Skip to content
OpenAdvisories

Archive

5 August 2021

Vulnerabilities first published on this day (UTC), newest first.

← July 2021 2021 / August /5 September 2021 →
  1. 11
  2. 2123
  3. 3112
  4. 484
  5. 593
  6. 652
  7. 712
  8. 867
  9. 968
  10. 1096
  11. 11117
  12. 12168
  13. 1364
  14. 141
  15. 154
  16. 16107
  17. 1773
  18. 1899
  19. 1933
  20. 2073
  21. 211
  22. 228
  23. 2395
  24. 24222
  25. 2575
  26. 2661
  27. 2732
  28. 28 
  29. 298
  30. 3089
  31. 3169
All Critical High Medium Low Exploited only Public exploit

18 results · Clear filters · Feed

  • High 8.0
    CVE-2021-32003

    Configuration service port remains open 10 minutes after reboot even when already provisioned

    Unprotected Transport of Credentials vulnerability in SiteManager provisioning service allows local attacker to capture credentials if the service is used after provisioning. This issue affects: Secomea SiteManager All versions prior to 9.5 on Hardware.

    Secomea SiteManager
  • High 8.8
    CVE-2020-7863

    Raonwiz RAON K Upload Arbitrary Command Execution Vulnerability

    A vulnerability in File Transfer Solution of Raonwiz could allow arbitrary command execution as the result of viewing a specially-crafted web page. This vulnerability is due to insufficient validation of the parameter of the specific method. An attacker could…

    Raonwiz,inc RAON K Upload
  • High 7.5
    CVE-2021-26605

    unidocs ezPDFReader arbitrary command execution vulnerability

    An improper input validation vulnerability in the service of ezPDFReader allows attacker to execute arbitrary command. This issue occurred when the ezPDF launcher received and executed crafted input values through JSON-RPC communication.

    Unidocs ezPDFReader
  • High 7.5
    CVE-2021-34639

    WordPress Download Manager <= 3.1.24 Authenticated Arbitrary File Upload

    Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. "payload.php.png" which is executable in some configurations. This issue affects: WordPress Download Manager v…

    W3 Eden WordPress Download Manager Web / CMS
  • High 8.1
    CVE-2021-37632

    Deserialization of Untrusted Data in com.supermartijn642.configlib.ConfigSyncPacket

    SuperMartijn642's Config Lib is a library used by a number of mods for the game Minecraft. The versions of SuperMartijn642's Config Lib between 1.0.4 and 1.0.8 are affected by a vulnerability and can be exploited on both servers and clients. Using SuperMartij…

    SuperMartijn642 SuperMartijn642sConfigLib
  • High 8.8
    CVE-2021-34633

    Youtube Feeder <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

    The Youtube Feeder WordPress plugin is vulnerable to Cross-Site Request Forgery via the printAdminPage function found in the ~/youtube-feeder.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.1.

    Youtube Feeder Youtube Feeder Web / CMS
  • High 8.8
    CVE-2021-34634

    Nifty Newsletters <= 4.0.23 - Cross-Site Request Forgery to Stored Cross-Site Scripting

    The Nifty Newsletters WordPress plugin is vulnerable to Cross-Site Request Forgery via the sola_nl_wp_head function found in the ~/sola-newsletters.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.23.

    SolaPlugins Nifty Newsletters Web / CMS
  • High 8.8
    CVE-2021-21893

    A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.0.0.49893. A …

  • High 8.8
    CVE-2021-21831

    A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.3.37598. A …

  • High 8.8
    CVE-2021-21870

    A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.4.37651. A …

  • High 8.8
    CVE-2021-21863

    A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CO…

  • High 7.1
    CVE-2021-37859

    Reflected XSS in OAuth Flow

    Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost.

    Mattermost Mattermost
  • High 8.8
    CVE-2021-34631

    NewsPlugin <= 1.0.18 - Cross-Site Request Forgery to Stored Cross-Site Scripting

    The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handle_save_style function found in the ~/news-plugin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.18.

    NewsPlugin NewsPlugin Web / CMS
  • High 8.7
    CVE-2021-22241

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a st…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.5
    CVE-2021-23849

    Cross Site Request Forgery (CSRF) vulnerability in web based management interface

    A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link …

    Bosch CPP Firmware
  • High 7.5
    CVE-2021-37625

    Incorrect Check of Function Return Value in Skytable

    Skytable is an open source NoSQL database. In versions prior to 0.6.4 an incorrect check of return value of the accept function in the run-loop for a TCP socket/TLS socket/TCP+TLS multi-socket causes an early exit from the run loop that should continue infini…

    skytable skytable
  • High 8.8
    CVE-2021-32603

    A server-side request forgery (SSRF) (CWE-918) vulnerability in FortiManager and FortiAnalyser GUI 7.0.0, 6.4.5 and bel…

    Fortinet Fortinet FortiAnalyzer, FortiManager Network devices
  • High 7.5
    CVE-2021-22926 EPSS 15%

    libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `C…

    curl Alpine