBM Jazz Foundation Products	Hig	0.46	7.1	0.02		Mar 30, 2021	IBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 198059.
CVE-2021-20482	IBM Cloud Pak For Automation	Hig	0.46	7.1	0.01		Mar 30, 2021	IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197504.
CVE-2021-27271	Foxitsoftware Reader	Hig	0.51	7.8	0.03		Mar 30, 2021	This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw…
CVE-2021-27270	Foxitsoftware Reader	Hig	0.51	7.8	0.04		Mar 30, 2021	This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw…
CVE-2021-27269	Foxitsoftware Reader	Hig	0.51	7.8	0.03		Mar 30, 2021	This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw…
CVE-2021-27268	Foxitsoftware Reader	Hig	0.51	7.8	0.03		Mar 30, 2021	This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw…
CVE-2021-27267	Foxitsoftware Reader	Hig	0.51	7.8	0.03		Mar 30, 2021	This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw…
CVE-2021-27261	Foxitsoftware Foxit PhantomPDF	Hig	0.51	7.8	0.03		Mar 30, 2021	This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw…
CVE-2020-15075	OpenVPN Connect	Hig	0.46	7.1	0.00		Mar 30, 2021	OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in /tmp.
CVE-2021-21638	Jenkins Project Team Foundation Server	Hig	0.57	8.8	0.01		Mar 30, 2021	A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in…
CVE-2021-21633	Jenkins Project OWASP Dependency-Track Plugin	Hig	0.50	8.8	0.01		Mar 30, 2021	A cross-site request forgery (CSRF) vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins.
CVE-2021-21629	Jenkins Project Build With Parameters	Hig	0.50	8.8	0.01		Mar 30, 2021	A cross-site request forgery (CSRF) vulnerability in Jenkins Build With Parameters Plugin 1.5 and earlier allows attackers to build a project with attacker-specified parameters.
CVE-2021-26919	Apache Druid	Hig	0.53	8.8	0.35		Mar 30, 2021	Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can…
CVE-2021-29376	IrcII ircII	Hig	0.49	7.5	0.02		Mar 30, 2021	ircII before 20210314 allows remote attackers to cause a denial of service (segmentation fault and client crash, disconnecting the victim from an IRC server) via a crafted CTCP UTC message.
CVE-2020-19641	INSMA Wifi Mini Spy 1080P HD Security IP Camera	Hig	0.57	8.8	0.01		Mar 30, 2021	An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. Authenticated attackers with the "Operator" Privilege can gain admin privileges via a crafted request to '/goform/formUserMng'.
CVE-2020-19640	INSMA Wifi Mini Spy 1080P HD Security IP Camera	Hig	0.49	7.5	0.01		Mar 30, 2021	An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. An unauthenticated attacker can reboot the device causing a Denial of Service, via a hidden reboot command to '/media/?action=cmd'.
CVE-2020-19639	INSMA Wifi Mini Spy 1080P HD Security IP Camera	Hig	0.57	8.8	0.01		Mar 30, 2021	Cross Site Request Forgery (CSRF) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B, via all fields to WebUI.
CVE-2021-25162	Arubanetworks Instant	Hig	0.58	8.1	0.26		Mar 30, 2021	A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant…
CVE-2018-1110	Nic Knot Resolver	Hig	0.49	7.5	0.01		Mar 30, 2021	A flaw was found in knot-resolver before version 2.3.0. Malformed DNS messages may cause denial of service.
CVE-2021-25150	Arubanetworks Instant	Hig	0.57	8.8	0.03		Mar 30, 2021	A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x:…
CVE-2021-25146	Arubanetworks Instant	Hig	0.47	7.2	0.03		Mar 30, 2021	A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x:…
CVE-2021-25148	Arubanetworks Instant	Hig	0.53	8.1	0.01		Mar 30, 2021	A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x:…
CVE-2021-27276	Netgear Prosafe Network Management System	Hig	0.52	7.1	0.73		Mar 29, 2021	This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The…
CVE-2021-27275	Netgear Prosafe Network Management System	Hig	0.60	8.3	0.74		Mar 29, 2021	This vulnerability allows remote attackers to disclose sensitive information and delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication…
CVE-2021-27273	Netgear Prosafe Network Management System	Hig	0.62	8.8	0.66		Mar 29, 2021	This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The…
CVE-2021-27272	Netgear Prosafe Network Management System	Hig	0.52	7.1	0.75		Mar 29, 2021	This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The…
CVE-2021-27245	TP-Link Archer A7	Hig	0.53	8.1	0.03		Mar 29, 2021	This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 prior to Archer C7(US)_V5_210125 and Archer A7(US)_V5_200220 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of…
CVE-2021-27243	Parallels Desktop	Hig	0.57	8.8	0.00		Mar 29, 2021	This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific…
CVE-2021-27242	Parallels Desktop	Hig	0.57	8.8	0.00		Mar 29, 2021	This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific…
CVE-2021-27240	SolarWinds Patch Manager	Hig	0.51	7.8	0.00		Mar 29, 2021	This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Patch Manager 2020.2.1. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific…
CVE-2021-27239	Netgear R6700 Firmware	Hig	0.57	8.8	0.01		Mar 29, 2021	This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400 and R6700 firmware version 1.0.4.98 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the upnpd service,…
CVE-2021-28669	Xerox AltaLink B80xx	Hig	0.49	7.5	0.01		Mar 29, 2021	Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 provide the ability to set configuration attributes without administrative rights.

