Skip to content
OpenAdvisories

Archive

20 September 2021

Vulnerabilities first published on this day (UTC), newest first.

← August 2021 2021 / September /20 October 2021 →
  1. 1115
  2. 253
  3. 327
  4. 41
  5. 54
  6. 637
  7. 7126
  8. 8276
  9. 9140
  10. 1050
  11. 112
  12. 122
  13. 1366
  14. 14102
  15. 15154
  16. 1648
  17. 1750
  18. 184
  19. 192
  20. 20171
  21. 2130
  22. 2237
  23. 23105
  24. 2425
  25. 25 
  26. 262
  27. 27115
  28. 2851
  29. 2976
  30. 3051
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 8.0
    CVE-2021-41083

    CSRF Vulnerability in dada-mail 11.15.1 and below

    Dada Mail is a web-based e-mail list management system. In affected versions a bad actor could give someone a carefully crafted web page via email, SMS, etc, that - when visited, allows them control of the list control panel as if the bad actor was logged in …

    justingit dada-mail
  • High 7.5
    CVE-2021-39229

    Regular expression deinal of service in apprise

    Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. In affected versions users who use Apprise granting them access to the IFTTT plugin (which just comes out of the box) …

    caronc apprise apprise PyPI
  • High 7.5
    CVE-2021-41082

    Private message title and participating users leaked in discourse

    Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed to users that do not have access to the private messages. However, access control for the private mes…

    Discourse Discourse
  • High —
    GHSA-84p7-fh9c-6g8h

    Prototype Pollution in mixme

    ### Impact When copying properties from a source object to a target object, the target object can gain access to certain properties of the source object and modify their content. ### Patches The problem was patch with a more agressive discovery of secured pro…

    mixme npm
  • High 7.5
    CVE-2020-26301

    Command injection in mscdex/ssh2

    ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls …

    mscdex ssh2 ssh2 npm
  • High 7.5
    CVE-2021-32838

    Regular Expression Denial of Service in flask-restx

    Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex. This is fixed in version 0.5.1.

    python-restx flask-restx flask-restx PyPI
  • High 7.5
    CVE-2021-32839

    Regular Expression Denial of Service in sqlparse

    sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many rep…

    andialbrecht sqlparse sqlparse sqlparse Debian Ubuntu Alpine PyPI
  • High 8.8
    CVE-2021-25741 Public exploit

    Symlink Exchange Can Allow Host Filesystem Access

    A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.

    Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go
  • High 8.8
    CVE-2021-32297

    LIEF heap-buffer-overflow

    An issue was discovered in LIEF through 0.11.4. A heap-buffer-overflow exists in the function main located in pe_reader.c. It allows an attacker to cause code Execution.

    lief lief Ubuntu PyPI