This is a list of recent vulnerabilities for which exploits are available.
CVE, Title, Vendor
Description
CVSS v3.1 Base Score
Date Created
Date Updated
CVE-2021-33509
Privilege Escalation Vulnerability in Plone
Plone
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.
9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
05/21/2021
05/24/2021
CVE-2017-10818
Weak Authentication Vulnerability in MaLion
Intercom
MaLion for Windows and Mac versions 3.2.1 to 5.2.1 uses a hardcoded cryptographic key which may allow an attacker to alter the connection settings of Terminal Agent and spoof the Relay Service.
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
08/04/2017
05/19/2021
CVE-2018-14718
Remote Code Execution Vulnerability in FasterXML Data Bind
Oracle, Redhat, NetApp, FasterXML, Debian
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
01/02/2019
05/21/2021
CVE-2021-27135
Denial of Service Vulnerability in xTerm
Debian, Fedora Project, Invisible-Island
xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
02/10/2021
05/21/2021
CVE-2020-36326
Object Injection Vulnerability in PHPMailer
PHPmailer_project
PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
04/27/2021
05/21/2021
CVE-2021-26583
Remote Code Execution Vulnerability in HP Amplifier Pack
HP
A potential security vulnerability was identified in HPE iLO Amplifier Pack. The vulnerabilities could be remotely exploited to allow remote code execution.
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
05/10/2021
05/21/2021
CVE-2020-13873
SQL Injection Vulnerability in Codologic
Codologic
A SQL Injection vulnerability in get_topic_info() in sys/CODOF/Forum/Topic.php in Codoforum before 4.9 allows remote attackers (pre-authentication) to bypass the admin page via a leaked password-reset token of the admin. (As an admin, an attacker can upload a PHP shell and execute remote code on the operating system.)
