Skip to content
OpenAdvisories

Archive

10 June 2021

Vulnerabilities first published on this day (UTC), newest first.

← May 2021 2021 / June /10 July 2021 →
  1. 179
  2. 278
  3. 353
  4. 460
  5. 5 
  6. 67
  7. 763
  8. 8108
  9. 9184
  10. 1075
  11. 11158
  12. 1214
  13. 131
  14. 1432
  15. 1557
  16. 1688
  17. 1733
  18. 1840
  19. 19 
  20. 201
  21. 2182
  22. 22104
  23. 2337
  24. 24103
  25. 2547
  26. 26 
  27. 271
  28. 2875
  29. 2962
  30. 3069
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium 5.4
    CVE-2021-23393

    Open Redirect

    This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulner…

    flask-unchained PyPI
  • Medium 6.8
    CVE-2021-20329

    Specific cstrings input may not be properly validated in the Go Driver

    Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue aff…

    MongoDB MongoDB Go Driver go.mongodb.org/mongo-driver Go
  • Medium 4.8
    CVE-2021-31839

    Incorrect permissions on McAfee Agent for Windows event folder

    Improper privilege management vulnerability in McAfee Agent for Windows prior to 5.7.3 allows a local user to modify event information in the MA event folder. This allows a local user to either add false events or remove events from the event logs prior to th…

    McAfee,LLC McAfee Agent for Windows Windows
  • Medium 6.1
    CVE-2021-21666

    Cross-site scripting in Jenkins Kiuwan Plugin

    Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.

    Jenkins Project Jenkins Kiuwan Plugin org.jenkins-ci.plugins:kiuwanJenkinsPlugin Web / CMS Maven
  • Medium 6.5
    CVE-2021-21664

    Incorrect permission check in XebiaLabs XL Deploy Plugin allows capturing credentials

    An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing …

    Jenkins Project Jenkins XebiaLabs XL Deploy Plugin com.xebialabs.deployit.ci:deployit-plugin Web / CMS Maven
  • Medium 4.3
    CVE-2021-21663

    Missing permission check in Jenkins XebiaLabs XL Deploy Plugin allows capturing credentials

    A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Userna…

    Jenkins Project Jenkins XebiaLabs XL Deploy Plugin com.xebialabs.deployit.ci:deployit-plugin Web / CMS Maven
  • Medium 4.3
    CVE-2021-21662

    Missing permission check in Jenkins XebiaLabs XL Deploy Plugin allows enumerating credentials IDs

    A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.

    Jenkins Project Jenkins XebiaLabs XL Deploy Plugin com.xebialabs.deployit.ci:deployit-plugin Web / CMS Maven
  • Medium 4.3
    CVE-2021-21661

    Missing Authorization in Jenkins Kubernetes CLI Plugin

    Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

    Jenkins Project Jenkins Kubernetes CLI Plugin org.jenkins-ci.plugins:kubernetes-cli Web / CMS Maven
  • Medium 6.7
    CVE-2021-3040

    Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution

    An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.139. Checkov 1.0 versions are not impact…

    Palo Alto Networks Bridgecrew Checkov Network devices
  • Medium 6.8
    CVE-2021-25322

    python-HyperKitty: hyperkitty-permissions.sh used during %post allows local privilege escalation from hyperkitty user to root

    A UNIX Symbolic Link (Symlink) Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from the user hyperkitty or hyperkitty-admin to root. This issue affects: openSUSE Leap 15.2 python-HyperK…

    openSUSE Factory Leap 15.2 hyperkitty Ubuntu
  • Medium 6.8
    CVE-2021-31997

    python-postorius: postorius-permissions.sh used during %post allows local privilege escalation from postorius user to root

    A UNIX Symbolic Link (Symlink) Following vulnerability in python-postorius of openSUSE Leap 15.2, Factory allows local attackers to escalate from users postorius or postorius-admin to root. This issue affects: openSUSE Leap 15.2 python-postorius version 1.3.2…

    openSUSE Factory Leap 15.2
  • Medium 6.8
    CVE-2021-31998

    inn: %post calls user owned file allowing local privilege escalation to root

    A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2 allows local attackers to escalate their privileges from the news user to root. This issue affects:…

    SUSE openSUSE openSUSE Leap 15.2 SUSE Linux Enterprise Server 11-SP3 Linux Ubuntu
  • Medium 6.1
    CVE-2021-20293

    Cross-Site Scripting

    A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to…

    org.jboss.resteasy:resteasy-bom org.jboss.resteasy:resteasy-core Maven