Skip to content
OpenAdvisories

Archive

10 September 2021

Vulnerabilities first published on this day (UTC), newest first.

← August 2021 2021 / September /10 October 2021 →
  1. 1115
  2. 253
  3. 327
  4. 41
  5. 54
  6. 637
  7. 7126
  8. 8276
  9. 9140
  10. 1050
  11. 112
  12. 122
  13. 1366
  14. 14102
  15. 15154
  16. 1648
  17. 1750
  18. 184
  19. 192
  20. 20171
  21. 2130
  22. 2237
  23. 23105
  24. 2425
  25. 25 
  26. 262
  27. 27115
  28. 2851
  29. 2976
  30. 3051
All Critical High Medium Low Exploited only Public exploit

32 results · Clear filters · Feed

  • Medium 5.4
    CVE-2021-40347

    GNU Mailman Postorius Access Control Issues

    An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first …

    postorius postorius postorius Debian Ubuntu PyPI
  • Medium 4.9
    CVE-2021-3646

    Cross-site Scripting (XSS) - Reflected in btcpayserver/btcpayserver

    btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    btcpayserver btcpayserver/btcpayserver
  • Medium 6.1
    CVE-2021-38357

    SMS OVH <= 0.1 Reflected Cross-Site Scripting

    The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the ~/sms-ovh-sent.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.

    SMS OVH SMS OVH Web / CMS
  • Medium 6.1
    CVE-2021-38358

    MoolaMojo <= 0.7.4.1 Reflected Cross-Site Scripting

    The MoolaMojo WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the ~/views/button-generator.html.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.4.1.

    MoolaMojo MoolaMojo Web / CMS
  • Medium 6.1
    CVE-2021-38359

    WordPress InviteBox Plugin <= 1.4.1 Reflected Cross-Site Scripting

    The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the message parameter found in the ~/admin/admin.php file which allows attackers to inject arbitrary web scripts, in versio…

    WordPress InviteBox Plugin WordPress InviteBox Plugin Web / CMS
  • Medium 6.1
    CVE-2021-38354

    GNU-Mailman Integration <= 1.0.6 Reflected Cross-Site Scripting

    The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gm_error parameter found in the ~/includes/admin/mailing-lists-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and inc…

    GNU-Mailman Integration GNU-Mailman Integration Web / CMS
  • Medium 6.1
    CVE-2021-38327

    YouTube Video Inserter <= 1.2.1.0 Reflected Cross-Site Scripting

    The YouTube Video Inserter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/adminUI/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and includin…

    YouTube Video Inserter YouTube Video Inserter Web / CMS
  • Medium 6.1
    CVE-2021-38339

    Simple Matted Thumbnails <= 1.01 Reflected Cross-Site Scripting

    The Simple Matted Thumbnails WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/simple-matted-thumbnail.php file which allows attackers to inject arbitrary web scripts, in versions up to and…

    Simple Matted Thumbnails Simple Matted Thumbnails Web / CMS
  • Medium 6.1
    CVE-2021-38347

    Custom Website Data <= 2.2 Reflected Cross-Site Scripting

    The Custom Website Data WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter found in the ~/views/edit.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2.

    Custom Website Data Custom Website Data Web / CMS
  • Medium 6.1
    CVE-2021-38355

    Bug Library <= 2.0.3 Reflected Cross-Site Scripting

    The Bug Library WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the successimportcount parameter found in the ~/bug-library.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.3.

    Bug Library Bug Library Web / CMS
  • Medium 6.1
    CVE-2021-38336

    Edit Comments XT <= 1.0 Reflected Cross-Site Scripting

    The Edit Comments XT WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/edit-comments-xt.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.

    Edit Comments XT Edit Comments XT Web / CMS
  • Medium 6.1
    CVE-2021-38335

    Wise Agent Capture Forms <= 1.0 Reflected Cross-Site Scripting

    The Wise Agent Capture Forms WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/WiseAgentCaptureForm.php file which allows attackers to inject arbitrary web scripts, in versions up to and in…

    Wise Agent Capture Forms Wise Agent Capture Forms Web / CMS
  • Medium 6.1
    CVE-2021-38329

    DJ EmailPublish <= 1.7.2 Reflected Cross-Site Scripting

    The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/dj-email-publish.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.7.2.

    DJ EmailPublish DJ EmailPublish Web / CMS
  • Medium 6.1
    CVE-2021-38328

    Notices <= 6.1 Reflected Cross-Site Scripting

    The Notices WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/notices.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.1.

    Notices Notices Web / CMS
  • Medium 6.1
    CVE-2021-38338

    Border Loading Bar <= 1.0.1 Reflected Cross-Site Scripting

    The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `f` and `t` parameter found in the ~/titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to a…

    Border Loading Bar Border Loading Bar Web / CMS
  • Medium 6.1
    CVE-2021-38331

    WP-T-Wap <= 1.13.2 Reflected Cross-Site Scripting

    The WP-T-Wap WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the posted parameter found in the ~/wap/writer.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.13.2.

