Total
22706 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-3616 | 2 Intel, Siemens | 23 Converged Security Management Engine Firmware, Simatic Field Pg M5, Simatic Field Pg M5 Firmware and 20 more | 2021-05-26 | 4.3 MEDIUM | 5.9 MEDIUM |
| Bleichenbacher-style side channel vulnerability in TLS implementation in Intel Active Management Technology before 12.0.5 may allow an unauthenticated user to potentially obtain the TLS session key via the network. | |||||
| CVE-2021-2177 | 1 Oracle | 1 Secure Global Desktop | 2021-05-26 | 7.5 HIGH | 10.0 CRITICAL |
| Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Gateway). The supported version that is affected is 5.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Secure Global Desktop. While the vulnerability is in Oracle Secure Global Desktop, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Secure Global Desktop. | |||||
| CVE-2017-8031 | 1 Cloudfoundry | 2 Cf-release, Uaa-release | 2021-05-25 | 3.5 LOW | 5.3 MEDIUM |
| An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1). In some cases, the UAA allows an authenticated user for a particular client to revoke client tokens for other users on the same client. This occurs only if the client is using opaque tokens or JWT tokens validated using the check_token endpoint. A malicious actor could cause denial of service. | |||||
| CVE-2017-14389 | 1 Cloudfoundry | 3 Capi-release, Cf-deployment, Cf-release | 2021-05-25 | 4.0 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf-release (all versions prior to v280), and cf-deployment (all versions prior to v1.0.0). The Cloud Controller does not prevent space developers from creating subdomains to an already existing route that belongs to a different user in a different org and space, aka an "Application Subdomain Takeover." | |||||
| CVE-2021-20385 | 1 Ibm | 1 Security Guardium | 2021-05-25 | 9.0 HIGH | 7.2 HIGH |
| IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 195766. | |||||
| CVE-2021-27737 | 1 Apache | 1 Traffic Server | 2021-05-25 | 5.0 MEDIUM | 7.5 HIGH |
| Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin. | |||||
| CVE-2021-29692 | 4 Ibm, Linux, Microsoft and 1 more | 5 Aix, Security Identity Manager, Linux Kernel and 2 more | 2021-05-24 | 4.3 MEDIUM | 5.9 MEDIUM |
| IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 200253. | |||||
| CVE-2021-29041 | 1 Liferay | 1 Dxp | 2021-05-24 | 4.0 MEDIUM | 6.5 MEDIUM |
| Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by (1) enabling Time-based One-time password (TOTP) on behalf of the other user or (2) modifying the other user's TOTP shared secret. | |||||
| CVE-2020-27150 | 1 Moxa | 6 Nport Ia5150a, Nport Ia5150a Firmware, Nport Ia5250a and 3 more | 2021-05-24 | 5.0 MEDIUM | 7.5 HIGH |
| In multiple versions of NPort IA5000A Series, the result of exporting a device’s configuration contains the passwords of all users on the system and other sensitive data in the original form if “Pre-shared key” doesn’t set. | |||||
| CVE-2021-23016 | 1 F5 | 1 Big-ip Access Policy Manager | 2021-05-24 | 5.0 MEDIUM | 5.3 MEDIUM |
| On BIG-IP APM versions 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, and all versions of 16.0.x, 12.1.x, and 11.6.x, an attacker may be able to bypass APM's internal restrictions and retrieve static content that is hosted within APM by sending specifically crafted requests to an APM Virtual Server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |||||
| CVE-2020-27149 | 1 Moxa | 6 Nport Ia5150a, Nport Ia5150a Firmware, Nport Ia5250a and 3 more | 2021-05-21 | 4.0 MEDIUM | 6.5 MEDIUM |
| By exploiting a vulnerability in NPort IA5150A/IA5250A Series before version 1.5, a user with “Read Only” privilege level can send requests via the web console to have the device’s configuration changed. | |||||
| CVE-2018-11797 | 3 Apache, Fedoraproject, Oracle | 3 Pdfbox, Fedora, Retail Xstore Point Of Service | 2021-05-21 | 4.3 MEDIUM | 5.5 MEDIUM |
| In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree. | |||||
| CVE-2020-23691 | 1 Yfcmf | 1 Yfcmf | 2021-05-21 | 7.5 HIGH | 9.8 CRITICAL |
| YFCMF v2.3.1 has a Remote Command Execution (RCE) vulnerability in the index.php. | |||||
| CVE-2021-26583 | 1 Hp | 1 Ilo Amplifier Pack | 2021-05-21 | 7.5 HIGH | 9.8 CRITICAL |
| A potential security vulnerability was identified in HPE iLO Amplifier Pack. The vulnerabilities could be remotely exploited to allow remote code execution. | |||||
| CVE-2021-32819 | 1 Squirrelly | 1 Squirrelly | 2021-05-20 | 6.8 MEDIUM | 8.8 HIGH |
| Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. There is currently no fix for these issues as of the publication of this CVE. The latest version of squirrelly is currently 8.0.8. For complete details refer to the referenced GHSL-2021-023. | |||||
| CVE-2021-31936 | 1 Microsoft | 1 Accessibility Insights For Web | 2021-05-19 | 4.3 MEDIUM | 6.5 MEDIUM |
| Microsoft Accessibility Insights for Web Information Disclosure Vulnerability | |||||
| CVE-2021-23010 | 1 F5 | 1 Big-ip Application Security Manager | 2021-05-19 | 5.0 MEDIUM | 7.5 HIGH |
| On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and 12.1.x before 12.1.5.3, when the BIG-IP ASM/Advanced WAF system processes WebSocket requests with JSON payloads using the default JSON Content Profile in the ASM Security Policy, the BIG-IP ASM bd process may produce a core file. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |||||
| CVE-2019-19023 | 2 Linuxfoundation, Pivotal | 2 Harbor, Vmware Harbor Registry | 2021-05-19 | 6.5 MEDIUM | 8.8 HIGH |
| Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the Pivotal Platform. | |||||
| CVE-2021-31897 | 1 Jetbrains | 1 Webstorm | 2021-05-19 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects. | |||||
| CVE-2021-26310 | 1 Jetbrains | 1 Teamcity | 2021-05-19 | 5.0 MEDIUM | 7.5 HIGH |
| In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible. | |||||