This is a list of recent vulnerabilities for which exploits are available.
CVE, Title, Vendor
Description
CVSS v3.1 Base Score
Date Created
Date Updated
CVE-2020-17510
Authentication Bypass Vulnerability in Apache Shiro
Apache
Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
11/05/2021
05/04/2021
CVE-2020-13942
Code Injection Vulnerability in Apache Unomi
Apache
It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
11/24/2021
05/05/2021
CVE-2020-24636
Remote Code Execution Vulnerability in Aruba IAP
Aruba Networks
A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x: 8.6.0.5 and below; Aruba Instant 8.7.x: 8.7.0.0 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
03/29/2021
05/11/2021
CVE-2021-30642
Input Validation Vulnerability in Symantec Security Analytics
Symantec
An input validation flaw in the Symantec Security Analytics web UI 7.2 prior 7.2.7, 8.1, prior to 8.1.3-NSR3, 8.2, prior to 8.2.1-NSR2 or 8.2.2 allows a remote, unauthenticated attacker to execute arbitrary OS commands on the target with elevated privileges.
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
04/27/2021
05/07/2021
CVE-2020-18020
SQL Injection Vulnerability in PHPSHE Mail System
PHPSHE
SQL Injection in PHPSHE Mall System v1.7 allows remote attackers to execute arbitrary code by injecting SQL commands into the "user phone" parameter of a crafted HTTP request to the "admin.php" component.
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
04/28/2021
05/05/2021
CVE-2021-29145
SSRF RCE in Aruba Policy Manager
Weak Authentication Vulnerability in Dell EMC Firmware
Dell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX Switch Module firmware versions prior to 2.0.0.82 contain a Weak Password Encryption Vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable system with privileges of the compromised account.
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
04/30/2021
05/10/2021
CVE-2021-21507
SSRF RCE in Aruba Policy Manager
Aruba Networks
A remote server-side request forgery (SSRF) remote code execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.
