Topics

Sort by:
Attacker Value
High

CVE-2021-26897

Disclosure Date: March 11, 2021 (last updated March 19, 2021)
Windows DNS Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26877, CVE-2021-26893, CVE-2021-26894, CVE-2021-26895.
Attacker Value
Very High

Webmin password_change.cgi Command Injection

Disclosure Date: August 16, 2019 (last updated February 28, 2020)
An issue was discovered in Webmin through 1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
23
Attacker Value
Very High

CVE-2020-15867

Disclosure Date: October 16, 2020 (last updated November 09, 2020)
The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in the UI, it could be considered a "Product UI does not Warn User of Unsafe Actions" issue.
Attacker Value
Unknown

CVE-2021-28310

Disclosure Date: April 13, 2021 (last updated April 17, 2021)
Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-27072.
Attacker Value
High

CVE-2021-25646

Disclosure Date: January 29, 2021 (last updated February 02, 2021)
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.
Attacker Value
Very High

CVE-2020-2034 — PAN-OS: OS command injection vulnerability in GlobalProtect por…

Disclosure Date: July 08, 2020 (last updated December 21, 2020)
An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if GlobalProtect portal feature is not enabled. This issue impacts PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; all versions of PAN-OS 8.0 and PAN-OS 7.1. Prisma Access services are not impacted by this vulnerability.
Attacker Value
Unknown

CVE-2019-5591

Disclosure Date: August 14, 2020 (last updated April 13, 2021)
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
Attacker Value
Very Low

CVE-2020-12440

Disclosure Date: May 14, 2020 (last updated May 19, 2020)
** DISPUTED ** NGINX through 1.18.0 allows an HTTP request smuggling attack that can lead to cache poisoning, credential hijacking, or security bypass. NOTE: many third parties dispute the validity of this finding because it represents normal "Connection: keep-alive" behavior.
1
Attacker Value
High

CVE-2021-25281

Disclosure Date: February 27, 2021 (last updated March 06, 2021)
An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.
Attacker Value
Very High

CVE-2020-14144

Disclosure Date: October 16, 2020 (last updated November 09, 2020)
** DISPUTED ** The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states "This is a functionality of the software that is limited to a very limited subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides."