Skip to content
OpenAdvisories

Archive

21 May 2021

Vulnerabilities first published on this day (UTC), newest first.

← April 2021 2021 / May /21 June 2021 →
  1. 1 
  2. 21
  3. 319
  4. 414
  5. 588
  6. 6106
  7. 7105
  8. 8 
  9. 91
  10. 1055
  11. 11141
  12. 1247
  13. 1363
  14. 14170
  15. 15 
  16. 165
  17. 1778
  18. 1841
  19. 1930
  20. 2061
  21. 2150
  22. 2218
  23. 23 
  24. 2493
  25. 2555
  26. 26105
  27. 2784
  28. 2865
  29. 296
  30. 30 
  31. 3120
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 6.1
    CVE-2021-33507

    Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone

    Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.

    plone products-pluggableauthservice products-cmfcore PyPI
  • Medium 5.4
    CVE-2021-33508

    Cross-site scripting in Plone

    Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.

    plone PyPI
  • Medium 4.3
    CVE-2021-33510

    Server-Side Request Forgery in Plone

    Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.

    plone PyPI
  • Medium 5.4
    CVE-2021-33512

    Cross-site scripting in Plone

    Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.

    plone PyPI
  • Medium 5.4
    CVE-2021-33513

    Cross-site scripting in Plone

    Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.

    plone PyPI
  • Medium 5.2
    CVE-2021-21552

    Dell Wyse Windows Embedded System versions WIE10 LTSC 2019 and earlier contain an improper authorization vulnerability.…

    Dell Wyse Windows Embedded (WES) Windows
  • Medium —
    GHSA-3wxm-m9m4-cprj

    Import of incorrectly embargoed keys could cause early publication

    ### Impact If your installation is using the `export-importer` service, there is potential impact. If your installation is not importing keys via the `export-importer` services, your installation is not impacted. In versions `0.19.1` and earlier, the `export-…

    github.com/google/exposure-notifications-server Go
  • Medium 6.6
    GHSA-6w87-g839-9wv7

    Helm OCI credentials leaked into Argo CD logs

    ### Impact When Argo CD was connected to a Helm OCI repository with authentication enabled, the credentials used for accessing the remote repository were logged. Anyone with access to the pod logs - either via access with appropriate permissions to the Kubern…

    github.com/argoproj/argo-cd Go
  • Medium —
    GHSA-9vxv-wpv4-f52p

    Information leakage in Error Handler

    ### Impact Information leakage in Error Handler ### Patches We recommend updating to the current version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Security…

    shopware/shopware Packagist
  • Medium —
    GHSA-f6p7-8xfw-fjqq

    Authenticated Stored XSS in Administration

    ### Impact Authenticated Stored XSS in Administration ### Patches We recommend updating to the current version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Se…

    shopware/shopware Packagist
  • Medium 6.8
    CVE-2021-32633

    Remote Code Execution via traversal in TAL expressions

    Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Pag…

    zopefoundation Zope zope PyPI