| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-1674 | Hig | 0.57 | 8.8 | 0.03 | Jan 12, 2021 | Windows Remote Desktop Protocol Core Security Feature Bypass Vulnerability | ||
| CVE-2021-1673 | Hig | 0.57 | 8.8 | 0.03 | Jan 12, 2021 | Remote Procedure Call Runtime Remote Code Execution Vulnerability | ||
| CVE-2021-1672 | Med | 0.36 | 5.5 | 0.01 | Jan 12, 2021 | Windows Projected File System FS Filter Driver Information Disclosure Vulnerability | ||
| CVE-2021-1671 | Hig | 0.57 | 8.8 | 0.03 | Jan 12, 2021 | Remote Procedure Call Runtime Remote Code Execution Vulnerability | ||
| CVE-2021-1670 | Med | 0.36 | 5.5 | 0.01 | Jan 12, 2021 | Windows Projected File System FS Filter Driver Information Disclosure Vulnerability | ||
| CVE-2021-1669 | Hig | 0.57 | 8.8 | 0.03 | Jan 12, 2021 | Windows Remote Desktop Security Feature Bypass Vulnerability | ||
| CVE-2021-1668 | Hig | 0.51 | 7.8 | 0.04 | Jan 12, 2021 | Microsoft DTV-DVD Video Decoder Remote Code Execution Vulnerability | ||
| CVE-2021-1667 | Hig | 0.58 | 8.8 | 0.04 | Jan 12, 2021 | Remote Procedure Call Runtime Remote Code Execution Vulnerability | ||
| CVE-2021-1666 | Hig | 0.57 | 8.8 | 0.03 | Jan 12, 2021 | Remote Procedure Call Runtime Remote Code Execution Vulnerability | ||
| CVE-2021-1665 | Hig | 0.51 | 7.8 | 0.04 | Jan 12, 2021 | GDI+ Remote Code Execution Vulnerability | ||
| CVE-2021-1664 | Hig | 0.57 | 8.8 | 0.03 | Jan 12, 2021 | Remote Procedure Call Runtime Remote Code Execution Vulnerability | ||
| CVE-2021-1663 | Med | 0.36 | 5.5 | 0.01 | Jan 12, 2021 | Windows Projected File System FS Filter Driver Information Disclosure Vulnerability | ||
| CVE-2021-1662 | Hig | 0.51 | 7.8 | 0.01 | Jan 12, 2021 | Windows Event Tracing Elevation of Privilege Vulnerability | ||
| CVE-2021-1661 | Hig | 0.51 | 7.8 | 0.01 | Jan 12, 2021 | Windows Installer Elevation of Privilege Vulnerability | ||
| CVE-2021-1660 | Hig | 0.57 | 8.8 | 0.03 | Jan 12, 2021 | Remote Procedure Call Runtime Remote Code Execution Vulnerability | ||
| CVE-2021-1659 | Hig | 0.51 | 7.8 | 0.01 | Jan 12, 2021 | Windows CSC Service Elevation of Privilege Vulnerability | ||
| CVE-2021-1658 | Hig | 0.57 | 8.8 | 0.03 | Jan 12, 2021 | Remote Procedure Call Runtime Remote Code Execution Vulnerability | ||
| CVE-2021-1657 | Hig | 0.51 | 7.8 | 0.01 | Jan 12, 2021 | Windows Fax Compose Form Remote Code Execution Vulnerability | ||
| CVE-2021-1656 | Med | 0.36 | 5.5 | 0.03 | Jan 12, 2021 | TPM Device Driver Information Disclosure Vulnerability | ||
| CVE-2021-1655 | Hig | 0.51 | 7.8 | 0.01 | Jan 12, 2021 | Windows CSC Service Elevation of Privilege Vulnerability | ||
| CVE-2021-1654 | Hig | 0.51 | 7.8 | 0.01 | Jan 12, 2021 | Windows CSC Service Elevation of Privilege Vulnerability | ||
| CVE-2021-1653 | Hig | 0.51 | 7.8 | 0.01 | Jan 12, 2021 | Windows CSC Service Elevation of Privilege Vulnerability | ||
| CVE-2021-1652 | Hig | 0.51 | 7.8 | 0.01 | Jan 12, 2021 | Windows CSC Service Elevation of Privilege Vulnerability | ||
| CVE-2021-1651 | Hig | 0.51 | 7.8 | 0.01 | Jan 12, 2021 | Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability | ||
| CVE-2021-1650 | Hig | 0.51 | 7.8 | 0.01 | Jan 12, 2021 | Windows Runtime C++ Template Library Elevation of Privilege Vulnerability | ||
| CVE-2021-1649 | Hig | 0.51 | 7.8 | 0.01 | Jan 12, 2021 | Active Template Library Elevation of Privilege Vulnerability | ||
| CVE-2021-1648 | Hig | 0.51 | 7.8 | 0.01 | Jan 12, 2021 | Microsoft splwow64 Elevation of Privilege Vulnerability | ||
| CVE-2021-1647 | Hig | 0.66 | 7.8 | 0.40 | KEV | Jan 12, 2021 | Microsoft Defender Remote Code Execution Vulnerability | |
| CVE-2021-1646 | Med | 0.43 | 6.6 | 0.01 | Jan 12, 2021 | Windows WLAN Service Elevation of Privilege Vulnerability | ||
| CVE-2021-1645 | Med | 0.33 | 5.0 | 0.08 | Jan 12, 2021 | Windows Docker Information Disclosure Vulnerability | ||
| CVE-2021-1644 | Hig | 0.51 | 7.8 | 0.04 | Jan 12, 2021 | HEVC Video Extensions Remote Code Execution Vulnerability | ||
| CVE-2021-1643 | Hig | 0.51 | 7.8 | 0.04 | Jan 12, 2021 | HEVC Video Extensions Remote Code Execution Vulnerability | ||
| CVE-2021-1642 | Hig | 0.51 | 7.8 | 0.01 | Jan 12, 2021 | Windows AppX Deployment Extensions Elevation of Privilege Vulnerability | ||
