Skip to content
OpenAdvisories

Archive

5 October 2021

Vulnerabilities first published on this day (UTC), newest first.

← September 2021 2021 / October /5 November 2021 →
  1. 170
  2. 2 
  3. 3 
  4. 496
  5. 557
  6. 6129
  7. 770
  8. 859
  9. 9 
  10. 103
  11. 1166
  12. 1274
  13. 13120
  14. 1434
  15. 1559
  16. 16 
  17. 17 
  18. 1864
  19. 19120
  20. 20191
  21. 2159
  22. 22101
  23. 23 
  24. 24 
  25. 2584
  26. 2643
  27. 2770
  28. 28106
  29. 2931
  30. 301
  31. 3111
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 7.4
    CVE-2021-41124

    Splash authentication credentials potentially leaked to target websites in scrapy-splash

    Scrapy-splash is a library which provides Scrapy and JavaScript integration. In affected versions users who use [`HttpAuthMiddleware`](http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth) (i.e. the `h…

    scrapy-plugins scrapy-splash scrapy-splash PyPI
  • High 7.0
    CVE-2021-3581

    Buffer Access with Incorrect Length Value in zephyr

    Buffer Access with Incorrect Length Value in zephyr. Zephyr versions >= >=2.5.0 contain Buffer Access with Incorrect Length Value (CWE-805). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8q65-5gqf-fmw5

    zephyrproject-rtos Zephyr
  • High 7.5
    CVE-2021-3510

    Zephyr JSON decoder incorrectly decodes array of array

    Zephyr JSON decoder incorrectly decodes array of array. Zephyr versions >= >1.14.0, >= >2.5.0 contain Attempt to Access Child of a Non-structure Pointer (CWE-588). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA…

    zephyrproject-rtos Zephyr
  • High 7.5
    CVE-2021-41120

    Unauthorized access to Credit card form in sylius/paypal-plugin

    sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created with autoincremented payment id (/pay-with-paypal/{id}) and therefore it was easy to predict. The pro…

    Sylius PayPalPlugin sylius/paypal-plugin Packagist
  • High 8.2
    CVE-2021-41116

    Command injection in composer on Windows

    Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not aff…

    composer composer composer/composer composer Ubuntu Alpine Packagist
  • High 7.5
    CVE-2021-35497

    TIBCO FTL unvalidated SAN in client certificates

    The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition,…

    TIBCO Software TIBCO FTL Enterprise Edition TIBCO FTL Community Edition TIBCO FTL Developer Edition
  • High 8.8
    CVE-2021-41113

    Cross-Site-Request-Forgery in Backend URI Handling in Typo3

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the new TYPO3 v11 feature that allows users to create and share deep links in the backend user interface is vulnerable to cross-site-reques…

    TYPO3 typo3 typo3/cms typo3/cms-core Web / CMS Packagist
  • High 7.3
    CVE-2021-22261

    A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.3
    CVE-2021-39887

    A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allow…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.5
    CVE-2021-41773 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

    A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Alpine
    KEV Nov 3, 2021