Skip to content
OpenAdvisories

Archive

11 May 2021

Vulnerabilities first published on this day (UTC), newest first.

← April 2021 2021 / May /11 June 2021 →
  1. 1 
  2. 21
  3. 319
  4. 414
  5. 588
  6. 6106
  7. 7105
  8. 8 
  9. 91
  10. 1055
  11. 11141
  12. 1247
  13. 1363
  14. 14170
  15. 15 
  16. 165
  17. 1778
  18. 1841
  19. 1930
  20. 2061
  21. 2150
  22. 2218
  23. 23 
  24. 2493
  25. 2555
  26. 26105
  27. 2784
  28. 2865
  29. 296
  30. 30 
  31. 3120
All Critical High Medium Low Exploited only Public exploit

141 results · Feed

  • Medium 4.9
    CVE-2021-27617

    The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does …

    SAP SAP Process Integration (Integration Builder Framework)
  • High 7.3
    CVE-2021-27614

    SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One on SAP…

    SAP SAP Business One, version for SAP HANA (Cookbooks)
  • Medium 4.9
    CVE-2021-27618

    The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does …

    SAP SAP Process Integration (Integration Builder Framework)
  • High 7.8
    CVE-2021-27616

    Under certain conditions, SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to insta…

    SAP SAP Business One, version for SAP HANA (Cookbooks)
  • High 7.1
    CVE-2021-21655

    Cross-Site Request Forgery in Jenkins P4 Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified Perforce server using attacker-specified username and password.

    Jenkins Project Jenkins P4 Plugin org.jenkins-ci.plugins:p4 Web / CMS Maven
  • High 7.1
    CVE-2021-21656

    XML external entity (XXE) attacks in Jenkins Xcode integration Plugin

    Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    Jenkins Project Jenkins Xcode integration Plugin org.jenkins-ci.plugins:xcode-plugin Web / CMS Maven
  • Medium 4.3
    CVE-2021-21654

    Missing Authorization in Jenkins P4 plugin

    Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password.

    Jenkins Project Jenkins P4 Plugin org.jenkins-ci.plugins:p4 Web / CMS Maven
  • High 7.1
    CVE-2021-21652

    CSRF vulnerability in Jenkins Xray - Test Management for Jira Plugin allows capturing credentials

    A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing …

    Jenkins Project Jenkins Xray - Test Management for Jira Plugin org.jenkins-ci.plugins:xray-connector Web / CMS Maven
  • Medium 4.3
    CVE-2021-21653

    Missing Authorization in jenkins xray-connector

    Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

    Jenkins Project Jenkins Xray - Test Management for Jira Plugin org.jenkins-ci.plugins:xray-connector Web / CMS Maven
  • Medium 4.3
    CVE-2021-21651

    Missing Authorization in Jenkins S3 publisher Plugin

    Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain the list of configured profiles.

    Jenkins Project Jenkins S3 publisher Plugin org.jenkins-ci.plugins:s3 Web / CMS Maven
  • Medium 5.4
    CVE-2021-21649 EPSS 73%

    Cross-site Scripting in Jenkins Dashboard View Plugin

    Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.

    Jenkins Project Jenkins Dashboard View Plugin org.jenkins-ci.plugins:dashboard-view Web / CMS Maven
  • Medium 4.3
    CVE-2021-21650

    Missing Authorization in Jenkins S3 publisher Plugin

    Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Ar…

    Jenkins Project Jenkins S3 publisher Plugin org.jenkins-ci.plugins:s3 Web / CMS Maven
  • Medium 6.1
    CVE-2021-21648 EPSS 11%

    Cross-Site Request Forgery in Jenkins Credentials Plugin

    Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (XSS) vulnerability.

    Jenkins Project Jenkins Credentials Plugin org.jenkins-ci.plugins:credentials Web / CMS Maven
  • Unscored —
    CVE-2021-31537 Scanner template

    SIS SIS-REWE Go before 7.7 SP17 allows XSS: rewe/prod/web/index.php (affected parameters are config, version, win, db, …

  • Medium 6.1
    CVE-2021-32561

    OctoPrint API Error Messages vulnerable to XSS

    OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters.

    octoprint PyPI
  • Medium 6.5
    CVE-2021-32560

    OctoPrint Incorrect Access Control

    The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files.

    octoprint PyPI
  • Unscored —
    CVE-2021-21990

    VMware Workspace one UEM console (2102 prior to 21.2.0.8, 2101 prior to 21.1.0.14, 2011 prior to 20.11.0.27, 2010 prior…

  • Unscored —
    CVE-2020-35438

    Cross Site Scripting (XSS) vulnerability in the kk Star Ratings plugin before 4.1.5.

  • Unscored —
    CVE-2021-31897

    In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects.

  • Unscored —
    CVE-2021-31898

    In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS.

  • Unscored —
    CVE-2021-30482

    In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctly

  • Unscored —
    CVE-2021-31915

    In JetBrains TeamCity before 2020.2.4, OS command injection leading to remote code execution was possible.

  • Unscored —
    CVE-2021-31914

    In JetBrains TeamCity before 2020.2.4 on Windows, arbitrary code execution on TeamCity Server was possible.

  • Unscored —
    CVE-2021-31913

    In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirect_uri were made during GitHub SSO token exchan…

  • Unscored —
    CVE-2021-31912

    In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset.

  • Unscored —
    CVE-2021-31911

    In JetBrains TeamCity before 2020.2.3, reflected XSS was possible on several pages.

  • Unscored —
    CVE-2021-31910

    In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible.

  • Unscored —
    CVE-2021-31908

    In JetBrains TeamCity before 2020.2.3, stored XSS was possible on several pages.

  • Unscored —
    CVE-2021-31909

    In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible.

  • Unscored —
    CVE-2021-3315

    In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible.

  • Unscored —
    CVE-2021-31907

    In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly.

  • Unscored —
    CVE-2021-31906

    In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file.

  • Unscored —
    CVE-2021-26309

    Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary…

  • Unscored —
    CVE-2021-26310

    In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible.

  • Unscored —
    CVE-2021-31904

    In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page.

  • Unscored —
    CVE-2021-30005 Public exploit

    In JetBrains PyCharm before 2020.3.4, local code execution was possible because of insufficient checks when getting the…

  • Unscored —
    CVE-2021-31905

    In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible.

  • Unscored —
    CVE-2021-31902

    In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly.

  • Unscored —
    CVE-2021-31903

    In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS.

  • Unscored —
    CVE-2021-27733

    In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment.