Skip to content
OpenAdvisories

Archive

10 March 2021

Vulnerabilities first published on this day (UTC), newest first.

← February 2021 2021 / March /10 April 2021 →
  1. 130
  2. 239
  3. 357
  4. 467
  5. 561
  6. 61
  7. 76
  8. 826
  9. 990
  10. 10102
  11. 11121
  12. 1247
  13. 135
  14. 14 
  15. 1565
  16. 1622
  17. 1739
  18. 1896
  19. 1942
  20. 206
  21. 216
  22. 2251
  23. 2366
  24. 2486
  25. 2571
  26. 2672
  27. 272
  28. 28 
  29. 2945
  30. 3078
  31. 3156
All Critical High Medium Low Exploited only Public exploit

102 results · Feed

  • Unscored —
    CVE-2021-28122

    A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an un…

  • Unscored —
    CVE-2020-35752

    Baby Care System 1.0 is affected by a cross-site scripting (XSS) vulnerability in the Edit Page tab through the Post ti…

  • Medium 4.7
    CVE-2021-21491

    SAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.3…

    SAP SAP NetWeaver Application Server Java (Applications based on Web Dynpro Java)
  • Unscored —
    CVE-2021-3224

    A stored cross-site scripting (XSS) vulnerability in cszcms 1.2.9 exists in /admin/pages/new via the content parameter.

  • Unscored —
    CVE-2020-28705

    FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pag…

  • Unscored —
    CVE-2020-24791

    FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1. Exploiting this issue could…

  • Unscored —
    CVE-2020-23722

    An issue was discovered in FUEL CMS 1.4.7. There is a escalation of privilege vulnerability to obtain super admin privi…

  • Unscored —
    CVE-2020-23721

    An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/page…

  • Unscored —
    CVE-2021-28007

    Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in register.php through the name parameter.

  • Unscored —
    CVE-2021-20673

    Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows re…

    WESEEK GROWI (v4.2 Series)
  • Unscored —
    CVE-2021-20672

    Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Se…

    WESEEK GROWI (v4.2 Series)
  • Unscored —
    CVE-2021-20671

    Invalid file validation on the upload feature in GROWI versions v4.2.2 allows a remote attacker with administrative pri…

    WESEEK GROWI
  • Unscored —
    CVE-2021-20670

    Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to …

    WESEEK GROWI
  • Unscored —
    CVE-2021-20669

    Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read …

    WESEEK GROWI
  • Unscored —
    CVE-2021-20667

    Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versio…

    WESEEK GROWI
  • Unscored —
    CVE-2021-20668

    Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read …

    WESEEK GROWI
  • High 8.8
    CVE-2020-13936 EPSS 23%

    Velocity Sandbox Bypass

    An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/mod…

    Apache Software Foundation Apache Velocity Engine org.apache.velocity:velocity-engine-parent org.apache.velocity:velocity Debian Ubuntu Maven
  • Medium 6.1
    CVE-2020-13959

    Velocity Tools XSS Vulnerability

    The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS v…

    Apache Software Foundation Apache Velocity Tools org.apache.velocity.tools:velocity-tools-parent org.apache.velocity:velocity-tools Debian Ubuntu Maven
  • Unscored —
    CVE-2021-3310 Public exploit

    Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can…

  • Unscored —
    CVE-2020-29238 Public exploit EPSS 16%

    An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sens…

  • Unscored —
    CVE-2020-27632

    In SIMATIC MV400 family versions prior to v7.0.6, the ISN generator is initialized with a constant value and has consta…

  • High 8.1
    CVE-2021-21772 Public exploit

    A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3m…

    lib3mf lib3mf Debian Ubuntu