Skip to content
OpenAdvisories

Archive

14 September 2021

Vulnerabilities first published on this day (UTC), newest first.

← August 2021 2021 / September /14 October 2021 →
  1. 1115
  2. 253
  3. 327
  4. 41
  5. 54
  6. 637
  7. 7126
  8. 8276
  9. 9140
  10. 1050
  11. 112
  12. 122
  13. 1366
  14. 14102
  15. 15154
  16. 1648
  17. 1750
  18. 184
  19. 192
  20. 20171
  21. 2130
  22. 2237
  23. 23105
  24. 2425
  25. 25 
  26. 262
  27. 27115
  28. 2851
  29. 2976
  30. 3051
All Critical High Medium Low Exploited only Public exploit

102 results · Feed

  • Unscored —
    CVE-2021-23029

    On version 16.0.x before 16.0.1.2, insufficient permission checks may allow authenticated users with guest privileges t…

  • Unscored —
    CVE-2021-23026

    BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all ve…

  • Unscored —
    CVE-2021-23027

    On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, and 14.1.x before 14.1.4.3, a DOM based cross-site scripting…

  • Unscored —
    CVE-2021-23025

    On version 15.1.x before 15.1.0.5, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all versions of 12.1.x and 11.6.…

  • Unscored —
    CVE-2021-23028

    On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON …

  • Unscored —
    CVE-2021-23030

    On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 1…

  • High —
    GHSA-2rh5-jvgx-pgw3

    Any storage file can be downloaded from p.sh if full server path is known

    The default configuration for platform.sh (.platform.app.yaml) allows access to uploaded files if you know or can guess their location, regardless of whether roles grant content read access to the content containing those files. If you're using Legacy Bridge,…

    ezsystems/ezplatform Packagist
  • High —
    GHSA-gqcf-83rq-gpfr

    Any storage file can be downloaded from p.sh if full server path is known

    The default configuration for platform.sh (.platform.app.yaml) allows access to uploaded files if you know or can guess their location, regardless of whether roles grant content read access to the content containing those files. If you're using Legacy Bridge,…

    ibexa/post-install Packagist
  • Unscored —
    CVE-2021-23031

    On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12…

  • Unscored —
    CVE-2021-23036

    On version 16.0.x before 16.0.1.2, when a BIG-IP ASM and DataSafe profile are configured on a virtual server, undisclos…

  • Unscored —
    CVE-2021-23034

    On BIG-IP version 16.x before 16.1.0 and 15.1.x before 15.1.3.1, when a DNS profile using a DNS cache resolver is confi…

  • Unscored —
    CVE-2021-23037

    On all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XSS) v…

  • Unscored —
    CVE-2021-23032

    On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, w…

  • Medium 6.1
    CVE-2021-39391

    Cross-site Scripting in Beego

    Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated by administrators viewing the "Request Statistics" page.

    github.com/beego/beego/v2 Go
  • Unscored —
    CVE-2021-23038

    On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all vers…

  • Unscored —
    CVE-2021-23035

    On BIG-IP 14.1.x before 14.1.4.4, when an HTTP profile is configured on a virtual server, after a specific sequence of …

  • Critical 9.0
    CVE-2021-35493

    TIBCO WebFOCUS Cross Site Scripting vulnerabilities

    The WebFOCUS Reporting Server and WebFOCUS Client components of TIBCO Software Inc.'s TIBCO WebFOCUS Client, TIBCO WebFOCUS Installer, and TIBCO WebFOCUS Reporting Server contain easily exploitable Stored and Reflected Cross Site Scripting (XSS) vulnerabiliti…

    TIBCO Software TIBCO WebFOCUS Client TIBCO WebFOCUS Reporting Server TIBCO WebFOCUS Installer
  • Unscored —
    CVE-2021-23033

    On BIG-IP Advanced WAF and BIG-IP ASM version 16.x before 16.1.0x, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1…

  • Unscored —
    CVE-2021-23039

    On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.2.8, and all versions of 13.1.x and 12.1.x,…

  • Unscored —
    CVE-2021-23045

    On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and a…

  • Unscored —
    CVE-2020-21082

    A cross-site scripting (XSS) vulnerability in the background administrator article management module of Maccms 8.0 allo…

  • Unscored —
    CVE-2020-21081

    A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowle…

  • Unscored —
    CVE-2021-23044

    On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all v…

  • Unscored —
    CVE-2020-21050

    Libsixel prior to v1.8.3 contains a stack buffer overflow in the function gif_process_raster at fromgif.c.

    libsixel libsixel Debian Ubuntu
  • Unscored —
    CVE-2020-21049

    An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service …

    libsixel libsixel Debian Ubuntu
  • Unscored —
    CVE-2020-21048

    An issue in the dither.c component of libsixel prior to v1.8.4 allows attackers to cause a denial of service (DOS) via …

    libsixel libsixel Debian Ubuntu
  • Unscored —
    CVE-2021-41077

    The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexp…

  • Unscored —
    CVE-2021-23042

    On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, and 12.1.x …

  • Unscored —
    CVE-2021-23040

    On BIG-IP AFM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and…

  • Unscored —
    CVE-2021-23043

    On BIG-IP, on all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a directory traversal vulnera…

  • Unscored —
    CVE-2021-23046

    On all versions of Guided Configuration before 8.0.0, when a configuration that contains secure properties is created a…

  • Unscored —
    CVE-2021-23041

    On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all…

  • Unscored —
    CVE-2021-23047

    On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, and all versions of 13.1.x, 12.1.x and 1…

  • Medium 5.4
    CVE-2021-29841

    IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed…

    IBM Financial Transaction Manager
  • Low 3.7
    CVE-2021-20582

    IBM Security Secret Server up to 11.0 stores sensitive information in URL parameters. This may lead to information disc…

    IBM Security Secret Server
  • Medium 5.3
    CVE-2021-20569

    IBM Security Secret Server up to 11.0 could allow an attacker to enumerate usernames due to improper input validation. …

    IBM Security Secret Server
  • Low 2.7
    CVE-2021-20508

    IBM Security Secret Server up to 11.0 could allow a remote attacker to obtain sensitive information when a detailed tec…

    IBM Security Secret Server
  • Unscored —
    CVE-2021-23049

    On BIG-IP version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3, when the iRules RESOLVER::summarize command is used …

  • Unscored —
    CVE-2021-23048

    On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and a…

  • Unscored —
    CVE-2021-23050

    On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on …