Skip to content
OpenAdvisories

Archive

27 April 2021

Vulnerabilities first published on this day (UTC), newest first.

← March 2021 2021 / April /27 May 2021 →
  1. 165
  2. 2178
  3. 31
  4. 4 
  5. 565
  6. 694
  7. 758
  8. 865
  9. 955
  10. 102
  11. 119
  12. 1261
  13. 13207
  14. 1480
  15. 1549
  16. 1619
  17. 174
  18. 188
  19. 1952
  20. 2030
  21. 2140
  22. 22297
  23. 2347
  24. 244
  25. 256
  26. 2668
  27. 2750
  28. 2859
  29. 29118
  30. 3050
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 8.8
    CVE-2021-29472

    Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer

    Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow code to be executed in the HgDriver if hg/Mercurial is inst…

    composer composer composer/composer composer Debian Ubuntu Alpine Packagist
  • High 8.6
    CVE-2021-29441 Public exploit Scanner template EPSS 83%

    Authentication bypass

    Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce auth…

    Alibaba nacos com.alibaba.nacos:nacos-common Maven
  • High 8.6
    CVE-2021-29442 Public exploit Scanner template EPSS 64%

    Authentication bypass

    Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the…

    Alibaba nacos
  • High 7.6
    CVE-2021-29460 Public exploit

    Cross-site scripting (XSS) from unsanitized uploaded SVG files

    Kirby is an open source CMS. An editor with write access to the Kirby Panel can upload an SVG file that contains harmful content like `<script>` tags. The direct link to that file can be sent to other users or visitors of the site. If the victim opens that li…

    getkirby kirby getkirby/cms Packagist
  • High 7.5
    CVE-2021-30638

    An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later

    Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapest…

    Apache Software Foundation Apache Tapestry org.apache.tapestry:tapestry-core Maven
  • High 7.0
    CVE-2021-29667

    IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.2 is potentially vulnerable to CSV Injection. A remote…

    IBM Spectrum Scale
  • High 7.8
    CVE-2021-3464

    A DLL search path vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow privi…

    Lenovo PCManager
  • High 7.5
    CVE-2021-30165

    EDIMAX Technology Co., Ltd. HD Wireless Day & Night Network Camera IC-3140W - Hard-coded password

    The default administrator account & password of the EDIMAX wireless network camera is hard-coded. Remote attackers can disassemble firmware to obtain the privileged permission and further control the devices.

    Edimax IC-3140W
  • High 7.5
    CVE-2021-31671

    Pgsync Contains Cleartext Transmission of Sensitive Information

    pgsync before 0.6.7 is affected by Information Disclosure of sensitive information. Syncing the schema with the --schema-first and --schema-only options is mishandled. For example, the sslmode connection parameter may be lost, which means that SSL would not b…

    pgsync RubyGems