Low-severity CVEs (page 82)
Page 82 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-38365 | Low | 3.7 | 2021-08-10 | Winner (aka ToneWinner) desktop speakers through 2021-08-09 allow remote attackers to recover speech signals from the power-indicator LED via a telescope and a… |
CVE-2021-33738 | Low | 3.3 | 2021-08-10 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.2), Teamcenter Visualization (All versions < V13.2.0.2). The plmxmlAdapterSE70.dll library… |
CVE-2021-21740 | Low | 2.4 | 2021-08-09 | There is an information leak vulnerability in the digital media player (DMS) of ZTE's residential gateway product. The attacker could insert the USB disk with… |
CVE-2021-38209 | Low | 3.3 | 2021-08-08 | net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked i… |
CVE-2021-38205 | Low | 3.3 | 2021-08-08 | drivers/net/ethernet/xilinx/xilinx_emaclite.c in the Linux kernel before 5.13.3 makes it easier for attackers to defeat an ASLR protection mechanism because it… |
CVE-2021-3655 | Low | 3.3 | 2021-08-05 | A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uni… |
CVE-2021-22924 | Low | 3.7 | 2021-08-05 | libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, t… |
CVE-2021-33597 | Low | 3.5 | 2021-08-05 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the SAVAPI component used in certain F-Secure products can crash while scanni… |
CVE-2021-33596 | Low | 3.5 | 2021-08-05 | Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit do… |
CVE-2021-32787 | Low | 3.1 | 2021-08-02 | Sourcegraph is a code search and navigation engine. Sourcegraph before version 3.30.0 has two potential information leaks. The site-admin area can be accessed… |
CVE-2021-24371 | Low | 2.7 | 2021-08-02 | The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and calls curl on it, w… |
CVE-2021-32000 | Low | 3.2 | 2021-07-28 | A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterprise Server 12 SP3… |
CVE-2021-32792 | Low | 3.1 | 2021-07-26 | mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating use… |
CVE-2021-35030 | Low | 3.5 | 2021-07-26 | A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and could allow an authe… |
CVE-2021-36091 | Low | 3.5 | 2021-07-26 | Agents are able to list appointments in the calendars without required permissions. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1… |
CVE-2021-21443 | Low | 3.5 | 2021-07-26 | Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG ((OTRS)) Community Edition: 6… |
CVE-2021-37468 | Low | 3.3 | 2021-07-25 | NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration files. |
CVE-2021-3619 | Low | 3.5 | 2021-07-22 | Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting (XSS) issue, where an authenticated user could abuse… |
CVE-2021-2432 | Low | 3.7 | 2021-07-21 | Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is affected is Java SE: 7u301. Difficult to exploit vulner… |
CVE-2021-2411 | Low | 3.7 | 2021-07-21 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: JS module). Supported versions that are affected are 8.0.25 and prior. Difficul… |
CVE-2021-2381 | Low | 3.9 | 2021-07-21 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerabili… |
CVE-2021-2341 | Low | 3.1 | 2021-07-21 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Jav… |
CVE-2021-2340 | Low | 2.7 | 2021-07-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Memcached). Supported versions that are affected are 8.0.25 and prior. Easily exp… |
CVE-2021-2336 | Low | 3.5 | 2021-07-21 | Vulnerability in the Oracle Database - Enterprise Edition Data Redaction component of Oracle Database Server. Supported versions that are affected are 12.1.0.2… |
CVE-2021-2335 | Low | 3.5 | 2021-07-21 | Vulnerability in the Oracle Database - Enterprise Edition Data Redaction component of Oracle Database Server. Supported versions that are affected are 12.1.0.2… |
CVE-2021-2334 | Low | 3.5 | 2021-07-21 | Vulnerability in the Oracle Database - Enterprise Edition Data Redaction component of Oracle Database Server. Supported versions that are affected are 12.1.0.2… |
CVE-2021-2448 | Low | 3.7 | 2021-07-21 | Vulnerability in the Oracle Financial Services Crime and Compliance Investigation Hub product of Oracle Financial Services Applications (component: Reports). T… |
CVE-2021-2326 | Low | 2.7 | 2021-07-21 | Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.2.0.1 and 19c. Easily exploitable vulnerab… |
CVE-2021-20478 | Low | 3.3 | 2021-07-20 | IBM Cloud Pak System 2.3 could allow a local user in some situations to view the artifacts of another user in self service console. IBM X-Force ID: 197497. |
CVE-2021-20534 | Low | 3.5 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to vi… |
CVE-2021-20523 | Low | 2.7 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in t… |
CVE-2021-20499 | Low | 2.7 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in t… |
