Skip to content
OpenAdvisories

Archive

5 May 2021

Vulnerabilities first published on this day (UTC), newest first.

← April 2021 2021 / May /5 June 2021 →
  1. 1 
  2. 21
  3. 319
  4. 414
  5. 588
  6. 6106
  7. 7105
  8. 8 
  9. 91
  10. 1055
  11. 11141
  12. 1247
  13. 1363
  14. 14170
  15. 15 
  16. 165
  17. 1778
  18. 1841
  19. 1930
  20. 2061
  21. 2150
  22. 2218
  23. 23 
  24. 2493
  25. 2555
  26. 26105
  27. 2784
  28. 2865
  29. 296
  30. 30 
  31. 3120
All Critical High Medium Low Exploited only Public exploit

88 results · Feed

  • Critical 9.8
    CVE-2021-31800 Public exploit EPSS 19%

    Path traversal in impacket

    Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22. An attacker that connects to a running smbserver instance can list and write to arbitrary files via ../ directory traversal. This could potentially be abused to achieve …

    impacket impacket impacket py3-impacket Debian Ubuntu Alpine PyPI
  • Low 3.3
    CVE-2021-25317

    cups: ownership of /var/log/cups allows the lp user to create files as root

    A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to cre…

    SUSE openSUSE Factory openSUSE Leap 15.2 Linux
  • High 7.8
    CVE-2021-25319

    virtualbox: missing sticky bit for /etc/vbox allows local root exploit for members of vboxusers group

    A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to root. This issue affects: openSUSE Factory virtualbox version 6.1.20-1.1 and prior versions.

    openSUSE Factory virtualbox Ubuntu
  • Unscored —
    CVE-2020-36333 Scanner template

    themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a reset_wizar…

  • Unscored —
    CVE-2020-36334

    themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database.

  • Unscored —
    CVE-2020-22428

    SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting (XSS) via a directory name (entered by an …

  • Unscored —
    CVE-2021-25179

    SolarWinds Serv-U before 15.2 is affected by Cross Site Scripting (XSS) via the HTTP Host header.

  • High 7.5
    CVE-2021-31542

    Path Traversal in Django

    In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

    python-django django python-django Debian Ubuntu PyPI