CVEs published in May 2021
2,381 vulnerabilities, 217 critical, 19 exploited.
- 101 project 101Prototype pollution in 1019.8 Critical
- laobancmsCross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by...4.8 Medium
- laobancmsUnrestricted File Upload in LAOBANCMS v2.0 allows remote attackers to upload arbitrary files by...9.8 Critical
- radare radare2, fedoraproject fedora +1 moreIn radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file...5.5 Medium
- moxa nport ia5150a firmware, nport ia5250a firmware, nport ia5450a firmware +2 moreCleartext transmission of sensitive information via Moxa Service in NPort IA5000A series serial...7.5 High
- moxa nport ia5150a firmware, nport ia5250a firmware, nport ia5450a firmware +2 moreThe NPort IA5000A Series devices use Telnet as one of the network device management services....5.9 Medium
- 10web photo gallery by 10web – mobile-friendly image gallery, photo gallery, photo gallery team gallery by 10web – mobile-friendly image gallery +2 morePhoto Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS)6.1 Medium
- moove agency select all categories and taxonomies, change checkbox to radio buttons, mooveagency select all categories and taxonomies\, change checkbox to radio buttons +1 moreSelect All Categories and Taxonomies < 1.3.2 - Reflected Cross-Site Scripting (XSS)6.1 Medium
- moove agency redirect 404 to parentRedirect 404 to Parent < 1.3.1 - Reflected Cross-Site Scripting (XSS)6.1 Medium
- unknown car seller - auto classifieds script, cars-seller-auto-classifieds-script project cars-seller-auto-classifieds-script +1 moreCar Seller - Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection9.8 Critical
- kaswara project kaswara, sayenthemes kaswara modern vc addons +1 moreKaswara Modern VC Addons <= 3.0.1 - Unauthenticated Arbitrary File Upload9.8 Critical
- pickplugins accordionAccordion < 2.2.30 - Authenticated Reflected Cross-Site Scripting (XSS)5.4 Medium
- query solutions redirection for contact form 7Redirection for Contact Form 7 < 2.3.4 - Unprotected AJAX Actions6.3 Medium
- query solutions redirection for contact form 7Redirection for Contact Form 7 < 2.3.4 - Authenticated Arbitrary Post Deletion4.3 Medium
- query solutions redirection for contact form 7Redirection for Contact Form 7 < 2.3.4 - Authenticated PHP Object Injection8.8 High
- query solutions redirection for contact form 7Redirection for Contact Form 7 < 2.3.4 - Authenticated Arbitrary Plugin Installation6.5 Medium
- query solutions redirection for contact form 7Redirection for Contact Form 7 < 2.3.4 - Unauthenticated Arbitrary Nonce Generation7.5 High
- flector rss for yandex turboRSS for Yandex Turbo < 1.30 - Authenticated Stored Cross-Site Scripting (XSS)5.4 Medium
- wp-buy login as user or customer (user switching), login as user or customer \(user switching\) +1 moreLogin as User or Customer (User Switching) < 1.9 - Arbitrary Plugin Installation/Activation via Low Privilege User8.8 High
- wp-buy login protection - limit failed login attempts, login protection – limit failed login attempts +1 moreLogin Protection - Limit Failed Login Attempts < 2.9 - Arbitrary Plugin Installation/Activation via Low Privilege User8.8 High
- wp-buy visitor traffic real time statisticsVisitor Traffic Real Time Statistics < 2.12 - Arbitrary Plugin Installation/Activation via Low Privilege User8.8 High
- sitemap project sitemap, wp-buy tree sitemap (pages, posts & categories list) +1 moreTree Sitemap < 2.9 - Arbitrary Plugin Installation/Activation via Low Privilege User8.8 High
- wp-buy wp maintenance mode & site under construction, wpshopmart coming soon page \& maintenance mode +1 moreWP Maintenance Mode & Site Under Construction < 1.8.2 - Arbitrary Plugin Installation/Activation via Low Privilege User8.8 High
- wp-buy conditional marketing mailer, woocommerce conditional marketing mailer +1 moreWooCommerce Conditional Marketing Mailer < 1.5.2 - Arbitrary Plugin Installation/Activation via Low Privilege User8.8 High
- wp-buy captchinoo, captchinoo, google recaptcha for admin login page +1 moreCaptchinoo, Google recaptcha for admin login page < 2.4 - Arbitrary Plugin Installation/Activation via Low Privilege User8.8 High
- wp-buy wp content copy protection & no right click, wp content copy protection \& no right click +1 moreWP Content Copy Protection & No Right Click < 3.1.5 - Arbitrary Plugin Installation/Activation via Low Privilege User8.8 High
- moxa nport ia5000a series, nport ia5150a firmware, nport ia5250a firmware +1 more +3 moreIn multiple versions of NPort IA5000A Series, the result of exporting a device’s configuration...7.5 High
- moxa nport ia5150a firmware, nport ia5250a firmware, nport ia5450a firmware +2 moreBy exploiting a vulnerability in NPort IA5150A/IA5250A Series before version 1.5, a user with ...6.5 Medium
- kaspersky password managerPassword generator feature in Kaspersky Password Manager was not completely cryptographically...7.5 High
- octopus serverCleartext storage of sensitive information in multiple versions of Octopus Server where in...7.5 High
ibsimSUSESecurity update for ibsimNo score- pulsesecure virtual traffic managerAn HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could...7.5 High
- hexagon intergraph g\!niusHexagon G!nius Auskunftsportal before 5.0.0.0 allows SQL injection via the GiPWorkflow/Service...7.5 High
assimpOSS-FuzzHeap-buffer-overflow in std::__1::char_traits<char>::lengthNo score- squirrellyRemote code execution in squirrelly8.0 High
- flask-caching project flask-cachingDeserialization of Untrusted Data in Flask-Caching9.8 Critical
- piwigoPiwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.9.8 Critical
- bitcoinBitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified...6.5 Medium
- bluespire aurelia frameworkCross-site Scripting in aurelia-framework6.1 Medium
- iliasA local file inclusion vulnerability in ILIAS before 5.3.19, 5.4.10 and 6.0 allows remote...8.8 High
- iliasAn information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote...6.5 Medium
- mercedes-benz hermesAn issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles...5.3 Medium
- mercedes-benz hermesAn issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles...6.3 Medium
- mercedes-benz headunit ntg6 mercedes-benz user experienceAn issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz...2.9 Low
- mercedes-benz headunit ntg6 mercedes-benz user experienceAn issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz...2.9 Low
- ics-cert omron cx-one, omron cx-one, cx-server +2 moreOmron CX-One Versions 4.60 and prior, including CX-Server Versions 5.0.29.0 and prior, are...7.8 High
- mercedes-benz user experienceAn issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz...1.8 Low
- pydantic, fedoraproject fedora +1 moreUse of "infinity" as an input to datetime and date fields causes infinite loop in pydantic3.3 Low
- graphhopperNavigate endpoint is vulnerable to regex injection that may lead to Denial of Service.6.5 Medium
- chamiloadmin/user_import.php in Chamilo 1.11.14 reads XML data without disabling the ability to load...6.5 Medium
- Show moreLoading…