CVE-2021-34688 | Low | 3.3 | 2021-07-15 | iDrive RemotePC before 7.6.48 on Windows allows information disclosure. A locally authenticated attacker can read an encrypted version of the system's Personal… |
CVE-2021-31224 | Low | 3.5 | 2021-07-13 | SES Evolution before 2.1.0 allows duplicating an existing security policy by leveraging access of a user having read-only access to security policies. |
CVE-2021-32734 | Low | 3.1 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped wit… |
CVE-2021-32725 | Low | 3.5 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, default share permissions were not being r… |
CVE-2021-36382 | Low | 2.6 | 2021-07-12 | Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connection… |
CVE-2021-32680 | Low | 3.3 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions priot to 19.0.13, 20.0.11, and 21.0.3, Nextcloud Server audit logging functional… |
CVE-2021-32679 | Low | 3.5 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, filenames where not escaped by default in… |
CVE-2021-32678 | Low | 3.7 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API res… |
CVE-2021-36371 | Low | 3.7 | 2021-07-09 | Emissary-Ingress (formerly Ambassador API Gateway) through 1.13.9 allows attackers to bypass client certificate requirements (i.e., mTLS cert_required) on back… |
CVE-2021-25439 | Low | 3.3 | 2021-07-08 | Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above all… |
CVE-2021-25432 | Low | 3.3 | 2021-07-08 | Information exposure vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above allows… |
CVE-2021-32715 | Low | 3.1 | 2021-07-07 | hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a pre… |
CVE-2021-29759 | Low | 2.3 | 2021-07-07 | IBM App Connect Enterprise Certified Container 1.0, 1.1, 1.2, and 1.3 could allow a privileged user to obtain sensitive information from internal log files. IB… |
CVE-2021-22231 | Low | 3.5 | 2021-07-07 | A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile page via using a spec… |
CVE-2021-22232 | Low | 3.5 | 2021-07-06 | HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE |
CVE-2021-32729 | Low | 2.0 | 2021-07-01 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 1… |
CVE-2021-36087 | Low | 3.3 | 2021-07-01 | The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there… |
CVE-2021-36086 | Low | 3.3 | 2021-07-01 | The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list). |
CVE-2021-36085 | Low | 3.3 | 2021-07-01 | The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map). |
CVE-2021-36084 | Low | 3.3 | 2021-07-01 | The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper). |
CVE-2021-31506 | Low | 3.3 | 2021-06-29 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interac… |
CVE-2021-32719 | Low | 3.1 | 2021-06-28 | RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI v… |
CVE-2021-32718 | Low | 3.1 | 2021-06-28 | RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's ba… |
CVE-2021-28587 | Low | 3.3 | 2021-06-28 | After Effects versions 18.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker co… |
CVE-2021-27040 | Low | 3.3 | 2021-06-25 | A maliciously crafted DWG file can be forced to read beyond allocated boundaries when parsing the DWG file. This vulnerability can be exploited to execute arbi… |
CVE-2021-29948 | Low | 2.5 | 2021-06-24 | Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user is replac… |
CVE-2021-24000 | Low | 3.1 | 2021-06-24 | A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they were on a separate t… |
CVE-2021-33604 | Low | 2.5 | 2021-06-24 | URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaad… |
CVE-2021-32823 | Low | 3.7 | 2021-06-24 | In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in… |
CVE-2021-34397 | Low | 1.9 | 2021-06-22 | Bootloader contains a vulnerability in NVIDIA MB2, which may cause free-the-wrong-heap, which may lead to limited denial of service. |
CVE-2021-34396 | Low | 3.0 | 2021-06-22 | Bootloader contains a vulnerability in access permission settings where unauthorized software may be able to overwrite NVIDIA MB2 code, which would result in l… |
CVE-2021-34395 | Low | 3.9 | 2021-06-22 | Trusty TLK contains a vulnerability in its access permission settings where it does not properly restrict access to a resource from a user with local privilege… |
CVE-2021-22365 | Low | 3.3 | 2021-06-22 | There is an out of bounds read vulnerability in eSE620X vESS V100R001C10SPC200, V100R001C20SPC200, V200R001C00SPC300. A local attacker can exploit this vulnera… |
CVE-2021-34428 | Low | 2.9 | 2021-06-22 | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID i… |
CVE-2021-33572 | Low | 3.5 | 2021-06-21 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Linux Security whereby the FSAVD component used in certain F-Secure products can crash while… |
CVE-2021-32696 | Low | 3.7 | 2021-06-18 | The npm package "striptags" is an implementation of PHP's strip_tags in Typescript. In striptags before version 3.2.0, a type-confusion vulnerability can cause… |
