Skip to content
OpenAdvisories

Archive

25 May 2021

Vulnerabilities first published on this day (UTC), newest first.

← April 2021 2021 / May /25 June 2021 →
  1. 1 
  2. 21
  3. 319
  4. 414
  5. 588
  6. 6106
  7. 7105
  8. 8 
  9. 91
  10. 1055
  11. 11141
  12. 1247
  13. 1363
  14. 14170
  15. 15 
  16. 165
  17. 1778
  18. 1841
  19. 1930
  20. 2061
  21. 2150
  22. 2218
  23. 23 
  24. 2493
  25. 2555
  26. 26105
  27. 2784
  28. 2865
  29. 296
  30. 30 
  31. 3120
All Critical High Medium Low Exploited only Public exploit

55 results · Feed

  • Unscored —
    CVE-2021-31924

    Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, co…

    pam-u2f pam-u2f Debian Alpine
  • Critical 9.8
    CVE-2021-33575

    Remote code execution in ruby-jss

    The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load during XML document processing.

    ruby-jss RubyGems
  • Unscored —
    CVE-2021-33570 Public exploit

    Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can…

  • Unscored —
    CVE-2016-20011

    libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers t…

    libgrss libgrss libgrss Debian Ubuntu Alpine
  • Unscored —
    CVE-2020-25672

    A memory leak vulnerability was found in Linux kernel in llcp_sock_connect

    linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu
  • Unscored —
    CVE-2021-20209

    A memory leak vulnerability was found in Privoxy before 3.0.29 in the show-status CGI handler when no action files are …

    privoxy privoxy Debian Ubuntu
  • Unscored —
    CVE-2020-20453

    FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aaccoder, which allows a remote malicious user to cause…

    ffmpeg ffmpeg ffmpeg ffmpeg4 Debian Ubuntu Alpine
  • Critical 9.8
    CVE-2021-25946

    Prototype pollution in nconf-toml

    Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.

    nconf-toml npm
  • Unscored —
    CVE-2020-20451

    Denial of Service issue in FFmpeg 4.2 due to resource management errors via fftools/cmdutils.c.

    ffmpeg ffmpeg Debian Ubuntu
  • Medium —
    CVE-2021-25934

    OpenNMS Horizon vulnerable to XSS

    In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to …

    org.opennms:opennms Maven
  • Unscored —
    CVE-2021-25935

    In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-…

  • Medium 5.5
    CVE-2021-27562 Exploited

    In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the prin…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-25944

    deep-defaults vulnerable to prototype pollution

    Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.

    deep-defaults npm
  • Medium 5.3
    CVE-2021-32640

    ReDoS in Sec-Websocket-Protocol header

    ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websock…

    websockets ws ws node-ws Debian Ubuntu npm
  • Unscored —
    CVE-2020-20450

    FFmpeg 4.2 is affected by null pointer dereference passed as argument to libavformat/aviobuf.c, which could cause a Den…

    ffmpeg ffmpeg ffmpeg ffmpeg4 Debian Ubuntu Alpine
  • Unscored —
    CVE-2020-20448

    FFmpeg 4.1.3 is affected by a Divide By Zero issue via libavcodec/ratecontrol.c, which allows a remote malicious user t…

    ffmpeg Debian
  • Unscored —
    CVE-2020-20446

    FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aacpsy.c, which allows a remote malicious user to cause…

    ffmpeg ffmpeg ffmpeg ffmpeg4 Debian Ubuntu Alpine
  • Unscored —
    CVE-2020-20445

    FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/lpc.h, which allows a remote malicious user to cause a …

    ffmpeg ffmpeg Debian Ubuntu
  • Medium 4.4
    CVE-2021-32638

    CodeQL runner: Command-line options that make GitHub access tokens visible to other processes are now deprecated

    Github's CodeQL action is provided to run CodeQL-based code scanning on non-GitHub CI/CD systems and requires a GitHub access token to connect to a GitHub repository. The runner and its documentation previously suggested passing the GitHub token as a command-…

    GitHub codeql-action
  • Medium 6.7
    CVE-2021-29708

    IBM Spectrum Scale 5.1.0.1 could allow a local with access to the GUI pod container to obtain sensitive cryptographic k…

    IBM Spectrum Scale
  • Medium 4.9
    CVE-2021-29695

    IBM Host firmware for LC-class Systems could allow a remote attacker to traverse directories on the system. An attacker…

    IBM 8335-GTA 8335-GTB 8335-GCA
  • Medium 4.9
    CVE-2020-4839

    IBM Host firmware for LC-class Systems is vulnerable to a stack based buffer overflow, caused by improper bounds checki…

    IBM 8335-GTB 8335-GCA 8335-GTA
  • Unscored —
    CVE-2021-29209

    A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 38…

  • Unscored —
    CVE-2021-29208

    A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 38…

  • Unscored —
    CVE-2021-29211

    A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrat…

  • Unscored —
    CVE-2021-29210

    A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 38…

  • Medium 5.4
    CVE-2021-21660

    XSS vulnerability in Jenkins Markdown Formatter Plugin

    Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured mark…

    Jenkins Project Jenkins Markdown Formatter Plugin io.jenkins.plugins:markdown-formatter Web / CMS Maven
  • High 8.1
    CVE-2021-21659 EPSS 67%

    XXE vulnerability in Jenkins URLTrigger Plugin

    Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    Jenkins Project Jenkins URLTrigger Plugin org.jenkins-ci.plugins:urltrigger Web / CMS Maven
  • Critical 9.1
    CVE-2021-21658

    XML external entity vulnerability in Jenkins Nuget Plugin

    Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    Jenkins Project Jenkins Nuget Plugin org.jenkins-ci.plugins:nuget Web / CMS Maven
  • High 8.8
    CVE-2021-21657

    XXE vulnerability in Jenkins Filesystem Trigger Plugin

    Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    Jenkins Project Jenkins Filesystem Trigger Plugin org.jenkins-ci.plugins:fstrigger Web / CMS Maven
  • Unscored —
    CVE-2021-29207

    A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrat…

  • Unscored —
    CVE-2021-29206

    A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrat…

  • Unscored —
    CVE-2021-27823

    An information disclosure vulnerability was discovered in /index.class.php (via port 8181) on NetWave System 1.0 which …

  • Unscored —
    CVE-2021-33425

    A stored cross-site scripting (XSS) vulnerability was discovered in the Web Interface for OpenWRT LuCI version 19.07 wh…

  • Unscored —
    CVE-2021-27821

    The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting vulnerabi…

  • Unscored —
    CVE-2021-29205

    A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrat…

  • Unscored —
    CVE-2021-29204

    A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrat…

  • Unscored —
    CVE-2021-29202

    A local buffer overflow vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; H…

  • Unscored —
    CVE-2021-29201

    A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrat…

  • Unscored —
    CVE-2021-30195

    CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.