Low-severity CVEs (page 85)
Page 85 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-25367 | Low | 3.7 | 2021-03-25 | Path Traversal vulnerability in Samsung Notes prior to version 4.2.00.22 allows attackers to access local files without permission. |
CVE-2021-25366 | Low | 3.2 | 2021-03-25 | Improper access control in Samsung Internet prior to version 13.2.1.70 allows physically proximate attackers to bypass the secret mode's authentication. |
CVE-2021-25354 | Low | 3.3 | 2021-03-25 | Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in Samsung Browser via malicious deeplink. |
CVE-2021-25351 | Low | 3.2 | 2021-03-25 | Improper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and 12.1.1.3 allows physically proximate attackers to log out user… |
CVE-2021-25350 | Low | 2.0 | 2021-03-25 | Information Exposure vulnerability in Samsung Account prior to version 12.1.1.3 allows physically proximate attackers to access user information via log. |
CVE-2021-22193 | Low | 3.5 | 2021-03-24 | An issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able to validate the use of a specific name fo… |
CVE-2021-3392 | Low | 3.2 | 2021-03-23 | A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_requ… |
CVE-2021-27596 | Low | 3.3 | 2021-03-22 | When a user opens manipulated Autodesk 3D Studio for MS-DOS (.3DS) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application cr… |
CVE-2021-27595 | Low | 3.3 | 2021-03-22 | When a user opens manipulated Portable Document Format (.PDF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes… |
CVE-2021-27594 | Low | 3.3 | 2021-03-22 | When a user opens manipulated Windows Bitmap (.BMP) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becom… |
CVE-2021-27593 | Low | 3.3 | 2021-03-22 | When a user opens manipulated Graphics Interchange Format (.GIF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application cras… |
CVE-2021-21438 | Low | 3.5 | 2021-03-22 | Agents are able to see linked FAQ articles without permissions (defined in FAQ Category). This issue affects: FAQ version 6.0.29 and prior versions, OTRS versi… |
CVE-2021-21437 | Low | 3.5 | 2021-03-22 | Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and… |
CVE-2019-14850 | Low | 3.7 | 2021-03-18 | A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a… |
CVE-2021-22887 | Low | 2.3 | 2021-03-16 | A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerab… |
CVE-2021-20286 | Low | 2.7 | 2021-03-15 | A flaw was found in libnbd 1.7.3. An assertion failure in nbd_unlocked_opt_go in ilb/opt.c may lead to denial of service. |
CVE-2021-23357 | Low | 3.3 | 2021-03-15 | All versions of package github.com/tyktechnologies/tyk/gateway are vulnerable to Directory Traversal via the handleAddOrUpdateApi function. This function is ab… |
CVE-2021-28378 | Low | 3.7 | 2021-03-15 | Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations. |
CVE-2021-21726 | Low | 2.3 | 2021-03-12 | Some ZTE products have an input verification vulnerability in the diagnostic function interface. Due to insufficient verification of some parameters input by u… |
CVE-2021-20668 | Low | 2.7 | 2021-03-10 | Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path via a specially crafte… |
CVE-2021-28116 | Low | 3.7 | 2021-03-09 | Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This ca… |
CVE-2021-20263 | Low | 3.3 | 2021-03-09 | A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the gue… |
CVE-2021-27584 | Low | 3.3 | 2021-03-09 | When a user opens manipulated PhotoShop Document (.PSD) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the applicat… |
CVE-2021-21493 | Low | 3.3 | 2021-03-09 | When a user opens manipulated Graphics Interchange Format (.GIF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the… |
CVE-2021-25348 | Low | 2.1 | 2021-03-04 | Improper permission grant check in Samsung Internet prior to version 13.0.1.60 allows access to files in internal storage without authorized STORAGE permission. |
CVE-2021-26988 | Low | 3.5 | 2021-03-04 | Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P8 and 9.8 are susceptible to a vulnerability which could allow unauthorized tenant users to… |
CVE-2021-25336 | Low | 2.8 | 2021-03-04 | Improper access control in NotificationManagerService in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to acquire notifi… |
CVE-2021-25335 | Low | 2.5 | 2021-03-04 | Improper lockscreen status check in cocktailbar service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows unauthenticated users to access hidden… |
CVE-2021-25333 | Low | 3.2 | 2021-03-04 | Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscreen via scanning spe… |
CVE-2021-25332 | Low | 3.2 | 2021-03-04 | Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to contacts information over the lockscreen in specific con… |
