Skip to content
OpenAdvisories

Archive

30 August 2021

Vulnerabilities first published on this day (UTC), newest first.

← July 2021 2021 / August /30 September 2021 →
  1. 11
  2. 2123
  3. 3112
  4. 484
  5. 593
  6. 652
  7. 712
  8. 867
  9. 968
  10. 1096
  11. 11117
  12. 12168
  13. 1364
  14. 141
  15. 154
  16. 16107
  17. 1773
  18. 1899
  19. 1933
  20. 2073
  21. 211
  22. 228
  23. 2395
  24. 24222
  25. 2575
  26. 2661
  27. 2732
  28. 28 
  29. 298
  30. 3089
  31. 3169
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 4.3
    CVE-2021-32832

    ReDOS in Rocket.Chat

    Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. In Rocket.Chat before versions 3.11.3, 3.12.2, and 3.13 an issue with certain regular expressions could lead potentially to Denial of Service. This was fixed in …

    RocketChat Rocket.Chat
  • Medium 4.7
    CVE-2021-38343

    Nested Pages <= 3.1.15 Open Redirect

    The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSort`, and `npCategoryFilter` `admin_post` actions.

    Kyle Phillips Nested Pages Web / CMS
  • Medium 6.4
    CVE-2021-34668

    WordPress Real Media Library <= 4.14.1 Author-only Stored Cross-Site Scripting

    The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the ~/inc/overrides/lite/rest/Folder.php file which allows author-level attackers to inject arbitrary web scripts in folder names, in vers…

    devowl.io WordPress Real Media Library Web / CMS
  • Medium 4.6
    CVE-2021-3628

    OpenKM Document Management Community vulnerable to Cross Site Scripting

    OpenKM Community Edition in its 6.3.10 version is vulnerable to authenticated Cross-site scripting (XSS). A remote attacker could exploit this vulnerability by injecting arbitrary code via de uuid parameter.

    Openkm Document Management Community
  • Medium 6.4
    CVE-2021-29743

    IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting. This vulnerability allows use…

    IBM Maximo Asset Management
  • Medium 4.9
    CVE-2021-29728

    IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 contains hard-coded credentials, such as a password or cry…

    IBM Sterling Secure Proxy
  • Medium 5.9
    CVE-2021-29723

    IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that co…

    IBM Sterling Secure Proxy
  • Medium 5.9
    CVE-2021-29722

    IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that co…

    IBM Sterling Secure Proxy
  • Medium 4.3
    GHSA-hw7r-qrhp-5pff

    Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20

    Improper check in `CheckboxGroup` in `com.vaadin:vaadin-checkbox-flow` versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.…

    com.vaadin:vaadin-bom Maven
  • Medium 6.3
    CVE-2021-27909

    XSS vulnerability on password reset page

    For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker to execute Javascript code. The attacker would be required to convince or trick …

    Mautic Mautic mautic/core Packagist
  • Medium 6.5
    CVE-2021-25958

    Generation of Error Message Containing Sensitive Information in Apache OFBiz

    In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he…

    Apache ofbiz-framework