Skip to content
OpenAdvisories

Archive

11 January 2021

Vulnerabilities first published on this day (UTC), newest first.

← December 2020 2021 / January /11 February 2021 →
  1. 119
  2. 22
  3. 38
  4. 445
  5. 548
  6. 660
  7. 757
  8. 895
  9. 92
  10. 10 
  11. 1184
  12. 12178
  13. 13172
  14. 1429
  15. 1552
  16. 16 
  17. 172
  18. 1814
  19. 1948
  20. 20242
  21. 2172
  22. 2254
  23. 231
  24. 242
  25. 2539
  26. 2653
  27. 2744
  28. 2831
  29. 2969
  30. 304
  31. 311
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.4
    CVE-2021-21241

    CSRF can expose users authentication token in Flask-Security-Too

    The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and…

    Flask-Middleware flask-security-too flask-security-too flask-security Debian PyPI
  • High 8.8
    CVE-2020-23960

    Cross-Site Request Forgery in ForkCMS

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass of the user's comments, (2) restoring a deleted user, (3) ins…

    forkcms/forkcms Packagist
  • High 7.0
    CVE-2020-17534

    Improper synchronization in Apache Netbeans HTML/Java API

    There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject of HTML/Java API version 1.7. A similar vulnerability has recently been disclosed in other Java projects and the fix in…

    netbeans org.netbeans.html:pom Ubuntu Maven
  • High 8.8
    CVE-2020-26118

    In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authenti…

  • High 7.2
    CVE-2020-2508

    Command Injection Vulnerability in QTS and QuTS hero

    A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions…

    QNAP Systems QTS QuTS hero
  • High 8.6
    CVE-2021-3121

    Improper Input Validation in GoGo Protobuf

    An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

    protobuf-c github.com/gogo/protobuf golang-gogoprotobuf golang-gogoprotobuf Debian Ubuntu Alpine Go
  • High 7.5
    CVE-2021-3116

    Logic error in authentication in proxy.py

    before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).

    proxy-py PyPI