CVE-2021-25331 | Low | 3.2 | 2021-03-04 | Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscreen in specific cond… |
CVE-2021-21331 | Low | 3.0 | 2021-03-03 | The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the AP… |
CVE-2021-22182 | Low | 3.5 | 2021-03-03 | An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request. |
CVE-2021-22294 | Low | 3.3 | 2021-03-02 | A component API of the HarmonyOS 2.0 has a permission bypass vulnerability. Local attackers may exploit this vulnerability to issue commands repeatedly, exhaus… |
CVE-2020-4726 | Low | 3.3 | 2021-03-02 | The IBM Application Performance Monitoring UI (IBM Cloud APM 8.1.4) allows web pages to be stored locally which can be read by another user on the system. IBM… |
CVE-2020-4725 | Low | 3.5 | 2021-03-02 | IBM Monitoring (IBM Cloud APM 8.1.4 ) could allow an authenticated user to modify HTML content by sending a specially crafted HTTP request to the APM UI, which… |
CVE-2021-21320 | Low | 2.6 | 2021-03-02 | matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content sandbox can be abuse… |
CVE-2021-21273 | Low | 3.1 | 2021-02-26 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2021-21298 | Low | 3.5 | 2021-02-26 | Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path… |
CVE-2019-18947 | Low | 3.5 | 2021-02-26 | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to information disclosure. |
CVE-2021-21330 | Low | 3.1 | 2021-02-26 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A mali… |
CVE-2021-20203 | Low | 3.2 | 2021-02-25 | An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for… |
CVE-2021-27645 | Low | 2.5 | 2021-02-24 | The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due… |
CVE-2020-8902 | Low | 3.5 | 2021-02-23 | Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery (SSRF) attack. An attacker can use a specially crafted webpage to force… |
CVE-2020-27768 | Low | 3.3 | 2021-02-23 | In ImageMagick, there is an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h. This flaw affects ImageMagick ver… |
CVE-2020-36248 | Low | 3.9 | 2021-02-19 | The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass th… |
CVE-2020-36251 | Low | 3.5 | 2021-02-19 | ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's access to that share. |
CVE-2021-22174 | Low | 3.7 | 2021-02-17 | Crash in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file |
CVE-2021-22173 | Low | 3.7 | 2021-02-17 | Memory leak in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file |
CVE-2021-23839 | Low | 3.7 | 2021-02-16 | OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versio… |
CVE-2020-29023 | Low | 3.5 | 2021-02-16 | Improper Encoding or Escaping of Output from CSV Report Generator of Secomea GateManager allows an authenticated administrator to generate a CSV file that may… |
CVE-2021-20406 | Low | 2.2 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti… |
CVE-2019-19004 | Low | 3.3 | 2021-02-11 | A biWidth*biBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows attackers to provide an unexpected input value to malloc via a malformed bitmap i… |
CVE-2021-21061 | Low | 3.3 | 2021-02-11 | Acrobat Pro DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Use-after-free v… |
CVE-2021-21046 | Low | 3.3 | 2021-02-11 | Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an memory corru… |
CVE-2021-21301 | Low | 2.6 | 2021-02-11 | Wire is an open-source collaboration platform. In Wire for iOS (iPhone and iPad) before version 3.75 there is a vulnerability where the video capture isn't sto… |
CVE-2020-1717 | Low | 2.7 | 2021-02-11 | A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack. |
CVE-2020-10734 | Low | 3.3 | 2021-02-11 | A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Sin… |
CVE-2021-20402 | Low | 2.7 | 2021-02-11 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is… |
CVE-2020-8030 | Low | 3.6 | 2021-02-11 | A Insecure Temporary File vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to leak the bootstrapToken or modify the configuration file b… |
CVE-2020-8029 | Low | 2.9 | 2021-02-11 | A Incorrect Permission Assignment for Critical Resource vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to gain access to the kublet ke… |
CVE-2021-21296 | Low | 2.7 | 2021-02-10 | Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes t… |
CVE-2021-22133 | Low | 2.4 | 2021-02-10 | The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally… |
CVE-2020-17428 | Low | 3.3 | 2021-02-09 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is req… |
CVE-2020-17422 | Low | 3.3 | 2021-02-09 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is req… |
CVE-2020-17420 | Low | 3.3 | 2021-02-09 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is req… |
CVE-2020-29021 | Low | 3.5 | 2021-02-08 | A vulnerability in web UI input field of GateManager allows authenticated attacker to enter script tags that could cause XSS. This issue affects: GateManager a… |
