Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-27 22:26Z
2021-05-03
2021-05-03 12:15Z
CRIT

CVE-2021-28860 — Adaltas Mixme: This will put the availability of the program at risk causing a potential denial

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-28860

In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS). CVSSv3.1 9.1 (CRITICAL) · EPSS 78th percentile

CWECWE 1321VNDAdaltasTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2021-04-29
2021-04-29 18:15Z
HIGH

CVE-2021-1504 — Cisco Secure_firewall_threat_defense: Multiple vulnerabilities in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-1504

Multiple vulnerabilities in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. These vulnerabilities are due to lack of proper input validation of the HTTPS request. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request to an affected device. A successful exploit could allow the attacker to c CVSSv3.1 8.6 (HIGH) · EPSS 74th percentile

CWECWE 787VNDCiscoTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2021-04-29
2021-04-29 18:15Z
HIGH

CVE-2021-1501 — Cisco Secure_firewall_threat_defense: A vulnerability in the SIP inspection engine of Cisco Adaptive Security Appliance (ASA) Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-1501

A vulnerability in the SIP inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a crash and reload of an affected device, resulting in a denial of service (DoS) condition.The vulnerability is due to a crash that occurs during a hash lookup for a SIP pinhole connection. An attacker could exploit this vulnerability by sending crafted SIP traffic through an CVSSv3.1 8.6 (HIGH) · EPSS 69th percentile

CWECWE 613VNDCiscoVNDSipTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2021-04-29
2021-04-29 18:15Z
HIGH

CVE-2021-1493 — Cisco Secure_firewall_threat_defense: A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-1493

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a buffer overflow on an affected system. The vulnerability is due to insufficient boundary checks for specific data that is provided to the web services interface of an affected system. An attacker could exploit this vulnerability by sending a malicious HTTP request. A success CVSSv3.1 8.5 (HIGH) · EPSS 65th percentile

CWECWE 120VNDCiscoTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2021-04-29
2021-04-29 18:15Z
HIGH

CVE-2021-1445 — Cisco Secure_firewall_threat_defense: Multiple vulnerabilities in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-1445

Multiple vulnerabilities in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. These vulnerabilities are due to lack of proper input validation of the HTTPS request. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request to an affected device. A successful exploit could allow the attacker to c CVSSv3.1 8.6 (HIGH) · EPSS 74th percentile

CWECWE 787VNDCiscoTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2021-04-29
2021-04-29 18:15Z
HIGH

CVE-2021-1402 — Cisco Secure_firewall_threat_defense: A vulnerability in the software-based SSL/TLS message handler of Cisco Firepower Threat Defense (FTD)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-1402

A vulnerability in the software-based SSL/TLS message handler of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient validation of SSL/TLS messages when the device performs software-based SSL decryption. An attacker could exploit this vulnerability by sending a crafted SSL/TLS message through an affecte CVSSv3.1 8.6 (HIGH) · EPSS 70th percentile

CWECWE 20CWECWE 119VNDCiscoTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2021-04-29
2021-04-29 03:15Z
HIGH

CVE-2020-36327 — Bundler Bundler: 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-36327

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product. CVSSv3.1 8.8 (HIGH) · EPSS 93th percentile

VNDMicrosoftVNDFedoraprojectVNDBundlerTYPVulnerability
8.8
CVSS v3.1
96
Edit Score
728 × 90 / responsive · programmatic ad slot
2021-04-23
2021-04-23 18:15Z
CRIT

CVE-2021-22205 — Gitlab Gitlab: An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-22205in the wild

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution. CVSSv3.1 10.0 (CRITICAL) · EPSS 100th percentile

CWECWE 94VNDGitlabTYPVulnerabilitySTAitw exploited
10.0
CVSS v3.1
100
Edit Score
2021-04-23
2021-04-23 17:15Z
CRIT

CVE-2021-22893 — Ivanti Connect_secure: Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-22893in the wild

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild. CVSSv3.1 10.0 (CRITICAL) · EPSS 99th percentile

CWECWE 287CWECWE 416VNDIvantiVNDPulseTYPVulnerabilitySTAitw exploited
10.0
CVSS v3.1
100
Edit Score
2021-04-22
2021-04-22 22:15Z
HIGH

CVE-2021-2316 — Oracle Human_resources_management_system: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-2316

Vulnerability in the Oracle HRMS (France) product of Oracle E-Business Suite (component: French HR). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (France). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HRMS (France) accessible data as well as unauthorized CVSSv3.1 8.1 (HIGH) · EPSS 59th percentile

VNDOracleVNDVulnerabilityTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2021-04-20
2021-04-20 12:15Z
HIGH

CVE-2021-25681 — Adtran Personal_phone_manager: Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-25681

AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed AdTran Personal Phone Manager web servers to be used as DNS redirectors to tunnel arbitrary data over DNS. NOTE: The affected appliances NetVanta 7060 and NetVanta 7100 are considered End of Life and as such this issue will not be patched. CVSSv3.1 7.5 (HIGH) · EPSS 96th percentile

VNDAdtranTYPVulnerability
7.5
CVSS v3.1
92
Edit Score
2021-04-20
2021-04-20 12:15Z
MED

