Skip to content
OpenAdvisories

Archive

26 February 2021

Vulnerabilities first published on this day (UTC), newest first.

← January 2021 2021 / February /26 March 2021 →
  1. 149
  2. 254
  3. 363
  4. 4117
  5. 538
  6. 616
  7. 76
  8. 878
  9. 9145
  10. 10114
  11. 1196
  12. 1249
  13. 132
  14. 147
  15. 1540
  16. 1655
  17. 17112
  18. 1838
  19. 1944
  20. 201
  21. 215
  22. 2266
  23. 2362
  24. 2441
  25. 2574
  26. 2674
  27. 2717
  28. 281
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 5.2
    CVE-2020-27223 Public exploit EPSS 78%

    DOS vulnerability for Quoted Quality CSV headers

    In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due…

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven
  • Medium 5.4
    CVE-2021-21309

    Integer overflow on 32-bit systems

    Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 o…

    Redis Redis redis redis Debian Ubuntu Alpine
  • Medium 6.1
    CVE-2021-21308

    Improper session management for soft logout

    PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is able to foreign request and executes customer commands. The problem is fixed in 1.7.7.2

    PrestaShop PrestaShop Web / CMS
  • Medium 6.8
    CVE-2021-21302

    CSV Injection via csv export

    PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via the admin panel. The problem is fixed in 1.7.7.2

    PrestaShop PrestaShop Web / CMS
  • Medium 4.3
    CVE-2021-21274

    Denial of service attack via .well-known lookups

    Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-kno…

    matrix-org synapse matrix-synapse matrix-synapse Ubuntu PyPI
  • Medium 5.3
    CVE-2021-23345

    Server-side Request Forgery (SSRF)

    All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as <iframe src='file:///etc/pas…

  • Medium 6.1
    CVE-2019-18943

    XML External Entity processing

    Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) on certain operations.

    Micro Focus Solutions Business Manager
  • Medium 5.5
    CVE-2019-18942

    Stored cross site scripting

    Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to stored XSS. The application reflects previously stored user input without encoding.

    Micro Focus Solutions Business Manager
  • Medium 4.9
    CVE-2019-18944

    Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS.

    Micro Focus Solutions Business Manager
  • Medium 4.8
    CVE-2019-18946

    Session fixation

    Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to session fixation.

    Micro Focus Solutions Business Manager
  • Medium 5.3
    CVE-2021-21328

    Denial of Service

    Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the attack vector: 1. send unlimited requests against a vapor instance with differe…

    vapor vapor github.com/vapor/vapor SwiftURL
  • Medium 5.5
    CVE-2020-27618

    The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input…

    glibc eglibc glibc Debian Ubuntu