| CVE-2021-1641 | Med | 0.30 | 4.6 | 0.02 | Jan 12, 2021 | Microsoft SharePoint Server Spoofing Vulnerability | ||
| CVE-2021-1638 | Hig | 0.50 | 7.7 | 0.01 | Jan 12, 2021 | Microsoft is aware of the "Impersonation in the Passkey Entry Protocol" vulnerability. For more information regarding the vulnerability, please see this statement from the Bluetooth SIG. To address the vulnerability, Microsoft has released a software update that… | ||
| CVE-2021-1637 | Med | 0.36 | 5.5 | 0.01 | Jan 12, 2021 | Windows DNS Query Information Disclosure Vulnerability | ||
| CVE-2021-1636 | Hig | 0.58 | 8.8 | 0.07 | Jan 12, 2021 | Microsoft SQL Elevation of Privilege Vulnerability | ||
| CVE-2020-4079 | Hig | 0.43 | 7.7 | 0.01 | Jan 12, 2021 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which… | ||
| CVE-2020-36190 | Med | 0.33 | 6.1 | 0.01 | Jan 12, 2021 | RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms. | ||
| CVE-2021-3133 | Med | 0.42 | 6.5 | 0.01 | Jan 12, 2021 | The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages. | ||
| CVE-2020-13116 | Med | 0.35 | 5.4 | 0.01 | Jan 12, 2021 | OpenText Carbonite Server Backup Portal before 8.8.7 allows XSS by an authenticated user via policy creation. | ||
| CVE-2020-27148 | Hig | 0.46 | 7.1 | 0.01 | Jan 12, 2021 | The TIBCO EBX Add-on for Oracle Hyperion EPM, TIBCO EBX Data Exchange Add-on, and TIBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-ons contain a vulnerability that theoretically allows a low privileged attacker with network access to execute an XML… | ||
| CVE-2021-3129 | Cri | 0.86 | 9.8 | 1.00 | KEV | Jan 12, 2021 | Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2. | |
| CVE-2021-21471 | Med | 0.42 | 6.5 | 0.01 | Jan 12, 2021 | In CLA-Assistant, versions before 2.8.5, due to improper access control an authenticated user could access API endpoints which are not intended to be used by the user. This could impact the integrity of the application. | ||
| CVE-2021-21470 | Med | 0.29 | 4.4 | 0.00 | Jan 12, 2021 | SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privileges to parse malicious XML files which could result in XXE-based attacks in applications that accept… | ||
| CVE-2021-21469 | Hig | 0.49 | 7.5 | 0.01 | Jan 12, 2021 | When security guidelines for SAP NetWeaver Master Data Management running on windows have not been thoroughly reviewed, it might be possible for an external operator to try and set custom paths in the MDS server configuration. When no adequate protection has been enforced on any… | ||
| CVE-2021-21468 | Med | 0.42 | 6.5 | 0.02 | Jan 12, 2021 | The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table. | ||
| CVE-2021-21467 | Med | 0.28 | 4.3 | 0.01 | Jan 12, 2021 | SAP Banking Services (Generic Market Data) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. An unauthorized User is allowed to display restricted Business Partner Generic Market Data (GMD), due to improper… | ||
| CVE-2021-21466 | Hig | 0.57 | 8.8 | 0.03 | Jan 12, 2021 | SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module over the network. Via the function module an attacker can create a malicious… | ||
| CVE-2021-21465 | Cri | 0.65 | 9.9 | 0.04 | Jan 12, 2021 | The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL… |
- risk 0.57cvss 8.8epss 0.03
Windows Remote Desktop Protocol Core Security Feature Bypass Vulnerability
- risk 0.57cvss 8.8epss 0.03
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- risk 0.36cvss 5.5epss 0.01
Windows Projected File System FS Filter Driver Information Disclosure Vulnerability
- risk 0.57cvss 8.8epss 0.03
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- risk 0.36cvss 5.5epss 0.01
Windows Projected File System FS Filter Driver Information Disclosure Vulnerability
- risk 0.57cvss 8.8epss 0.03
Windows Remote Desktop Security Feature Bypass Vulnerability
- risk 0.51cvss 7.8epss 0.04
Microsoft DTV-DVD Video Decoder Remote Code Execution Vulnerability
- risk 0.58cvss 8.8epss 0.04
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- risk 0.57cvss 8.8epss 0.03
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.04
GDI+ Remote Code Execution Vulnerability
- risk 0.57cvss 8.8epss 0.03
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- risk 0.36cvss 5.5epss 0.01