CVE-2020-8590 | Low | 3.3 | 2021-02-08 | Clustered Data ONTAP versions prior to 9.1P18 and 9.3P12 are susceptible to a vulnerability which could allow an attacker to discover node names via AutoSuppor… |
CVE-2020-8578 | Low | 3.3 | 2021-02-08 | Clustered Data ONTAP versions prior to 9.3P20 are susceptible to a vulnerability which could allow an attacker to discover node names via AutoSupport bundles e… |
CVE-2021-21436 | Low | 3.5 | 2021-02-08 | Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7… |
CVE-2021-21434 | Low | 3.5 | 2021-02-08 | Survey administrator can craft a survey in such way that malicious code can be executed in the agent interface (i.e. another agent who wants to make changes in… |
CVE-2021-22305 | Low | 3.3 | 2021-02-06 | There is a buffer overflow vulnerability in Mate 30 10.1.0.126(C00E125R5P3). A module does not verify the some input when dealing with messages. Attackers can… |
CVE-2021-22304 | Low | 3.3 | 2021-02-06 | There is a use after free vulnerability in Taurus-AL00A 10.0.0.1(C00E1R1P1). A module may refer to some memory after it has been freed while dealing with some… |
CVE-2021-22303 | Low | 3.3 | 2021-02-06 | There is a pointer double free vulnerability in Taurus-AL00A 10.0.0.1(C00E1R1P1). There is a lack of muti-thread protection when a function is called. Attacker… |
CVE-2021-25227 | Low | 3.3 | 2021-02-04 | Trend Micro Antivirus for Mac 2021 (Consumer) is vulnerable to a memory exhaustion vulnerability that could lead to disabling all the scanning functionality wi… |
CVE-2020-9389 | Low | 3.7 | 2021-02-03 | A username enumeration issue was discovered in SquaredUp before version 4.6.0. The login functionality was implemented in a way that would enable a malicious u… |
CVE-2020-8589 | Low | 3.5 | 2021-02-03 | Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthorized tenant users to discover the names o… |
CVE-2020-8588 | Low | 3.5 | 2021-02-03 | Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthorized tenant users to discover the existen… |
CVE-2021-25775 | Low | 3.8 | 2021-02-03 | In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users. |
CVE-2021-25755 | Low | 2.5 | 2021-02-03 | In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to the encrypted traffic. |
CVE-2021-3349 | Low | 3.3 | 2021-02-01 | GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution does not retrieve e… |
CVE-2020-4787 | Low | 2.3 | 2021-01-27 | IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 is vulnerable to server side request forgery (SSRF). This may all… |
CVE-2020-29443 | Low | 3.9 | 2021-01-26 | ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated. |
CVE-2020-4889 | Low | 3.3 | 2021-01-26 | IBM Spectrum Scale 5.0.0 through 5.0.5.4 and 5.1.0 could allow a local user to poison log files which could impact support and development efforts. IBM X-Force… |
CVE-2020-25686 | Low | 3.7 | 2021-01-20 | A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards… |
CVE-2020-25685 | Low | 3.7 | 2021-01-20 | A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded… |
CVE-2020-25684 | Low | 3.7 | 2021-01-20 | A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destin… |
CVE-2021-2123 | Low | 3.2 | 2021-01-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily… |
CVE-2021-2045 | Low | 3.1 | 2021-01-20 | Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to ex… |
CVE-2021-2042 | Low | 2.3 | 2021-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vu… |
CVE-2021-2019 | Low | 2.7 | 2021-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.19 and prior… |
CVE-2021-2007 | Low | 3.7 | 2021-01-20 | Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8… |
CVE-2021-2000 | Low | 2.4 | 2021-01-20 | Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploi… |
CVE-2021-1998 | Low | 3.8 | 2021-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.20 and prior. Easily exp… |
CVE-2021-1996 | Low | 2.4 | 2021-01-20 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0… |
CVE-2020-9203 | Low | 3.3 | 2021-01-13 | There is a resource management errors vulnerability in Huawei P30. Local attackers construct broadcast message for some application, causing this application t… |
CVE-2020-14341 | Low | 2.7 | 2021-01-12 | The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connections to be attempt… |
CVE-2021-23239 | Low | 2.5 | 2021-01-12 | The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race… |
CVE-2020-24003 | Low | 3.3 | 2021-01-11 | Microsoft Skype through 8.59.0.77 on macOS has the disable-library-validation entitlement, which allows a local process (with the user's privileges) to obtain… |
CVE-2020-23250 | Low | 2.3 | 2021-01-05 | GigaVUE-OS (GVOS) 5.4 - 5.9 uses a weak algorithm for a hash stored in internal database. |