Skip to content
OpenAdvisories

Archive

3 May 2021

Vulnerabilities first published on this day (UTC), newest first.

← April 2021 2021 / May /3 June 2021 →
  1. 1 
  2. 21
  3. 319
  4. 414
  5. 588
  6. 6106
  7. 7105
  8. 8 
  9. 91
  10. 1055
  11. 11141
  12. 1247
  13. 1363
  14. 14170
  15. 15 
  16. 165
  17. 1778
  18. 1841
  19. 1930
  20. 2061
  21. 2150
  22. 2218
  23. 23 
  24. 2493
  25. 2555
  26. 26105
  27. 2784
  28. 2865
  29. 296
  30. 30 
  31. 3120
All Critical High Medium Low Exploited only Public exploit

19 results · Feed

  • Unscored —
    CVE-2020-23015

    An open redirect issue was discovered in OPNsense through 20.1.5. The redirect parameter "url" in login page was not fi…

  • Unscored —
    CVE-2021-32020

    The kernel in Amazon Web Services FreeRTOS before 10.4.3 has insufficient bounds checking during management of heap mem…

  • Unscored —
    CVE-2020-23083

    Unrestricted File Upload in JEECG v4.0 and earlier allows remote attackers to execute arbitrary code or gain privileges…

  • Unscored —
    CVE-2020-35758

    An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. There is a Authentication Bypass in the Web Interfac…

  • Unscored —
    CVE-2020-35757

    An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. There is Unauthenticated Root ADB Access Over TCP. T…

  • Unscored —
    CVE-2020-35756

    An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. There is a luci_service GETPASS Configuration Passwo…

  • Unscored —
    CVE-2020-35755

    An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. There is a luci_service Read_ NVRAM Direct Access In…

  • Unscored —
    CVE-2020-28945

    OX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature, such as ![](http://one…

  • Medium 5.2
    CVE-2021-21264

    Bypass of fix for CVE-2020-26231, Twig sandbox escape

    October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-26231 (fixed in 1.0.470/471 and 1.1.1) was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247. An authenticated backend user …

    octobercms october october/cms Packagist
  • Unscored —
    CVE-2020-20218

    Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/traceroute pr…

  • Unscored —
    CVE-2020-20247

    Mikrotik RouterOs before 6.46.5 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/tracerout…

  • Unscored —
    CVE-2021-29242

    CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication …

  • Unscored —
    CVE-2021-29239

    CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries wi…

  • Unscored —
    CVE-2021-29238

    CODESYS Automation Server before 1.16.0 allows cross-site request forgery (CSRF).

  • High 7.5
    CVE-2021-29241

    CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).

  • High 7.1
    CVE-2021-28860

    Use of Potentially Dangerous Function in mixme

    In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability…

    mixme npm
  • Critical 9.8
    CVE-2021-29369

    Code injection in @rkesters/gnuplot

    The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.

    @rkesters/gnuplot npm
  • Unscored —
    CVE-2021-25631

    denylist of executable filename extensions possible to bypass under windows

    In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so it doesn't match the denylist but results in ShellExecute attempting to launch an executab…

    The Document Foundation LibreOffice libreoffice Alpine
  • High 7.5
    CVE-2021-31996

    Double free in algorithmica

    An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. There is a double free in merge_sort::merge().

    algorithmica crates.io