    WP-T-Wap WP-T-Wap Web / CMS
  • Medium 6.1
    CVE-2021-38333

    WP Scrippets <= 1.5.1 Reflected Cross-Site Scripting

    The WP Scrippets WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/wp-scrippets.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.1.

    WP Scrippets WP Scrippets Web / CMS
  • Medium 6.1
    CVE-2021-38352

    Feedify – Web Push Notifications <= 2.1.8 Reflected Cross-Site Scripting

    The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedify_msg parameter found in the ~/includes/base.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2…

    Feedify – Web Push Notifications Feedify – Web Push Notifications Web / CMS
  • Medium 6.1
    CVE-2021-38341

    WooCommerce Payment Gateway Per Category <= 2.0.10 Reflected Cross-Site Scripting

    The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/includes/plugin_settings.php file which allows attackers to inject arbitrary web scripts, in v…

    WooCommerce Payment Gateway Per Category WooCommerce Payment Gateway Per Category Web / CMS
  • Medium 6.1
    CVE-2021-38340

    Wordpress Simple Shop <= 1.2 Reflected Cross-Site Scripting

    The Wordpress Simple Shop WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the update_row parameter found in the ~/includes/add_product.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.

    Wordpress Simple Shop Wordpress Simple Shop Web / CMS
  • Medium 6.1
    CVE-2021-38349

    Integration of Moneybird for WooCommerce <= 2.1.1 Reflected Cross-Site Scripting

    The Integration of Moneybird for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error_description parameter found in the ~/templates/wcmb-admin.php file which allows attackers to inject arbitrary web scripts, in versions …

    Integration of Moneybird for WooCommerce Integration of Moneybird for WooCommerce Web / CMS
  • Medium 6.1
    CVE-2021-38353

    Dropdown and scrollable Text <= 2.0 Reflected Cross-Site Scripting

    The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the ~/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.

    Dropdown and scrollable Text Dropdown and scrollable Text Web / CMS
  • Medium 6.1
    CVE-2021-38326

    Post Title Counter <= 1.1 Reflected Cross-Site Scripting

    The Post Title Counter WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the notice parameter found in the ~/post-title-counter.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1.

    Post Title Counter Post Title Counter Web / CMS
  • Medium 6.1
    CVE-2021-38348

    Advance Search <= 1.1.2 Reflected Cross-Site Scripting

    The Advance Search WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the wpas_id parameter found in the ~/inc/admin/views/html-advance-search-admin-options.php file which allows attackers to inject arbitrary web scripts, in versions up to a…

    Advance Search Advance Search Web / CMS
  • Medium 6.1
    CVE-2021-38332

    On Page SEO + Whatsapp Chat Button <= 1.0.1 Reflected Cross-Site Scripting

    The On Page SEO + Whatsapp Chat Button Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to a…

    On Page SEO + Whatsapp Chat Button On Page SEO + Whatsapp Chat Button Web / CMS
  • Medium 6.1
    CVE-2021-38337

    RSVPMaker Excel <= 1.1 Reflected Cross-Site Scripting

    The RSVPMaker Excel WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/phpexcel/PHPExcel/Shared/JAMA/docs/download.php file which allows attackers to inject arbitrary web scripts, in version…

    RSVPMaker Excel RSVPMaker Excel Web / CMS
  • Medium 6.1
    CVE-2021-38330

    Yet Another bol.com Plugin <= 1.4 Reflected Cross-Site Scripting

    The Yet Another bol.com Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/yabp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.

    Yet Another bol.com Plugin Yet Another bol.com Plugin Web / CMS
  • Medium 6.1
    CVE-2021-38334

    WP Design Maps & Places <= 1.2 Reflected Cross-Site Scripting

    The WP Design Maps & Places WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the filename parameter found in the ~/wpdmp-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.

    WP Design Maps & Places WP Design Maps & Places Web / CMS
  • Medium 6.1
    CVE-2021-38350

    spideranalyse <= 0.0.1 Reflected Cross-Site Scripting

    The spideranalyse WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the date parameter found in the ~/analyse/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.1.

    spideranalyse spideranalyse Web / CMS
  • Medium 6.1
    CVE-2021-38351

    OSD Subscribe <= 1.2.3 Reflected Cross-Site Scripting

    The OSD Subscribe WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the osd_subscribe_message parameter found in the ~/options/osd_subscribe_options_subscribers.php file which allows attackers to inject arbitrary web scripts, in versions up…

    OSD Subscribe OSD Subscribe Web / CMS
  • Medium 6.8
    CVE-2021-3645

    Prototype Pollution in viking04/merge

    merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

    viking04 viking04/merge @viking04/merge npm
  • Medium 6.0
    CVE-2021-34343

    Buffer Overflow Vulnerability in QTS, QuTS hero, and QuTScloud

    A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of…

    QNAP Systems QTS QuTS hero QuTScloud