Skip to content
OpenAdvisories

Archive

2 July 2021

Vulnerabilities first published on this day (UTC), newest first.

← June 2021 2021 / July /2 August 2021 →
  1. 157
  2. 263
  3. 3 
  4. 4 
  5. 56
  6. 626
  7. 7108
  8. 866
  9. 961
  10. 102
  11. 115
  12. 1288
  13. 13139
  14. 14172
  15. 1583
  16. 1657
  17. 175
  18. 181
  19. 1961
  20. 20174
  21. 2185
  22. 2290
  23. 2320
  24. 241
  25. 2534
  26. 2662
  27. 2740
  28. 2828
  29. 2928
  30. 3016
  31. 316
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 6.5
    CVE-2021-32738

    Utils.readChallengeTx does not verify the server account signature

    js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The `Utils.readChallengeTx` function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction i…

    stellar js-stellar-sdk stellar-sdk npm
  • Medium 5.4
    CVE-2020-36397

    LavaLite Stored Cross-site Scripting vulnerability

    A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.

    lavalite/cms Packagist
  • Medium 5.4
    CVE-2020-36396

    Stored XSS in LavaLite 5.8.0

    A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.

    lavalite/cms Packagist
  • Medium 5.4
    CVE-2020-36395

    Stored XSS in LavaLite 5.8.0

    A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.

    lavalite/cms Packagist
  • Medium 6.5
    CVE-2021-26920

    Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended

    In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of t…

    Apache Software Foundation Apache Druid fast-xml-parser org.apache.druid:druid-core npm Maven