Archive
June 2021
Vulnerabilities first published in this month (UTC), newest first.
1,711 results · Feed
-
Unscored —
RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation i…
-
Unscored —
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.
-
High 7.2
Vulnerability in Roon Server
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. Roon Labs has already fixed this vulnerability in the following versions: Roon Server 2021-05-18 and later
-
High 7.5
Vulnerability in Roon Server
If exploited, this vulnerability allows an attacker to access resources which are not otherwise accessible without proper authentication. Roon Labs has already fixed this vulnerability in the following versions: Roon Server 2021-05-18 and later
-
High 7.5
Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks
In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addr…
-
High 7.5CVE-2021-33560 Public exploit
Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to addre…
-
Unscored —
An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a remote server t…
-
Unscored —
A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker c…
-
Unscored —
An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.…
-
Unscored —
An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.…
-
Unscored —
The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 b…
-
Unscored —
EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before versio…
-
Unscored —CVE-2021-26078 Public exploit
The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 befor…
-
Critical 10.0CVE-2021-32671 EPSS 40%
XSS vulnerability with translator
Flarum is a forum software for building communities. Flarum's translation system allowed for string inputs to be converted into HTML DOM nodes when rendered. This change was made after v0.1.0-beta.16 (our last beta before v1.0.0) and was not noticed or docume…
-
High 7.2
Reflected cross-site scripting issue in Datasette
Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#ref…
-
Unscored —CVE-2021-3277 EPSS 59%
Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the ren…
-
Critical 9.1
Improper Certificate Validation in WP-CLI framework
WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-C…
-
High 7.3
Arbitrary File Write via Archive Extraction (Zip Slip)
This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install functionality.
-
High 7.8
Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox
A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with view_hosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as we…
-
Unscored —
A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files i…
-
Unscored —
A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container c…
-
Unscored —
An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attack…
-
Unscored —
An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-roo…
-
Unscored —
Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install …
-
Unscored —
Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install …
-
Unscored —
Incorrect security UI in payments in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perfor…
-
Unscored —CVE-2021-30538 EPSS 16%
Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote atta…
-
Unscored —
Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote atta…
-
Unscored —
Insufficient policy enforcement in cookies in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass c…
-
Unscored —
Out of bounds read in V8 in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit stack …
-
Unscored —CVE-2021-30535 Public exploit
Double free in ICU in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corrupt…
-
Medium 6.5
Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to byp…
KEV Jun 27, 2022 -
Unscored —
Insufficient policy enforcement in iFrameSandbox in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to by…
-
Unscored —
Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote atta…
-
Unscored —
Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote atta…
-
Unscored —
Out of bounds memory access in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to perform out…
-
Unscored —
Use after free in Bookmarks in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install …
-
Unscored —
Use after free in WebUI in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a ma…
-
Unscored —
Out of bounds write in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to inst…