Skip to content
OpenAdvisories

Archive

3 March 2021

Vulnerabilities first published on this day (UTC), newest first.

← February 2021 2021 / March /3 April 2021 →
  1. 130
  2. 239
  3. 357
  4. 467
  5. 561
  6. 61
  7. 76
  8. 826
  9. 990
  10. 10102
  11. 11121
  12. 1247
  13. 135
  14. 14 
  15. 1565
  16. 1622
  17. 1739
  18. 1896
  19. 1942
  20. 206
  21. 216
  22. 2251
  23. 2366
  24. 2486
  25. 2571
  26. 2672
  27. 272
  28. 28 
  29. 2945
  30. 3078
  31. 3156
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 6.1
    CVE-2021-27940

    openark/orchestrator cross-site scripting vulnerability

    resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter.

    github.com/openark/orchestrator Go
  • Medium 5.4
    CVE-2021-21314

    XSS injection on ticket update

    GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is an XSS vulnerability involving a logged in user while updating a ticket.

    glpi-project glpi glpi Ubuntu
  • Medium 5.4
    CVE-2021-21312

    Stored XSS on documents

    GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability within the document upload function (Home > Management > Do…

    glpi-project glpi glpi Ubuntu
  • Medium 4.9
    CVE-2021-21313

    XSS on tabs

    GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability in the /ajax/common.tabs.php endpoint, indeed, at least two…

    glpi-project glpi glpi Ubuntu
  • Medium 5.3
    CVE-2021-22188

    An issue has been discovered in GitLab affecting all versions starting with 13.0. Confidential issue titles in Gitlab w…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.9
    CVE-2021-20442

    IBM Security Verify Bridge contains hard-coded credentials, such as a password or cryptographic key, which it uses for …

    IBM Security Verify Bridge
  • Medium 5.9
    CVE-2021-20441

    IBM Security Verify Bridge uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h…

    IBM Security Verify Bridge
  • Medium 4.7
    CVE-2020-15937

    An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allo…

    Fortinet Fortinet FortiOS Network devices
  • Medium 4.7
    CVE-2021-23347

    Cross-site Scripting (XSS)

    The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.

    github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • Medium 4.6
    CVE-2021-2138

    Vulnerability in the Oracle Cloud Infrastructure Data Science Notebook Sessions. Easily exploitable vulnerability allow…

    Oracle Oracle Cloud Infrastructure Data Science Notebook Sessions
  • Medium 6.8
    CVE-2021-21353 Public exploit

    Remote code execution in pug

    Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a reque…

    pugjs pug pug pug-code-gen npm
  • Medium 6.8
    CVE-2021-21352

    Predictable tokens used for password resets

    Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time Tracker are based on system time and, therefore, are predictable. This opens a w…

    anuko timetracker