Windows Projected File System FS Filter Driver Information Disclosure Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows Event Tracing Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows Installer Elevation of Privilege Vulnerability
- risk 0.57cvss 8.8epss 0.03
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows CSC Service Elevation of Privilege Vulnerability
- risk 0.57cvss 8.8epss 0.03
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows Fax Compose Form Remote Code Execution Vulnerability
- risk 0.36cvss 5.5epss 0.03
TPM Device Driver Information Disclosure Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows CSC Service Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows CSC Service Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows CSC Service Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows CSC Service Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows Runtime C++ Template Library Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Active Template Library Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Microsoft splwow64 Elevation of Privilege Vulnerability
- risk 0.66cvss 7.8epss 0.40
Microsoft Defender Remote Code Execution Vulnerability
- risk 0.43cvss 6.6epss 0.01
Windows WLAN Service Elevation of Privilege Vulnerability
- risk 0.33cvss 5.0epss 0.08
Windows Docker Information Disclosure Vulnerability
- risk 0.51cvss 7.8epss 0.04
HEVC Video Extensions Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.04
HEVC Video Extensions Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows AppX Deployment Extensions Elevation of Privilege Vulnerability
- risk 0.30cvss 4.6epss 0.02
Microsoft SharePoint Server Spoofing Vulnerability
- risk 0.50cvss 7.7epss 0.01
Microsoft is aware of the "Impersonation in the Passkey Entry Protocol" vulnerability. For more information regarding the vulnerability, please see this statement from the Bluetooth SIG. To address the vulnerability, Microsoft has released a software update that…
- risk 0.36cvss 5.5epss 0.01
Windows DNS Query Information Disclosure Vulnerability
- risk 0.58cvss 8.8epss 0.07
Microsoft SQL Elevation of Privilege Vulnerability
- risk 0.43cvss 7.7epss 0.01
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which…
- risk 0.33cvss 6.1epss 0.01
RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms.
- risk 0.42cvss 6.5epss 0.01
The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages.
- risk 0.35cvss 5.4epss 0.01
OpenText Carbonite Server Backup Portal before 8.8.7 allows XSS by an authenticated user via policy creation.
- risk 0.46cvss 7.1epss 0.01
The TIBCO EBX Add-on for Oracle Hyperion EPM, TIBCO EBX Data Exchange Add-on, and TIBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-ons contain a vulnerability that theoretically allows a low privileged attacker with network access to execute an XML…
- risk 0.86cvss 9.8epss 1.00
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
- risk 0.42cvss 6.5epss 0.01
In CLA-Assistant, versions before 2.8.5, due to improper access control an authenticated user could access API endpoints which are not intended to be used by the user. This could impact the integrity of the application.
- risk 0.29cvss 4.4epss 0.00
SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privileges to parse malicious XML files which could result in XXE-based attacks in applications that accept…
- risk 0.49cvss 7.5epss 0.01
When security guidelines for SAP NetWeaver Master Data Management running on windows have not been thoroughly reviewed, it might be possible for an external operator to try and set custom paths in the MDS server configuration. When no adequate protection has been enforced on any…
- risk 0.42cvss 6.5epss 0.02
The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table.
- risk 0.28cvss 4.3epss 0.01
SAP Banking Services (Generic Market Data) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. An unauthorized User is allowed to display restricted Business Partner Generic Market Data (GMD), due to improper…
- risk 0.57cvss 8.8epss 0.03
SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module over the network. Via the function module an attacker can create a malicious…
- risk 0.65cvss 9.9epss 0.04
The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL…