Skip to content
OpenAdvisories

Archive

22 October 2021

Vulnerabilities first published on this day (UTC), newest first.

← September 2021 2021 / October /22 November 2021 →
  1. 170
  2. 2 
  3. 3 
  4. 496
  5. 557
  6. 6129
  7. 770
  8. 859
  9. 9 
  10. 103
  11. 1166
  12. 1274
  13. 13120
  14. 1434
  15. 1559
  16. 16 
  17. 17 
  18. 1864
  19. 19120
  20. 20191
  21. 2159
  22. 22101
  23. 23 
  24. 24 
  25. 2584
  26. 2643
  27. 2770
  28. 28106
  29. 2931
  30. 301
  31. 3111
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 5.4
    CVE-2020-23049

    Cross-site scripting in forkcms

    Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the `Displayname` field when using the `Add`, `Edit` or `Register' functions. This vulnerability allows attackers to execute arbitrary web script…

    forkcms/forkcms Packagist
  • Medium 5.4
    CVE-2020-28957

    Foxlor cross-site scripting (XSS) vulnerability

    Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the name, firstname, or username input fields.

    froxlor/froxlor Packagist
  • Medium 5.4
    CVE-2021-29835

    IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability a…

    IBM Business Automation Workflow
  • Medium 5.9
    CVE-2021-41171

    Bypass bruteforce protection on login form in elabftw

    eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This iss…

    elabftw elabftw
  • Medium 6.3
    CVE-2021-42534

    Trane Building Automation Controllers Cross-site Scripting

    The affected product’s web application does not properly neutralize the input during webpage generation, which could allow an attacker to inject code in the input forms.

    Trane Tracer SC
  • Medium 4.8
    CVE-2021-38451

    AUVESY Versiondog

    The affected product’s proprietary protocol CSC allows for calling numerous function codes. In order to call those function codes, the user must supply parameters. There is no sanitation on the value of the offset, which allows the client to specify any offse…

    AUVESY Versiondog
  • Medium 6.5
    CVE-2021-38479

    AUVESY Versiondog

    Many API function codes receive raw pointers remotely from the user and trust these pointers as valid in-bound memory regions. An attacker can manipulate API functions by writing arbitrary data into the resolved address of a raw pointer.

    AUVESY Versiondog
  • Medium 6.7
    CVE-2021-35230

    Unquoted Path Vulnerability (SMB Login) in Kiwi CatTools

    As a result of an unquoted service path vulnerability present in the Kiwi CatTools Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry.

    SolarWinds Kiwi CatTools
  • Medium 4.8
    CVE-2021-31835

    McAfee ePO Cross-Site Scripting vulnerability

    Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or HTML via a specific parameter where the administrator's entries were not correctly sanitized.

    McAfee,LLC McAfee ePolicy Orchestrator (ePO)