Skip to content
OpenAdvisories

Archive

28 May 2021

Vulnerabilities first published on this day (UTC), newest first.

← April 2021 2021 / May /28 June 2021 →
  1. 1 
  2. 21
  3. 319
  4. 414
  5. 588
  6. 6106
  7. 7105
  8. 8 
  9. 91
  10. 1055
  11. 11141
  12. 1247
  13. 1363
  14. 14170
  15. 15 
  16. 165
  17. 1778
  18. 1841
  19. 1930
  20. 2061
  21. 2150
  22. 2218
  23. 23 
  24. 2493
  25. 2555
  26. 26105
  27. 2784
  28. 2865
  29. 296
  30. 30 
  31. 3120
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 5.7
    CVE-2021-29507

    dlt-daemon could crash if there is special character in dlt.conf

    GENIVI Diagnostic Log and Trace (DLT) provides a log and trace interface. In versions of GENIVI DLT between 2.10.0 and 2.18.6, a configuration file containing the special characters could cause a vulnerable component to crash. All the applications which are u…

    GENIVI dlt-daemon dlt-daemon dlt-daemon Debian Ubuntu
  • Medium 6.3
    CVE-2021-32635

    Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint

    Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the conta…

    sylabs singularity singularity-container singularity Ubuntu Alpine Go
  • Medium —
    GHSA-5vm8-hhgr-jcjp

    Cross-site scripting vulnerability in TinyMCE

    ### Impact A cross-site scripting (XSS) vulnerability was discovered in the URL sanitization logic of the core parser for `form` elements. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the ed…

    tinymce npm
  • Medium 5.3
    CVE-2021-32646

    Escalation of permissions in roomer

    Roomer is a discord bot cog (extension) which provides automatic voice channel generation as well as private voice and text channels. A vulnerability has been discovered allowing discord users to get the ``manage channel`` permissions in a private VC they hav…

    Dav-Git Dav-Cogs
  • Medium 4.0
    CVE-2020-1729

    Permissions bypass in SmallRye

    A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vu…

    io.smallrye.config:smallrye-config Maven
  • Medium 6.5
    CVE-2021-20278

    Kiali Authentication Bypass vulnerability

    An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used. When RBAC is enabled, Kiali assumes that some of the token validation is handled by the underlying cluster. When OpenID `imp…

    github.com/kiali/kiali Go
  • Medium 6.5
    CVE-2021-32543

    SysJust CTS Web - Broken Authentication

    The CTS Web transaction system related to authentication management is implemented incorrectly. After login, remote attackers can manipulate cookies to access other accounts and trade in the stock market with spoofed identity.

    SysJust CTS Web
  • Medium 5.3
    CVE-2021-32541

    SysJust CTS Web - Broken Access Control

    The CTS Web transaction system related to authentication and session management is implemented incorrectly, which allows remote unauthenticated attackers can send a large number of valid usernames, and force those logged-in account to log out, causing the use…

    SysJust CTS Web
  • Medium 4.7
    CVE-2021-32542

    SysJust CTS Web - Reflected XSS

    The parameters of the specific functions in the CTS Web trading system do not filter special characters, which allows unauthenticated attackers can remotely perform reflected XSS and obtain the users’ connection token that triggered the attack.

    SysJust CTS Web
  • Medium 5.4
    CVE-2021-32540

    Hundred Plus 101EIP - Stored XSS-2

    Add announcement function in the 101EIP system does not filter special characters, which allows authenticated users to inject JavaScript and perform a stored XSS attack.

    Hundred Plus 101EIP
  • Medium 5.4
    CVE-2021-32539

    Hundred Plus 101EIP - Stored XSS-1

    Add event in calendar function in the 101EIP system does not filter special characters in specific fields, which allows remote authenticated users to inject JavaScript and perform a stored XSS attack.

    Hundred Plus 101EIP
  • Medium 6.5
    CVE-2021-33620 EPSS 80%

    Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to al…

    squid squid3 squid squid Debian Ubuntu Alpine