CVE-2021-22997HigMar 31, 2021
risk 0.49cvss 7.5epss 0.01
On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of…
CVE-2021-22996HigMar 31, 2021
risk 0.49cvss 7.5epss 0.01
On all 7.x versions (fixed in 8.0.0), when set up for auto failover, a BIG-IQ Data Collection Device (DCD) cluster member that receives an undisclosed message may cause the corosync process to abort. This behavior may lead to a denial-of-service (DoS) and impact the stability of…
CVE-2021-22993HigMar 31, 2021
F5, Inc.
Big IP
risk 0.57cvss 8.8epss 0.01
On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, DOM-based XSS on DoS Profile properties page. Note: Software versions which have reached End of Software…
CVE-2021-21975HigKEVMar 31, 2021
VMware
Vrealize Operations Manager
risk 0.76cvss 7.5epss 0.78
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
CVE-2021-29658HigMar 31, 2021
Visual Studio Code
vscode-rufo
risk 0.57cvss 8.8epss 0.01
The unofficial vscode-rufo extension before 0.0.4 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted workspace folder.
CVE-2021-22995HigMar 31, 2021
F5, Inc.
BIG-IQ
risk 0.49cvss 7.5epss 0.01
On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not implement any form of authentication with the Corosync daemon. Note: Software versions which have reached End of Software Development (EoSD) are…
CVE-2021-22990HigMar 31, 2021
F5, Inc.
Big IP
risk 0.48cvss 7.2epss 0.09
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, on systems with Advanced WAF or BIG-IP ASM provisioned, the Traffic Management User Interface (TMUI), also…
CVE-2021-22988HigMar 31, 2021
F5, Inc.
Big IP
risk 0.58cvss 8.8epss 0.10
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability…
CVE-2021-28245HigMar 31, 2021
Pbootcmspro
Pbootcms
risk 0.49cvss 7.5epss 0.01
PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensitive information through adding an admin account.
CVE-2021-23988HigMar 31, 2021
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.01
Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 87.
CVE-2021-23987HigMar 31, 2021
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.01
Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This…
CVE-2021-23981HigMar 31, 2021
Mozilla Corporation
Firefox
risk 0.53cvss 8.1epss 0.01
A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and…
CVE-2021-21782HigMar 31, 2021
Accusoft
Imagegear
risk 0.57cvss 8.8epss 0.01
An out-of-bounds write vulnerability exists in the SGI format buffer size processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2021-21776HigMar 31, 2021
Accusoft
Imagegear
risk 0.57cvss 8.8epss 0.01
An out-of-bounds write vulnerability exists in the SGI Format Buffer Size Processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2021-21773HigMar 31, 2021
Accusoft
Imagegear
risk 0.51cvss 7.8epss 0.01
An out-of-bounds write vulnerability exists in the TIFF header count-processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2020-28173HigMar 31, 2021
Simple College Website
Simple College Website
risk 0.47cvss 7.2epss 0.03
Simple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax.php?action=save_settings when uploading a malicious file using the image upload functionality, which is stored in /alumni/admin/assets/uploads/.
CVE-2021-21413HigMar 30, 2021
laverdet
isolated-vm
risk 0.45cvss 8.0epss 0.01
isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate. Reference…
CVE-2020-24995HigMar 30, 2021
FFmpeg
Ffmpeg
risk 0.51cvss 7.8epss 0.01
Buffer overflow vulnerability in sniff_channel_order function in aacdec_template.c in ffmpeg 3.1.2, allows attackers to execute arbitrary code (local).
CVE-2021-20502HigMar 30, 2021
IBM
Jazz Foundation Products
risk 0.46cvss 7.1epss 0.02
IBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 198059.
CVE-2021-20482HigMar 30, 2021
IBM
Cloud Pak For Automation
risk 0.46cvss 7.1epss 0.01
IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197504.
CVE-2021-27271HigMar 30, 2021
Foxitsoftware
Reader
risk 0.51cvss 7.8epss 0.03
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw…
CVE-2021-27270HigMar 30, 2021
Foxitsoftware
Reader
risk 0.51cvss 7.8epss 0.04
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw…
CVE-2021-27269HigMar 30, 2021
Foxitsoftware
Reader
risk 0.51cvss 7.8epss 0.03
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw…
CVE-2021-27268HigMar 30, 2021
Foxitsoftware
Reader
risk 0.51cvss 7.8epss 0.03
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw…
CVE-2021-27267HigMar 30, 2021
Foxitsoftware
Reader
risk 0.51cvss 7.8epss 0.03
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw…
CVE-2021-27261HigMar 30, 2021
Foxitsoftware
Foxit PhantomPDF
risk 0.51cvss 7.8epss 0.03
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw…
CVE-2020-15075HigMar 30, 2021
OpenVPN
Connect
risk 0.46cvss 7.1epss 0.00
OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in /tmp.
