Skip to content
OpenAdvisories

Archive

24 September 2021

Vulnerabilities first published on this day (UTC), newest first.

← August 2021 2021 / September /24 October 2021 →
  1. 1115
  2. 253
  3. 327
  4. 41
  5. 54
  6. 637
  7. 7126
  8. 8276
  9. 9140
  10. 1050
  11. 112
  12. 122
  13. 1366
  14. 14102
  15. 15154
  16. 1648
  17. 1750
  18. 184
  19. 192
  20. 20171
  21. 2130
  22. 2237
  23. 23105
  24. 2425
  25. 25 
  26. 262
  27. 27115
  28. 2851
  29. 2976
  30. 3051
All Critical High Medium Low Exploited only Public exploit

25 results · Feed

  • Unscored —
    CVE-2021-21742

    There is an information leak vulnerability in the message service app of a ZTE mobile phone. Due to improper parameter …

  • Unscored —
    CVE-2020-20514

    A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated atta…

  • Unscored —
    CVE-2020-20508

    Shopkit v2.7 contains a reflective cross-site scripting (XSS) vulnerability in the /account/register component, which a…

  • High 7.5
    CVE-2021-40655 Exploited EPSS 87%

    An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user nam…

    KEV May 16, 2024
  • Unscored —
    CVE-2021-40654

    An information disclosure issue exist in D-LINK-DIR-615 B2 2.01mt. An attacker can obtain a user name and password by f…

  • Unscored —
    CVE-2021-41504

    An Elevated Privileges issue exists in D-Link DCS-5000L v1.05 and DCS-932L v2.17 and older. The use of the digest-authe…

  • High 8.0
    CVE-2021-41503

    DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Control. The use of the basic authenticati…

  • High 7.8
    CVE-2021-2464

    Vulnerability in Oracle Linux (component: OSwatcher). Supported versions that are affected are 7 and 8. Easily exploita…

    Oracle Oracle Linux Linux
  • Unscored —
    CVE-2021-39246

    Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visit…

  • Unscored —
    CVE-2021-22868

    Unsafe configuration options in GitHub Pages leading to path traversal on GitHub Enterprise Server

    A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration options used by GitHub Pages were not sufficiently restricted and made it possible to read files…

    GitHub GitHub Enterprise Server
  • Unscored —
    CVE-2021-22869

    Improper access control in GitHub Enterprise Server allows self-hosted runners to execute outside their control group

    An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner group it should not have had access to. This affects customers using self-hosted runner groups for access control. A repository with…

    GitHub GitHub Enterprise Server
  • Unscored —
    CVE-2021-28130

    Dr.Web Firewall 12.5.2.4160 on Windows incorrectly restricts applications signed by Dr.Web. A DLL for a custom payload …

  • Unscored —
    CVE-2021-40309

    A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0. allows an attacker to…

  • Unscored —
    CVE-2021-40310

    OpenSIS Community Edition version 8.0 is affected by a cross-site scripting (XSS) vulnerability in the TakeAttendance.p…

  • Unscored —
    CVE-2021-40099

    An issue was discovered in Concrete CMS through 8.5.5. Fetching the update json scheme over HTTP leads to remote code e…

  • Unscored —
    CVE-2021-40100

    An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversati…

  • Unscored —
    CVE-2021-40102

    An issue was discovered in Concrete CMS through 8.5.5. Arbitrary File deletion can occur via PHAR deserialization in is…

  • Unscored —
    CVE-2021-41586

    In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the sy…

  • Unscored —
    CVE-2021-41587

    In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover cre…

  • Unscored —
    CVE-2021-41588

    In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. T…

  • Medium 6.5
    CVE-2021-36749 Public exploit EPSS 81%

    Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)

    In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of t…

    Apache Software Foundation Apache Druid org.apache.druid:druid-core Maven
  • Unscored —
    CVE-2021-41584

    Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sens…

  • Unscored —
    CVE-2021-31923

    Ping Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation.

    Ping Identity PingAccess
  • Unscored —
    CVE-2021-41583

    vpn-user-portal (aka eduVPN or Let's Connect!) before 2.3.14, as packaged for Debian 10, Debian 11, and Fedora, allows …

  • Unscored —
    CVE-2021-41581

    x509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL through 3.4.0 has a stack-based buf…