Skip to content
OpenAdvisories

Archive

27 September 2021

Vulnerabilities first published on this day (UTC), newest first.

← August 2021 2021 / September /27 October 2021 →
  1. 1115
  2. 253
  3. 327
  4. 41
  5. 54
  6. 637
  7. 7126
  8. 8276
  9. 9140
  10. 1050
  11. 112
  12. 122
  13. 1366
  14. 14102
  15. 15154
  16. 1648
  17. 1750
  18. 184
  19. 192
  20. 20171
  21. 2130
  22. 2237
  23. 23105
  24. 2425
  25. 25 
  26. 262
  27. 27115
  28. 2851
  29. 2976
  30. 3051
All Critical High Medium Low Exploited only Public exploit

24 results · Clear filters · Feed

  • Medium 5.4
    CVE-2020-20696

    Cross-site Scripting in GilaCMS

    A cross-site scripting (XSS) vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Tags field.

    gilacms/gila Packagist
  • Medium 5.4
    CVE-2020-20695

    Cross-site Scripting in GilaCMS

    A stored cross-site scripting (XSS) vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file.

    gilacms/gila Packagist
  • Medium 4.2
    CVE-2021-41095

    XSS via blocked watched word in error message

    Discourse is an open source discussion platform. There is a cross-site scripting (XSS) vulnerability in versions 2.7.7 and earlier of the `stable` branch, versions 2.8.0.beta6 and earlier of the `beta` branch, and versions 2.8.0.beta6 and earlier of the `test…

    Discourse Discourse
  • Medium 6.5
    CVE-2021-20035 Exploited

    Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker t…

    SonicWall SMA100 Network devices
    KEV Apr 16, 2025
  • Medium 6.5
    CVE-2021-40712

    Adobe Experience Manager Path parameter Improper Input Validation Could Lead To DOS

    Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a improper input validation vulnerability via the path parameter. An authenticated attacker can send a malformed POST request to achieve server-side denial of service.

    Adobe Experience Manager
  • Medium 6.1
    CVE-2021-40714

    Adobe Experience Manager Reflected Cross Site Scripting via accesskey parameter

    Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the accesskey parameter. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScr…

    Adobe Experience Manager
  • Medium 5.8
    CVE-2021-39828

    Adobe Digital Editions Installer flaw leads to Local Privilege Escalation

    Adobe Digital Editions 4.5.11.187646 (and earlier) are affected by a privilege escalation vulnerability in the Digital Editions installer. An authenticated attacker could leverage this vulnerability to escalate privileges. User interaction is required before …

    Adobe Digital Editions
  • Medium 5.9
    CVE-2021-40713

    Adobe Experience Manager Improper Certificate Validation Could Lead to Man In The Middle Attack

    Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a improper certificate validation vulnerability in the cold storage component. If an attacker can achieve a man in the middle when the cold server establishes a new certificate, they would …

    Adobe Experience Manager
  • Medium 6.5
    CVE-2021-39827

    Adobe Digital Editions Installer flaw leads to Arbitrary File System Write

    Adobe Digital Editions 4.5.11.187646 (and earlier) are affected by an arbitrary file write vulnerability in the Digital Editions installer. An authenticated attacker could leverage this vulnerability to write an arbitrary file to the system. User interaction …

    Adobe Digital Editions
  • Medium 5.4
    CVE-2021-40711

    Adobe Experience Manager Stored Cross-Site Scripting Could Lead to Arbitrary Code Execution

    Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a stored XSS vulnerability when creating Content Fragments. An authenticated attacker can send a malformed POST request to achieve arbitrary code execution. Malicious JavaScript may be exec…

    Adobe Experience Manager
  • Medium 6.9
    CVE-2021-36845

    YITH Maintenance Mode (WordPress plugin) <= 1.3.8 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

    Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.8, there are 46 vulnerable parameters that were missed by the vendor while patching the 1.3.7 version to 1.3.8. Vulnerable par…

    Yith YITH Maintenance Mode (WordPress plugin) Web / CMS
  • Medium 6.9
    CVE-2021-36841

    YITH Maintenance Mode (WordPress plugin) <= 1.3.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability.

    Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.7, vulnerable parameter &yith_maintenance_newsletter_submit_label. Possible even when unfiltered HTML is disallowed by WordPress configur…

    Yith YITH Maintenance Mode (WordPress plugin) Web / CMS
  • Medium 5.9
    CVE-2021-36875

    WordPress uListing plugin <= 2.0.5 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability

    Cross-site Scripting (XSS) vulnerability in Stylemix Directory Listings WordPress plugin – uListing allows Reflected XSS.This issue affects Directory Listings WordPress plugin – uListing: from n/a through 2.0.5.

    stylemix Directory Listings WordPress plugin – uListing Web / CMS
  • Medium 4.3
    CVE-2021-36877

    WordPress uListing plugin <= 2.0.5 - Modify User Roles via Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to modify user roles.

    StylemixThemes uListing (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2021-36876

    WordPress uListing plugin <= 2.0.5 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

    Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WordPress uListing plugin (versions <= 2.0.5) as it lacks CSRF checks on plugin administration pages.

    StylemixThemes uListing (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2021-36878

    WordPress uListing plugin <= 2.0.5 - Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to update settings.

    StylemixThemes uListing (WordPress plugin) Web / CMS
  • Medium 6.5
    CVE-2021-22272

    ControlTouch Cloud Service vulnerability: Serial Number can be misused during commissioning phase.

    The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device virtually into her/his my.busch-jaeger.de or mybuildings.abb.com profile. A successful attacker can…

    ABB Busch-Jaeger my.busch-jaeger.de mybuildings.abb.com ICS / OT
  • Medium 5.3
    CVE-2021-3822

    Inefficient Regular Expression Complexity in josdejong/jsoneditor

    jsoneditor is vulnerable to Inefficient Regular Expression Complexity

    josdejong josdejong/jsoneditor jsoneditor npm
  • Medium 5.3
    CVE-2021-3820

    Inefficient Regular Expression Complexity in pksunkara/inflect

    inflect is vulnerable to Inefficient Regular Expression Complexity

    pksunkara pksunkara/inflect i npm
  • Medium 4.3
    CVE-2021-3819

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

    firefly-iii firefly-iii/firefly-iii grumpydictator/firefly-iii Packagist
  • Medium 6.3
    CVE-2021-3818

    Reliance on Cookies without Validation and Integrity Checking in getgrav/grav

    grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking

    getgrav getgrav/grav getgrav/grav Packagist
  • Medium 5.4
    CVE-2021-3799

    Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admin

    grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames

    getgrav getgrav/grav-plugin-admin
  • Medium 5.3
    CVE-2021-41580

    Improper Access Control in passport-oauth2

    The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error r…

    passport-oauth2 npm
  • Medium 5.3
    CVE-2021-31604

    furlongm openvpn-monitor allows CSRF to disconnect an arbitrary client

    furlongm openvpn-monitor through 1.1.3 allows CSRF to disconnect an arbitrary client.

    openvpn-monitor PyPI