CVE-2021-21638HigMar 30, 2021
Jenkins Project
Team Foundation Server
risk 0.57cvss 8.8epss 0.01
A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in…
CVE-2021-21633HigMar 30, 2021
Jenkins Project
OWASP Dependency-Track Plugin
risk 0.50cvss 8.8epss 0.01
A cross-site request forgery (CSRF) vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins.
CVE-2021-21629HigMar 30, 2021
Jenkins Project
Build With Parameters
risk 0.50cvss 8.8epss 0.01
A cross-site request forgery (CSRF) vulnerability in Jenkins Build With Parameters Plugin 1.5 and earlier allows attackers to build a project with attacker-specified parameters.
CVE-2021-26919HigMar 30, 2021
Apache
Druid
risk 0.53cvss 8.8epss 0.35
Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can…
CVE-2021-29376HigMar 30, 2021
IrcII
ircII
risk 0.49cvss 7.5epss 0.02
ircII before 20210314 allows remote attackers to cause a denial of service (segmentation fault and client crash, disconnecting the victim from an IRC server) via a crafted CTCP UTC message.
CVE-2020-19641HigMar 30, 2021
INSMA
Wifi Mini Spy 1080P HD Security IP Camera
risk 0.57cvss 8.8epss 0.01
An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. Authenticated attackers with the "Operator" Privilege can gain admin privileges via a crafted request to '/goform/formUserMng'.
CVE-2020-19640HigMar 30, 2021
INSMA
Wifi Mini Spy 1080P HD Security IP Camera
risk 0.49cvss 7.5epss 0.01
An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. An unauthenticated attacker can reboot the device causing a Denial of Service, via a hidden reboot command to '/media/?action=cmd'.
CVE-2020-19639HigMar 30, 2021
INSMA
Wifi Mini Spy 1080P HD Security IP Camera
risk 0.57cvss 8.8epss 0.01
Cross Site Request Forgery (CSRF) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B, via all fields to WebUI.
CVE-2021-25162HigMar 30, 2021
Arubanetworks
Instant
risk 0.58cvss 8.1epss 0.26
A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant…
CVE-2018-1110HigMar 30, 2021
Nic
Knot Resolver
risk 0.49cvss 7.5epss 0.01
A flaw was found in knot-resolver before version 2.3.0. Malformed DNS messages may cause denial of service.
CVE-2021-25150HigMar 30, 2021
Arubanetworks
Instant
risk 0.57cvss 8.8epss 0.03
A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x:…
CVE-2021-25146HigMar 30, 2021
Arubanetworks
Instant
risk 0.47cvss 7.2epss 0.03
A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x:…
CVE-2021-25148HigMar 30, 2021
Arubanetworks
Instant
risk 0.53cvss 8.1epss 0.01
A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x:…
CVE-2021-27276HigMar 29, 2021
Netgear
Prosafe Network Management System
risk 0.52cvss 7.1epss 0.73
This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The…
CVE-2021-27275HigMar 29, 2021
Netgear
Prosafe Network Management System
risk 0.60cvss 8.3epss 0.74
This vulnerability allows remote attackers to disclose sensitive information and delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication…
CVE-2021-27273HigMar 29, 2021
Netgear
Prosafe Network Management System
risk 0.62cvss 8.8epss 0.66
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The…
CVE-2021-27272HigMar 29, 2021
Netgear
Prosafe Network Management System
risk 0.52cvss 7.1epss 0.75
This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The…
CVE-2021-27245HigMar 29, 2021
TP-Link
Archer A7
risk 0.53cvss 8.1epss 0.03
This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 prior to Archer C7(US)_V5_210125 and Archer A7(US)_V5_200220 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of…
CVE-2021-27243HigMar 29, 2021
Parallels
Desktop
risk 0.57cvss 8.8epss 0.00
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific…
CVE-2021-27242HigMar 29, 2021
Parallels
Desktop
risk 0.57cvss 8.8epss 0.00
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific…
CVE-2021-27240HigMar 29, 2021
SolarWinds
Patch Manager
risk 0.51cvss 7.8epss 0.00
This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Patch Manager 2020.2.1. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific…
CVE-2021-27239HigMar 29, 2021
Netgear
R6700 Firmware
risk 0.57cvss 8.8epss 0.01
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400 and R6700 firmware version 1.0.4.98 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the upnpd service,…
CVE-2021-28669HigMar 29, 2021
Xerox
AltaLink B80xx
risk 0.49cvss 7.5epss 0.01
Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 provide the ability to set configuration attributes without administrative rights.