CVE-2020-18442 | Low | 3.3 | 2021-06-18 | Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip_file_read" in the function "unzzip_cat_file". |
CVE-2021-32695 | Low | 3.9 | 2021-06-17 | Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.16.1, a malicious app on the same device could have gotten access to the shar… |
CVE-2020-35762 | Low | 2.7 | 2021-06-16 | bloofoxCMS 0.5.2.1 is infected with Path traversal in the 'fileurl' parameter that allows attackers to read local files. |
CVE-2021-3595 | Low | 3.8 | 2021-06-15 | An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur… |
CVE-2021-3594 | Low | 3.8 | 2021-06-15 | An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur w… |
CVE-2021-3593 | Low | 3.8 | 2021-06-15 | An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() function and could occur… |
CVE-2021-3592 | Low | 3.8 | 2021-06-15 | An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur… |
CVE-2021-31501 | Low | 3.3 | 2021-06-15 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction i… |
CVE-2021-31498 | Low | 3.3 | 2021-06-15 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction i… |
CVE-2021-34682 | Low | 3.7 | 2021-06-12 | Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature. |
CVE-2021-32556 | Low | 3.8 | 2021-06-12 | It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would… |
CVE-2021-22898 | Low | 3.1 | 2021-06-11 | curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send… |
CVE-2021-25409 | Low | 2.4 | 2021-06-11 | Improper access in Notification setting prior to SMR JUN-2021 Release 1 allows physically proximate attackers to set arbitrary notification via physically conf… |
CVE-2021-25404 | Low | 3.3 | 2021-06-11 | Information Exposure vulnerability in SmartThings prior to version 1.7.64.21 allows attacker to access user information via log. |
CVE-2021-25403 | Low | 3.3 | 2021-06-11 | Intent redirection vulnerability in Samsung Account prior to version 10.8.0.4 in Android P(9.0) and below, and 12.2.0.9 in Android Q(10.0) and above allows att… |
CVE-2021-25402 | Low | 3.3 | 2021-06-11 | Information Exposure vulnerability in Samsung Notes prior to version 4.2.04.27 allows attacker to access s pen latency information. |
CVE-2021-25398 | Low | 3.3 | 2021-06-11 | Intent redirection vulnerability in Bixby Voice prior to version 3.1.12 allows attacker to access contacts. |
CVE-2021-25389 | Low | 2.3 | 2021-06-11 | Improper running task check in S Secure prior to SMR MAY-2021 Release 1 allows attackers to use locked app without authentication. |
CVE-2021-20396 | Low | 3.3 | 2021-06-11 | IBM QRadar Analyst Workflow App 1.0 through 1.18.0 for IBM QRadar SIEM allows web pages to be stored locally which can be read by another user on the system. I… |
CVE-2021-28801 | Low | 3.1 | 2021-06-11 | An out-of-bounds read vulnerability has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read se… |
CVE-2021-33031 | Low | 3.1 | 2021-06-10 | In LabCup before <v2_next_18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, af… |
CVE-2021-3039 | Low | 3.8 | 2021-06-10 | An information exposure through log file vulnerability exists in the Palo Alto Networks Prisma Cloud Compute Console where a secret used to authorize the role… |
CVE-2021-3588 | Low | 3.3 | 2021-06-10 | The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for re… |
CVE-2020-24512 | Low | 3.3 | 2021-06-09 | Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. |
CVE-2021-22218 | Low | 2.6 | 2021-06-08 | All versions of GitLab CE/EE starting from 12.8 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13… |
CVE-2021-22308 | Low | 3.3 | 2021-06-03 | There is a Business Logic Errors vulnerability in Huawei Smartphone. The malicious apps installed on the device can keep taking screenshots in the background… |
CVE-2021-23896 | Low | 3.2 | 2021-06-02 | Cleartext Transmission of Sensitive Information vulnerability in the administrator interface of McAfee Database Security (DBSec) prior to 4.8.2 allows an admin… |
CVE-2021-32655 | Low | 3.5 | 2021-06-01 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to convert a Files Dr… |
CVE-2021-32653 | Low | 2.7 | 2021-06-01 | Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server versions prior to 19.0.11, 20.0.10, or 21.0.2 send user IDs to the lookup s… |
CVE-2021-32651 | Low | 3.1 | 2021-06-01 | OneDev is a development operations platform. If the LDAP external authentication mechanism is enabled in OneDev versions 4.4.1 and prior, an attacker can manip… |
CVE-2021-20575 | Low | 3.3 | 2021-06-01 | IBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by another user on the system. X-Force ID: 199278. |
CVE-2021-20239 | Low | 3.3 | 2021-05-28 | A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an attacker with a local account to leak information about… |