Skip to content
OpenAdvisories

Archive

14 October 2021

Vulnerabilities first published on this day (UTC), newest first.

← September 2021 2021 / October /14 November 2021 →
  1. 170
  2. 2 
  3. 3 
  4. 496
  5. 557
  6. 6129
  7. 770
  8. 859
  9. 9 
  10. 103
  11. 1166
  12. 1274
  13. 13120
  14. 1434
  15. 1559
  16. 16 
  17. 17 
  18. 1864
  19. 19120
  20. 20191
  21. 2159
  22. 22101
  23. 23 
  24. 24 
  25. 2584
  26. 2643
  27. 2770
  28. 28106
  29. 2931
  30. 301
  31. 3111
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.4
    CVE-2021-36387

    In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploit…

  • Medium 6.1
    CVE-2021-42227

    Cross site scripting in kindeditor

    Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .html file on the website that uses this editor (the file suffix is allowed).

    kindeditor npm
  • Medium 5.4
    CVE-2021-41142

    XSS via the name of a deleted attachment

    Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. There is a cross-site scripting vulnerability in Tuleap Community Edition prior to 12.11.99.25 and Tuleap Enterprise Edition 12.11-2. A malicio…

    Enalean tuleap
  • Medium 6.4
    CVE-2021-38344

    Brizy <= 2.3.11 Authenticated Stored Cross-Site Scripting

    The Brizy Page Builder plugin <= 2.3.11 for WordPress was vulnerable to stored XSS by lower-privileged users such as a subscribers. It was possible to add malicious JavaScript to a page by modifying the request sent to update the page via the brizy_update_ite…

    Brizy.io Brizy - Page Builder
  • Medium 6.1
    CVE-2021-22963

    URL Redirection to Untrusted Site ('Open Redirect') in fastify-static

    A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.The issue shows up on all the fastify-st…

    fastify-static npm
  • Medium 5.9
    CVE-2021-3882

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ledgersmb/ledgersmb

    LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user to use an unencrypted connection (HTTP), an attacker may be able to obtain the …

    ledgersmb ledgersmb/ledgersmb ledgersmb Ubuntu