Skip to content
OpenAdvisories

Archive

21 July 2021

Vulnerabilities first published on this day (UTC), newest first.

← June 2021 2021 / July /21 August 2021 →
  1. 157
  2. 263
  3. 3 
  4. 4 
  5. 56
  6. 626
  7. 7108
  8. 866
  9. 961
  10. 102
  11. 115
  12. 1288
  13. 13139
  14. 14172
  15. 1583
  16. 1657
  17. 175
  18. 181
  19. 1961
  20. 20174
  21. 2185
  22. 2290
  23. 2320
  24. 241
  25. 2534
  26. 2662
  27. 2740
  28. 2828
  29. 2928
  30. 3016
  31. 316
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.8
    CVE-2021-32776

    No CSRF form token cleanup on Windows servers

    Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows servers no cleanup is done on CSRF tokens. This issue is fixed in versions 2.7.4 and 3.0.0.

    Combodo iTop
  • Medium 5.4
    CVE-2021-23408

    Prototype Pollution

    This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.

    com.graphhopper:graphhopper-web-bundle Maven
  • Medium 5.8
    CVE-2021-21406

    Command Injection vulnerability in the Setup Wizard

    Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability in the Setup Wizard when providing Graphviz executable path. The vulnerability is patched in version 2.7.4 and 3.0.0.

    Combodo iTop
  • Medium 5.4
    CVE-2021-23411

    Cross-site Scripting (XSS)

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the main functionality. It accepts input that can result in the output (an anchor a tag) containing undesirable Javascript code that can be executed upon user interaction.

    anchorme npm
  • Medium 6.5
    CVE-2021-22145 Public exploit EPSS 76%

    Generation of Error Message Containing Sensitive Information in Elasticsearch

    A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing p…

    Elastic Elasticsearch elasticsearch org.elasticsearch.client:elasticsearch-rest-client Ubuntu Maven
  • Medium 4.4
    CVE-2021-1103

    NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a NULL…

    NVIDIA NVIDIA Virtual GPU Software
  • Medium 5.5
    CVE-2021-1102

    NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can lead to floating p…

    NVIDIA NVIDIA Virtual GPU Software
  • Medium 5.5
    CVE-2021-1101

    NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a NULL…

    NVIDIA NVIDIA Virtual GPU Software
  • Medium 6.2
    CVE-2021-1100

    NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager kernel mode driver (nvidia.ko), in which a poi…

    NVIDIA NVIDIA Virtual GPU Software