Skip to content
OpenAdvisories

Archive

13 May 2021

Vulnerabilities first published on this day (UTC), newest first.

← April 2021 2021 / May /13 June 2021 →
  1. 1 
  2. 21
  3. 319
  4. 414
  5. 588
  6. 6106
  7. 7105
  8. 8 
  9. 91
  10. 1055
  11. 11141
  12. 1247
  13. 1363
  14. 14170
  15. 15 
  16. 165
  17. 1778
  18. 1841
  19. 1930
  20. 2061
  21. 2150
  22. 2218
  23. 23 
  24. 2493
  25. 2555
  26. 26105
  27. 2784
  28. 2865
  29. 296
  30. 30 
  31. 3120
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium —
    CVE-2019-10062

    Cross-site Scripting in aurelia-framework

    The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via …

    aurelia-framework npm
  • Medium 5.3
    CVE-2021-23910

    An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. There is …

  • Medium 6.3
    CVE-2021-23909

    An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The SH2 M…

  • Medium 6.5
    CVE-2021-29506

    Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.

    GraphHopper is an open-source Java routing engine. In GrassHopper from version 2.0 and before version 2.4, there is a regular expression injection vulnerability that may lead to Denial of Service. This has been patched in 2.4 and 3.0 See this pull request for…

    graphhopper graphhopper com.graphhopper:graphhopper-nav Maven
  • Medium 5.3
    CVE-2021-22137

    Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch

    In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain cross-cluster search queries. This could…

    Elastic Elasticsearch elasticsearch org.elasticsearch:elasticsearch Ubuntu Maven
  • Medium 5.3
    CVE-2021-22135

    API information disclosure flaw in Elasticsearch

    Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index wh…

    Elastic Elasticsearch elasticsearch org.elasticsearch:elasticsearch Ubuntu Maven
  • Medium 6.5
    CVE-2021-20535

    IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may…

    IBM Jazz Reporting Service
  • Medium 5.3
    CVE-2020-12526

    BECKHOFF: DoS-Vulnerability for TwinCAT OPC UA Server and IPC Diagnostics UA Server

    TwinCAT OPC UA Server in versions up to 2.3.0.12 and IPC Diagnostics UA Server in versions up to 3.1.0.1 from Beckhoff Automation GmbH & Co. KG are vulnerable to denial of service attacks. The attacker needs to send several specifically crafted requests to th…

    Beckhoff IPC Diagnostics UA Server TwinCAT OPC UA Server TF6100 ICS / OT
  • Medium 5.3
    CVE-2021-20996

    WAGO: Managed Switches: Unsecure Cookie settings

    In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties.

    WAGO 0852-1505/000-001 0852-1305 0852-1305/000-001 ICS / OT
  • Medium 5.3
    CVE-2021-20995

    WAGO: Managed Switches: Storage of user credentials in a cookie

    In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials.

    WAGO 0852-1305 0852-1305/000-001 0852-0303 ICS / OT
  • Medium 5.3
    CVE-2021-20993

    WAGO: Managed Switches: Exposure of sensitive information through directory listing

    In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside the directory.

    WAGO 0852-1305 0852-1305/000-001 0852-0303 ICS / OT
  • Medium 4.3
    CVE-2021-20250

    JBoss EJB Client information disclosure vulnerability

    A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality.

    org.jboss:jboss-ejb-client Maven
  • Medium 4.2
    CVE-2021-20331

    MongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an application

    Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "s…

    MongoDB MongoDB C Driver MongoDB.Driver NuGet
  • Medium 6.7
    CVE-2020-36198

    Command Injection Vulnerability in Malware Remover

    A command injection vulnerability has been reported to affect certain versions of Malware Remover. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Malware Remover versions prior to …

    QNAP Systems Malware Remover
  • Medium 5.3
    CVE-2021-21424 Public exploit

    Prevent user enumeration using Guard or the new Authenticator-based Security

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting t…

    symfony symfony symfony/symfony symfony Debian Ubuntu Packagist