CVE-2021-20023 — Sonicwall Email_security: Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-20023in the wild

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host. CVSSv3.1 4.9 (MEDIUM) · EPSS 99th percentile

CWECWE 22VNDSonicwallTYPVulnerabilitySTAitw exploited
4.9
CVSS v3.1
90
Edit Score
2021-04-14
2021-04-14 15:15Z
CRIT

CVE-2021-27130 — Janobe Online_reviewer_system: Online Reviewer System 1.0 contains a SQL injection vulnerability through authentication bypass, which may

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-27130

Online Reviewer System 1.0 contains a SQL injection vulnerability through authentication bypass, which may lead to a reverse shell upload. CVSSv3.1 9.8 (CRITICAL) · EPSS 68th percentile

CWECWE 89VNDJanobeVNDOnlineTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2021-04-13
2021-04-13 20:15Z
HIGH

CVE-2021-29428 — Gradle Gradle: In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-29428

In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. Gradle builds could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory. This vulnerability impacted builds using precompiled script plugins written in Kotlin DSL and tests for Gradle plugins written using Project CVSSv3.1 8.8 (HIGH) · EPSS 44th percentile

CWECWE 379CWECWE 378VNDQuarkusVNDGradleTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2021-04-13
2021-04-13 07:15Z
MED

CVE-2021-29425 — Apache Commons_io: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-29425

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value. CVSSv3.1 4.8 (MEDIUM) · EPSS 95th percentile

CWECWE 22CWECWE 20VNDApacheTYPVulnerability
4.8
CVSS v3.1
77
Edit Score
2021-04-09
2021-04-09 18:15Z
HIGH

CVE-2021-20022 — Sonicwall Email_security: Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-20022in the wild

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host. CVSSv3.1 7.2 (HIGH) · EPSS 97th percentile

CWECWE 434VNDSonicwallTYPVulnerabilitySTAitw exploited
7.2
CVSS v3.1
91
Edit Score
2021-04-09
2021-04-09 18:15Z
CRIT

CVE-2021-20021 — Sonicwall Email_security: A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-20021in the wild

A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 269VNDSonicwallTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2021-04-09
2021-04-09 13:15Z
HIGH

CVE-2020-21884 — Indionetworks Unibox_u50_firmware: Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-21884

Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace, /list_users, /list_byod?usertype=raduser, /dhcp_leases, /go?rid=202 in which a specially crafted HTTP request may reconfigure the device. CVSSv3.1 8.8 (HIGH) · EPSS 63th percentile

CWECWE 352VNDIndionetworksVNDUniboxTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2021-04-09
2021-04-09 13:15Z
HIGH

CVE-2020-21883 — Indionetworks Unibox_u50_firmware: Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-21883

Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a OS command injection vulnerability in /tools/ping, which can leads to complete device takeover. CVSSv3.1 8.8 (HIGH) · EPSS 92th percentile

CWECWE 78VNDIndionetworksVNDUniboxTYPVulnerability
8.8
CVSS v3.1
96
Edit Score
2021-04-07
2021-04-07 21:15Z
CRIT

CVE-2021-30246 — Kjur Jsrsasign: In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-30246

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack. CVSSv3.1 9.1 (CRITICAL) · EPSS 57th percentile

CWECWE 347VNDKjurTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2021-04-05
2021-04-05 22:15Z
HIGH

CVE-2021-20305 — Nettle_project Nettle: A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-20305

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as wel CVSSv3.1 8.1 (HIGH) · EPSS 76th percentile

CWECWE 787CWECWE 327VNDFedoraprojectVNDNettle ProjectTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2021-03-31
2021-03-31 18:15Z
MED

CVE-2021-21983 — Vmware Cloud_foundation: Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-21983

Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system. CVSSv3.1 6.5 (MEDIUM) · EPSS 99th percentile

VNDVmwareVNDArbitraryTYPVulnerability
6.5
CVSS v3.1
100
Edit Score
2021-03-31
2021-03-31 18:15Z
HIGH

CVE-2021-21975 — Vmware Cloud_foundation: Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-21975in the wild

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials. CVSSv3.1 7.5 (HIGH) · EPSS 100th percentile

CWECWE 918VNDVmwareTYPVulnerabilitySTAitw exploited
7.5
CVSS v3.1
100
Edit Score
2021-03-25
2021-03-25 16:15Z
HIGH

CVE-2021-22659 — Rockwellautomation Micrologix_1400_firmware: Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-22659

Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus packet allowing the attacker to retrieve or modify random values in the register. If successfully exploited, this may lead to a buffer overflow resulting in a denial-of-service condition. The FAULT LED will flash RED and communications may be lost. Recovery from denial-of-service condition requires the fault to be cleared by the user. CVSSv3.1 8.6 (HIGH) · EPSS 72th percentile

CWECWE 120VNDRockwellautomationVNDRockwellTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2021-03-25
2021-03-25 15:15Z
HIGH

CVE-2021-3450 — Openssl Openssl: The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-3450

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates CVSSv3.1 7.4 (HIGH) · EPSS 97th percentile

CWECWE 295VNDOpensslVNDX509 V Flag X509 StrictTYPVulnerability
7.4
CVSS v3.1
93
Edit Score