Skip to content
OpenAdvisories

Archive

April 2021

Vulnerabilities first published in this month (UTC), newest first.

← March 2021 2021 / April May 2021 →
  1. 165
  2. 2178
  3. 31
  4. 4 
  5. 565
  6. 694
  7. 758
  8. 865
  9. 955
  10. 102
  11. 119
  12. 1261
  13. 13207
  14. 1480
  15. 1549
  16. 1619
  17. 174
  18. 188
  19. 1952
  20. 2030
  21. 2140
  22. 22297
  23. 2347
  24. 244
  25. 256
  26. 2668
  27. 2750
  28. 2859
  29. 29118
  30. 3050
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 6.8
    CVE-2021-22204 Exploited Public exploit EPSS 100%

    Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exe…

    ExifTool ExifTool libimage-exiftool-perl libimage-exiftool-perl Debian Ubuntu Alpine
    KEV Nov 17, 2021
  • Medium 5.4
    CVE-2021-2220 Public exploit

    Vulnerability in the PeopleSoft Enterprise SCM eProcurement product of Oracle PeopleSoft (component: Manage Requisition…

    Oracle PeopleSoft Enterprise SCM eProcurement
  • Medium 4.1
    CVE-2021-2173 Public exploit

    Vulnerability in the Recovery component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 1…

    Oracle Database - Enterprise Edition
  • Medium 6.3
    CVE-2021-29449 Public exploit

    Multiple Privilege Escalation Vulnerabilities Pihole

    Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in version 5.2.4 of Pi-hole core. See the referenced GitHub security advisory for details.

    pi-hole pi-hole
  • Medium 6.5
    CVE-2021-29425 Public exploit EPSS 11%

    Possible limited path traversal vulnerabily in Apache Commons IO

    In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not furth…

    Apache Software Foundation Apache Commons IO commons-io commons-io Debian Ubuntu Maven
  • Medium 5.6
    CVE-2021-23369 Public exploit

    Remote Code Execution (RCE)

    The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

    handlebars node-handlebars node-handlebars org.webjars.npm:handlebars Debian Ubuntu npm Maven
  • Medium 5.3
    CVE-2021-1473 Public exploit EPSS 64%

    Cisco Small Business RV Series Routers Vulnerabilities

    Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about thes…

    Cisco Cisco Small Business RV Series Router Firmware Network devices
  • Medium 5.3
    CVE-2021-1472 Public exploit EPSS 72%

    Cisco Small Business RV Series Routers Vulnerabilities

    Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about thes…

    Cisco Cisco Small Business RV Series Router Firmware Network devices
  • Medium 6.8
    CVE-2021-21423 Public exploit

    Exposure of Version-Control Repository to an Unauthorized Control Sphere in projen

    `projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GitHub Workflows, `eslint`, `jest`, and more, from a well-typed definition written in JavaScript. Users of projen's `Node…

    projen projen projen projen npm PyPI
  • Medium 6.1
    CVE-2021-30109 Public exploit

    Cross-site Scripting in Froala Editor

    Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS). Under certain conditions, a base64 crafted string leads to persistent Cross-site scripting (XSS) vulnerability within the hyperlink creation module.

    froala-editor npm
  • Medium 5.3
    CVE-2021-28164 Public exploit EPSS 82%

    Authorization Before Parsing and Canonicalization in jetty

    In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml …

    The Eclipse Foundation Eclipse Jetty jetty9 equinox-bundles Debian Ubuntu Maven