Skip to content
OpenAdvisories

Archive

20 September 2021

Vulnerabilities first published on this day (UTC), newest first.

← August 2021 2021 / September /20 October 2021 →
  1. 1115
  2. 253
  3. 327
  4. 41
  5. 54
  6. 637
  7. 7126
  8. 8276
  9. 9140
  10. 1050
  11. 112
  12. 122
  13. 1366
  14. 14102
  15. 15154
  16. 1648
  17. 1750
  18. 184
  19. 192
  20. 20171
  21. 2130
  22. 2237
  23. 23105
  24. 2425
  25. 25 
  26. 262
  27. 27115
  28. 2851
  29. 2976
  30. 3051
All Critical High Medium Low Exploited only Public exploit

171 results · Feed

  • Unscored —
    CVE-2021-24403

    WordPress Page Contact <= 1.0 - Authenticated (editor+) SQL Injection

    The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users suc…

    Web / CMS
  • Unscored —
    CVE-2021-24402

    WP iCommerce <= 1.1.1 - Authenticated (contributor+) SQL Injection

    The Orders functionality in the WP iCommerce WordPress plugin through 1.1.1 has an `order_id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users…

    Web / CMS
  • Unscored —
    CVE-2021-24401

    WP Domain Redirect <= 1.0 - Authenticated SQL Injection

    The Edit domain functionality in the WP Domain Redirect WordPress plugin through 1.0 has an `editid` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.

    Web / CMS
  • Unscored —
    CVE-2021-24400

    Display users <= 2.0.0 - Authenticated SQL Injection

    The Edit Role functionality in the Display Users WordPress plugin through 2.0.0 had an `id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.

    Web / CMS
  • Unscored —
    CVE-2021-24399

    The Sorter <= 1.0 - Authenticated SQL Injection

    The check_order function of The Sorter WordPress plugin through 1.0 uses an `area_id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.

    Web / CMS
  • Unscored —
    CVE-2021-24398

    Responsive 3D Slider <= 1.2 - Authenticated SQL Injection

    The Add new scene functionality in the Responsive 3D Slider WordPress plugin through 1.2 uses an id parameter which is not sanitised, escaped or validated before being inserted to a SQL statement, leading to SQL injection. This is a time based SQLI and in the…

    Web / CMS
  • Unscored —
    CVE-2021-24397

    MicroCopy <= 1.1.0 - Authenticated SQL Injection

    The edit functionality in the MicroCopy WordPress plugin through 1.1.0 makes a get request to fetch the related option. The id parameter used is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.

    Web / CMS
  • Unscored —
    CVE-2021-24396

    GSEOR <= 1.3 - Authenticated SQL Injection

    A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.

    Web / CMS
  • Unscored —
    CVE-2021-38300

    arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when transforming unpri…

    linux linux-realtime linux-raspi-realtime linux-intel-iot-realtime Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2021-39537

    An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.

    ncurses ncurses ncurses ncurses Debian Ubuntu Azure Linux Alpine
  • Unscored —
    CVE-2021-32280

    An issue was discovered in fig2dev before 3.2.8.. A NULL pointer dereference exists in the function compute_closed_spli…

    fig2dev fig2dev transfig xfig Debian Ubuntu