Skip to content
OpenAdvisories

Archive

February 2021

Vulnerabilities first published in this month (UTC), newest first.

← January 2021 2021 / February March 2021 →
  1. 149
  2. 254
  3. 363
  4. 4117
  5. 538
  6. 616
  7. 76
  8. 878
  9. 9145
  10. 10114
  11. 1196
  12. 1249
  13. 132
  14. 147
  15. 1540
  16. 1655
  17. 17112
  18. 1838
  19. 1944
  20. 201
  21. 215
  22. 2266
  23. 2362
  24. 2441
  25. 2574
  26. 2674
  27. 2717
  28. 281
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.8
    CVE-2021-25281 Public exploit EPSS 73%

    SaltStack Salt Improper Authentication vulnerability

    An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.1
    CVE-2021-25282 Public exploit EPSS 93%

    SaltStack Salt Directory Traversal vulnerability

    An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2021-21972 Exploited · Ransomware Public exploit EPSS 100%

    The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-27101 Exploited · Ransomware Public exploit

    Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root…

    KEV Nov 3, 2021
  • Critical 9.1
    CVE-2021-21014 Public exploit

    Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console i…

    Adobe Magento Commerce magento/community-edition magento/project-community-edition Web / CMS Packagist
  • Critical 9.8
    CVE-2020-14343 Public exploit

    Improper Input Validation in PyYAML

    A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the libra…

    pyyaml pyyaml pyyaml py3-yaml Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2021-22502 Exploited Public exploit EPSS 97%

    Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. Th…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-17523 Public exploit EPSS 86%

    Authentication bypass in Apache Shiro

    Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.

    org.apache.shiro:shiro-web org.apache.shiro:shiro-spring org.apache.shiro:shiro-spring-boot-starter Maven
  • Critical 9.3
    CVE-2021-21276 Public exploit

    Privilege escalation in Polr

    Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attackers to gain admin access to site instances, even if they do not possess an existing account. This vulnerability exists regardless of users' s…

    cydrobolt polr