Skip to content
OpenAdvisories

Archive

2 February 2021

Vulnerabilities first published on this day (UTC), newest first.

← January 2021 2021 / February /2 March 2021 →
  1. 149
  2. 254
  3. 363
  4. 4117
  5. 538
  6. 616
  7. 76
  8. 878
  9. 9145
  10. 10114
  11. 1196
  12. 1249
  13. 132
  14. 147
  15. 1540
  16. 1655
  17. 17112
  18. 1838
  19. 1944
  20. 201
  21. 215
  22. 2266
  23. 2362
  24. 2441
  25. 2574
  26. 2674
  27. 2717
  28. 281
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2021-21294

    Unbounded connection acceptance in http4s-blaze-server

    Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, …

    http4s http4s org.http4s:http4s-blaze-server_2.13 org.http4s:http4s-blaze-server_2.12 Maven
  • High 7.5
    CVE-2021-21293

    Unbounded connection acceptance leads to file handle exhaustion

    blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, ac…

    http4s blaze org.http4s:blaze-core_2.12 org.http4s:blaze-core_2.11 Maven
  • High 7.4
    CVE-2021-21289

    Command Injection Vulnerability in Mechanize

    Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using …

    sparklemotion mechanize ruby-mechanize ruby-mechanize Debian Ubuntu RubyGems
  • High 8.0
    CVE-2021-23271

    TIBCO EBX Cross Site Scripting (XSS)

    The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) attack on the affected system. Affected relea…

    TIBCO Software TIBCO EBX
  • High 7.2
    GHSA-x7p5-p2c9-phvg

    Unexpected database bindings

    This is a follow-up to the previous security advisory (GHSA-3p32-j457-pg5x) which addresses a few additional edge cases. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expec…

    laravel/framework illuminate/database Packagist
  • High 8.6
    CVE-2020-28494

    Command Injection

    This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is cal…

    total.js npm
  • High 7.3
    CVE-2020-28495

    Prototype Pollution

    This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact de…

    total.js npm