Archive
September 2021
Vulnerabilities first published in this month (UTC), newest first.
1,922 results · Feed
-
High 8.6
Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
-
Medium 5.9
The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two …
-
Unscored —
In Contiki 3.0, Telnet option negotiation is mishandled. During negotiation between a server and a client, the server m…
-
Unscored —CVE-2021-40524 Scanner template
In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of…
-
Unscored —
WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that tr…
-
Medium 4.2
Cross-site Scripting (XSS)
This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a user needs to be tricked into uploading such a file).
-
Unscored —
ViewCommon.java in JForum2 2.7.0 allows XSS via a user signature.
-
Unscored —
Chromium: CVE-2021-30624 Use after free in Autofill
-
Unscored —
Chromium: CVE-2021-30623 Use after free in Bookmarks
-
Unscored —
Chromium: CVE-2021-30622 Use after free in WebApp Installs
-
Unscored —
Chromium: CVE-2021-30621 UI Spoofing in Autofill
-
Unscored —
Chromium: CVE-2021-30620 Insufficient policy enforcement in Blink
-
Unscored —
Chromium: CVE-2021-30619 UI Spoofing in Autofill
-
Unscored —
Chromium: CVE-2021-30618 Inappropriate implementation in DevTools
-
Unscored —
Chromium: CVE-2021-30617 Policy bypass in Blink
-
Unscored —
Chromium: CVE-2021-30616 Use after free in Media
-
Unscored —
Chromium: CVE-2021-30615 Cross-origin data leak in Navigation
-
Unscored —
Chromium: CVE-2021-30614 Heap buffer overflow in TabStrip
-
Unscored —
Chromium: CVE-2021-30613 Use after free in Base internals
-
Unscored —
Chromium: CVE-2021-30612 Use after free in WebRTC
-
Unscored —
Chromium: CVE-2021-30611 Use after free in WebRTC
-
Unscored —
Chromium: CVE-2021-30610 Use after free in Extensions API
-
Unscored —
Chromium: CVE-2021-30609 Use after free in Sign-In
-
Unscored —
Chromium: CVE-2021-30608 Use after free in Web Share
-
Unscored —
Chromium: CVE-2021-30607 Use after free in Permissions
-
Unscored —
Chromium: CVE-2021-30606 Use after free in Blink
-
Medium 5.3
Transaction validity oversight in pallet-ethereum
Frontier is Substrate's Ethereum compatibility layer. Prior to commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26, a bug in `pallet-ethereum` can cause invalid transactions to be included in the Ethereum block state in `pallet-ethereum` due to not validat…
-
Unscored —CVE-2021-40492 Public exploit
A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrar…
-
High 7.5
Regular Expression Denial of Service (ReDoS)
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
-
Medium 6.5
Privilege escalation: all users can access Admin-level API keys
Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users (including contributors) to view admin-level API keys via the integrations API endpoint, leading…
-
Critical 9.8
AdaptiveScale LXDUI Hardcoded JWT Secret Key
A Hardcoded JWT Secret Key in metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system.
-
Unscored —
A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux ke…
-
Medium 4.7
URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO function…
-
Unscored —
The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure the…
-
Medium 6.1
Microsoft Edge for iOS Spoofing Vulnerability
Microsoft Edge for iOS Spoofing Vulnerability
-
Medium 6.1
Microsoft Edge for Android Spoofing Vulnerability
Microsoft Edge for Android Spoofing Vulnerability
-
Medium 5.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
Medium 4.6
Microsoft Edge for Android Information Disclosure Vulnerability
Microsoft Edge for Android Information Disclosure Vulnerability
-
Medium 6.1
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
Unscored —
In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) …