Skip to content
OpenAdvisories

Archive

4 May 2021

Vulnerabilities first published on this day (UTC), newest first.

← April 2021 2021 / May /4 June 2021 →
  1. 1 
  2. 21
  3. 319
  4. 414
  5. 588
  6. 6106
  7. 7105
  8. 8 
  9. 91
  10. 1055
  11. 11141
  12. 1247
  13. 1363
  14. 14170
  15. 15 
  16. 165
  17. 1778
  18. 1841
  19. 1930
  20. 2061
  21. 2150
  22. 2218
  23. 23 
  24. 2493
  25. 2555
  26. 26105
  27. 2784
  28. 2865
  29. 296
  30. 30 
  31. 3120
All Critical High Medium Low Exploited only Public exploit

14 results · Feed

  • High 7.8
    GHSA-4whq-r978-2x68

    Arbitrary code execution in ExifTool

    ### Impact Arbitrary code execution can occur when running `exiftool` against files with hostile metadata payloads. ### Patches ExifTool has already been patched in version 12.24. exiftool-vendored, which vendors ExifTool, includes this patch in v14.3.0. ### …

    exiftool-vendored npm
  • Unscored —
    CVE-2021-26804

    Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validati…

  • High 7.5
    CVE-2021-29478

    Vulnerability in the COPY command for large intsets

    Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis 6.2 before 6.2.3 could be exploited to corrupt the heap and potentially result with remote code execution. …

    Redis Redis redis Debian
  • Medium 6.4
    CVE-2020-4987

    The IBM FlashSystem 900 user management GUI is vulnerable to stored cross-site scripting in code versions 1.5.2.8 and p…

    IBM FlashSystem 900
  • Unscored —
    CVE-2020-21999

    iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using d…

  • High 8.8
    CVE-2021-21551 Exploited Public exploit EPSS 80%

    Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privil…

    Dell dbutil
    KEV Mar 31, 2022
  • High 7.5
    CVE-2021-29477

    Vulnerability in the STRALGO LCS command

    Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially…

    Redis Redis redis redis Debian Alpine
  • Unscored —
    CVE-2020-27518

    All versions of Windscribe VPN for Mac and Windows <= v2.02.10 contain a local privilege escalation vulnerability in th…

  • Medium 6.3
    CVE-2021-22547

    Buffer overrun in Google Cloud IoT Device SDK for Embedded C

    In IoT Devices SDK, there is an implementation of calloc() that doesn't have a length check. An attacker could pass in memory objects larger than the buffer and wrap around to have a smaller buffer than required, allowing the attacker access to the other part…

    Google Google Cloud IoT Device SDK for Embedded C
  • Unscored —
    CVE-2021-3154

    An issue was discovered in SolarWinds Serv-U before 15.2.2. Unauthenticated attackers can retrieve cleartext passwords …

  • Unscored —
    CVE-2021-29240

    The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before inst…

  • Medium 5.6
    CVE-2021-23383 Public exploit

    Prototype Pollution

    The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

    handlebars node-handlebars node-handlebars Debian Ubuntu npm
  • Medium 5.3
    CVE-2021-23343

    Regular Expression Denial of Service (ReDoS)

    All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

    path-parse npm
  • High 7.5
    CVE-2021-31164

    Apache Unomi log injection

    Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements.

    Apache Software Foundation Apache Unomi org.apache.unomi:unomi Maven