Skip to content
OpenAdvisories

Archive

23 February 2021

Vulnerabilities first published on this day (UTC), newest first.

← January 2021 2021 / February /23 March 2021 →
  1. 149
  2. 254
  3. 363
  4. 4117
  5. 538
  6. 616
  7. 76
  8. 878
  9. 9145
  10. 10114
  11. 1196
  12. 1249
  13. 132
  14. 147
  15. 1540
  16. 1655
  17. 17112
  18. 1838
  19. 1944
  20. 201
  21. 215
  22. 2266
  23. 2362
  24. 2441
  25. 2574
  26. 2674
  27. 2717
  28. 281
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.8
    CVE-2021-3407 EPSS 50%

    A flaw was found in mupdf 1.18.0. Double free of object during linearization may lead to memory corruption and other po…

    mupdf mupdf mupdf Debian Ubuntu Alpine
  • High 8.8
    CVE-2021-22112

    Privilege escalation in spring security

    Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to …

    org.springframework.security:spring-security-web org.springframework.security:spring-security-bom Maven
  • High 7.5
    CVE-2020-27782

    Denial of service in Undertow

    A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerabilit…

    undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  • High 8.8
    CVE-2020-28587

    A specially crafted document can cause the document parser to copy data from a particular record type into a static-siz…

  • High 7.4
    CVE-2020-7847

    The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can …

    EFM-Networks ipTIME NAS
  • High 7.3
    CVE-2020-28429 EPSS 63%

    Command Injection

    All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})

    geojson2kml npm
  • High 7.3
    CVE-2020-14359

    Keycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers

    A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) an attacker can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection …

    github.com/keycloak/keycloak-gatekeeper Go
  • High 7.1
    CVE-2020-29075

    PDF Injection BlackHat Talk

    Acrobat Reader DC versions 2020.013.20066 (and earlier), 2020.001.30010 (and earlier) and 2017.011.30180 (and earlier) are affected by an information exposure vulnerability, that could enable an attacker to get a DNS interaction and track if the user has open…

    Adobe Acrobat Reader DC