Skip to content
OpenAdvisories

Archive

19 January 2021

Vulnerabilities first published on this day (UTC), newest first.

← December 2020 2021 / January /19 February 2021 →
  1. 119
  2. 22
  3. 38
  4. 445
  5. 548
  6. 660
  7. 757
  8. 895
  9. 92
  10. 10 
  11. 1184
  12. 12178
  13. 13172
  14. 1429
  15. 1552
  16. 16 
  17. 172
  18. 1814
  19. 1948
  20. 20242
  21. 2172
  22. 2254
  23. 231
  24. 242
  25. 2539
  26. 2653
  27. 2744
  28. 2831
  29. 2969
  30. 304
  31. 311
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.2
    CVE-2021-21263

    Query Binding Exploitation in Laravel

    Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field th…

    laravel framework laravel/framework php-laravel-framework Debian Packagist
  • High 8.1
    CVE-2021-20190

    Deserialization of untrusted data in jackson-databind

    A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

    com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  • High 7.3
    CVE-2020-28480

    Prototype Pollution

    The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object's key and set the value is not properly sanitized, leadin…

    jointjs npm
  • High 8.0
    CVE-2021-3182

    D-Link DCS-5220 devices have a buffer overflow. NOTE: This vulnerability only affects products that are no longer suppo…

  • High 7.3
    CVE-2020-28472

    Prototype Pollution

    This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the ap…

    aws-sdk @aws-sdk/shared-ini-file-loader npm
  • High 7.5
    CVE-2020-28478 Public exploit

    Prototype Pollution

    This affects the package gsap before 3.6.0.

    gsap npm
  • High 7.5
    CVE-2020-28477

    Prototype Pollution

    This affects all versions of package immer.

    immer npm
  • High 8.8
    CVE-2021-22852

    HGiga OAKloud Portal - SQL injection -2

    HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (online registration) to obtain database schema and data.

    HGiga OAKSv20 OAKlouds-mol_course_v3 2.0 OAKSv30 OAKlouds-mol_course_v3 3.0