CVEs published in February 2021
1,593 vulnerabilities, 240 critical, 19 exploited.
- apple macos, mac os x, debian linux +2 moreAn input validation issue was addressed with improved memory handling. This issue is fixed in...5.5 Medium
- adt lifeshield diy hd video doorbell, lifeshield diy hd video doorbell firmware +1 moreCommand execution due to unsanitized input in LifeShield DIY HD Video Doorbell6.9 Medium
- totaljs total.jsCommand Injection8.6 High
- totaljs total.jsPrototype Pollution7.3 High
java-11-openjdkSUSESecurity update for java-11-openjdkNo scorelinuxUbuntu,linux-hwe-5.4Ubuntu,linux-hwe-5.8Ubuntu +2 morelinux, linux-hwe-5.4, linux-hwe-5.8 regressionNo score- facebook hermesA stack overflow vulnerability in Facebook Hermes ‘builtin apply’ prior to commit...9.8 Critical
- uip project uipAn issue was discovered in uIP through 1.0, as used in Contiki and Contiki-NG. Domain name...7.5 High
- ucopia express wireless applianceUCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with root privileges using...6.7 Medium
- ucopia wireless applianceUCOPIA Wi-Fi appliances 6.0.5 allow authenticated remote attackers to escape the restricted...8.8 High
- ucopia wireless applianceUCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with admin user privileges via an...8.2 High
openscOSS-FuzzHeap-buffer-overflow in sc_pkcs15emu_oberthur_add_dataNo scorefluent-bitOSS-FuzzStack-buffer-overflow in flb_sds_catNo scorelibdatetime-timezone-perlDebianlibdatetime-timezone-perl - new upstream versionNo scoretzdataDebiantzdata - new upstream versionNo score- atlassian crucible, fisheye +1 moreAffected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's...4.3 Medium
- atlassian jira, jira server, jira data center +1 more +3 moreAffected versions of Atlassian Jira Server and Data Center allow remote attackers to view the...4.3 Medium
- fortiloggerFortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png"...9.8 Critical
- wikindx project wikindxA cross-site scripting (XSS) vulnerability in many forms of Wikindx before 5.7.0 and 6.x through...6.1 Medium
- tk-star q90 junior gps horloge firmwareAn issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices....9.8 Critical
- tk-star q90 junior gps horloge, q90 junior gps horloge firmware +1 moreAn issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. Any SIM card...6.8 Medium
- tk-star q90 junior gps horloge firmwareAn issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. When using the...7.8 High
- tk-star q90 junior gps horloge firmwareAn issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It performs...7.5 High
- palletsprojects jinja, fedoraproject fedora +1 moreRegular Expression Denial of Service (ReDoS)5.3 Medium
- yccmsUnrestricted file upload vulnerability in the yccms 3.3 project. The xhUp function's improper...9.8 Critical
- yccmsSql injection vulnerability in the yccms 3.3 project. The no_top function's improper judgment of...9.8 Critical
- yccmsDirectory traversal vulnerability in the yccms 3.3 project. The delete, deletesite, and deleteAll...7.5 High
- cmswingAn issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not...9.8 Critical
- cmswingAn issue was found in CMSWing project version 1.3.8. Because the updateAction function does not...9.8 Critical
- cmswingAn issue was found in CMSWing project version 1.3.8. Because the log function does not check the...9.8 Critical
- koa2-blog project koa2-blogSql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious...9.8 Critical
- koa2-blog project koa2-blogSql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious...9.8 Critical
- thinkjsSQL Injection in thinkjs9.8 Critical
- minioServer-Side Request Forgery in MinIO Browser API7.7 High
- hashicorp vaultHashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.5.3 Medium
- hashicorp vaultHashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.5.3 Medium
- hashicorp vaultImproper Authentication in HashiCorp Vault7.5 High
- hashicorp nomadImproper Privilege Management in HashiCorp Nomad7.5 High
- kill-process-on-port project kill-process-on-portCommand Injection7.3 High
- wwbn avideoAuthorization Bypass in AVideo Platform7.7 High
- phpgacl, open-emr openemr +1 moreA cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A...9.6 Critical
- phpgacl, open-emr openemr +1 moreA cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A...9.6 Critical
- bitovi launchpadCommand Injection9.8 Critical
- phpgacl, open-emr openemr +1 moreA cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A...9.6 Critical
- peerigon angular-expressionsAngular Expressions - Remote Code Execution8.5 High
- openhab, openhab openhab-addons +1 moreXXE vulnerability in OpenHAB6.4 Medium
- easycmsA CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index...8.8 High
- asus rt-ax86u firmwareASUS RT-AX86U router firmware below version under 9.0.0.4_386 has a buffer overflow in the...9.8 Critical
- accel-pppVariable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS s…9.8 Critical
- delete account project accountdeleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason...6.1 Medium
- Show moreLoading…