Skip to content
OpenAdvisories

Archive

7 October 2021

Vulnerabilities first published on this day (UTC), newest first.

← September 2021 2021 / October /7 November 2021 →
  1. 170
  2. 2 
  3. 3 
  4. 496
  5. 557
  6. 6129
  7. 770
  8. 859
  9. 9 
  10. 103
  11. 1166
  12. 1274
  13. 13120
  14. 1434
  15. 1559
  16. 16 
  17. 17 
  18. 1864
  19. 19120
  20. 20191
  21. 2159
  22. 22101
  23. 23 
  24. 24 
  25. 2584
  26. 2643
  27. 2770
  28. 28106
  29. 2931
  30. 301
  31. 3111
All Critical High Medium Low Exploited only Public exploit

18 results · Clear filters · Feed

  • Medium 4.3
    CVE-2021-41115

    Regular expression denial-of-service in Zulip

    Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers" that automatically create links from messages that users send, detected via arbitrary regular expressions. Malicious …

    zulip zulip
  • Medium 6.4
    CVE-2021-41130

    X-Endpoint-API-UserInfo can be spoofed in cloudendpoints Extensible Service Proxy

    Extensible Service Proxy, a.k.a. ESP is a proxy which enables API management capabilities for JSON/REST or gRPC API services. ESPv1 can be configured to authenticate a JWT token. Its verified JWT claim is passed to the application by HTTP header "X-Endpoint-A…

    cloudendpoints esp
  • Medium 4.3
    CVE-2021-29700

    IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authneticated attacker to obtain se…

    IBM Sterling B2B Integrator
  • Medium 6.5
    CVE-2021-20584

    IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote attacker to upload arbitrary files, caused by im…

    IBM Sterling File Gateway
  • Medium 4.9
    CVE-2021-20571

    IBM Sterling B2B Integrator 5.2.0.0 through 6.1.1.0 is vulnerable to stored cross-site scripting. This vulnerability al…

    IBM Sterling B2B Integrator
  • Medium 5.4
    CVE-2021-20561

    IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows user…

    IBM Sterling File Gateway
  • Medium 4.3
    CVE-2021-20552

    IBM Sterling File Gateway 6.0.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a …

    IBM Sterling File Gateway
  • Medium 4.3
    CVE-2021-20489

    IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an atta…

    IBM Sterling File Gateway
  • Medium 5.4
    CVE-2021-20481

    IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows user…

    IBM Sterling File Gateway
  • Medium 6.3
    CVE-2021-20473

    IBM Sterling File Gateway User Interface 2.2.0.0 through 6.1.1.0 does not invalidate session after logout which could a…

    IBM Sterling File Gateway
  • Medium 4.3
    CVE-2021-20376

    IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated attacker to enumerate usernames due to t…

    IBM Sterling File Gateway
  • Medium 6.5
    CVE-2021-20375

    IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to intercept and replace a message …

    IBM Sterling File Gateway
  • Medium 4.3
    CVE-2021-20372

    IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote authenticated user to cause a denial of another …

    IBM Sterling File Gateway
  • Medium 5.4
    CVE-2021-23447

    Cross-site Scripting (XSS)

    This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization when the model content is an array (instead of a string).

    teddy npm
  • Medium 5.4
    CVE-2021-3834

    Integria IMS vulnerable to Cross Site Scripting (XSS)

    Integria IMS in its 5.0.92 version does not filter correctly some fields related to the login.php file. An attacker could exploit this vulnerability in order to perform a cross-site scripting attack (XSS).

    Ártica Integria IMS
  • Medium 4.3
    CVE-2021-28661

    SilverStripe GraphQL Server permission checker not inherited by query subclass.

    Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.

    silverstripe/graphql Packagist
  • Medium 6.1
    CVE-2021-36150

    Cross-site Scripting in SilverStripe Framework

    SilverStripe Framework through 4.8.1 allows XSS.

    silverstripe/admin Packagist
  • Medium 6.1
    CVE-2021-42053 Public exploit

    Cross-site scripting in Unicorn framework

    The Unicorn framework through 0.35.3 for Django allows XSS via component.name.

    django-unicorn PyPI