Skip to content
OpenAdvisories

Archive

2 August 2021

Vulnerabilities first published on this day (UTC), newest first.

← July 2021 2021 / August /2 September 2021 →
  1. 11
  2. 2123
  3. 3112
  4. 484
  5. 593
  6. 652
  7. 712
  8. 867
  9. 968
  10. 1096
  11. 11117
  12. 12168
  13. 1364
  14. 141
  15. 154
  16. 16107
  17. 1773
  18. 1899
  19. 1933
  20. 2073
  21. 211
  22. 228
  23. 2395
  24. 24222
  25. 2575
  26. 2661
  27. 2732
  28. 28 
  29. 298
  30. 3089
  31. 3169
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Medium 5.3
    CVE-2021-21565

    Dell PowerScale OneFS versions 9.1.0.3 and earlier contain a denial of service vulnerability. SmartConnect had an error…

    Dell PowerScale OneFS
  • Medium 6.5
    CVE-2021-21563

    Dell EMC PowerScale OneFS versions 8.1.2-9.1.0.x contain an Improper Check for Unusual or Exceptional Conditions in its…

    Dell PowerScale OneFS
  • Medium 4.4
    CVE-2021-21562

    Dell EMC PowerScale OneFS contains an untrusted search path vulnerability. This vulnerability allows a user with (ISI_P…

    Dell PowerScale OneFS
  • Medium 6.1
    CVE-2021-37916

    Joplin vulnerable to Cross-site Scripting in notes

    Joplin before 2.0.9 allows XSS via button and form in the note body.

    joplin npm
  • Medium —
    CVE-2021-37914

    Workflow re-write vulnerability using input parameter

    In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.

    github.com/argoproj/argo-workflows/v3 github.com/argoproj/argo-workflows github.com/argoproj/argo-workflows/v2 Go
  • Medium 4.6
    CVE-2021-32812

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') and Improper Encoding or Escaping of Output in frontend/server/server.js

    Monkshu is an enterprise application server for mobile apps (iOS and Android), responsive HTML 5 apps, and JSON API services. In version 2.90 and earlier, there is a reflected cross-site scripting vulnerability in frontend HTTP server. The attacker can send i…

    TekMonksGitHub monkshu
  • Medium 6.1
    CVE-2021-34635

    Poll Maker <= 3.2.8 - Reflected Cross-Site Scripting

    The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the ~/admin/partials/settings/poll-maker-settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and includin…

    AYS Pro Extensions Poll Maker Web / CMS
  • Medium 6.5
    CVE-2021-32806

    URL Redirection to Untrusted Site ('Open Redirect') in Products.isurlinportal

    Products.isurlinportal is a replacement for isURLInPortal method in Plone. Versions of Products.isurlinportal prior to 1.2.0 have an Open Redirect vulnerability. Various parts of Plone use the 'is url in portal' check for security, mostly to see if it is safe…

    plone Products.isurlinportal products-isurlinportal PyPI
  • Medium —
    GHSA-rc7p-gmvh-xfx2

    Attack on Kubernetes via Misconfigured Argo Workflows

    ### Impact Users running using the Argo Server with `--auth-mode=server` (which is the default < v3.0.0) AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g. crypto-mining. ### Resolution * Do not e…

    github.com/argoproj/argo-workflows Go
  • Medium 4.9
    CVE-2021-29697

    IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authent…

    IBM Cloud Pak for Security
  • Medium 5.3
    CVE-2021-20539

    IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive inf…

    IBM Cloud Pak for Security
  • Medium 4.3
    CVE-2021-29757

    IBM QRadar User Behavior Analytics 4.1.1 is vulnerable to cross-site request forgery which could allow an attacker to e…

    IBM QRadar User Behavior Analytics
  • Medium 5.3
    CVE-2021-22552

    Memory overread secure enclave in Asylo 0.6.2

    An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall number in MessageReader that is then used by sysno() and can bypass validation. This can allow the attacker to read memory from within the secu…

    Google Asylo
  • Medium 4.2
    CVE-2021-20332

    MongoDB Rust Driver may publish events containing authentication-related data to a connection pool event listener configured by an application

    Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these event…

    MongoDB MongoDB Rust Driver mongodb crates.io
  • Medium 6.1
    CVE-2021-37216

    QSAN Storage Manager - Reflected Cross-Site Scripting

    QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data.

    QSAN Storage Manager XN8008T Storage Manager XN8024R
  • Medium 4.3
    CVE-2021-34574

    Password policy evasion in products of MB connect line and Helmholz

    In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attacker can change the password of his account into a new password that violates the password policy by intercepting and m…

    MB connect line Helmholz mymbCONNECT24 mbCONNECT24