Skip to content
OpenAdvisories

Archive

25 October 2021

Vulnerabilities first published on this day (UTC), newest first.

← September 2021 2021 / October /25 November 2021 →
  1. 170
  2. 2 
  3. 3 
  4. 496
  5. 557
  6. 6129
  7. 770
  8. 859
  9. 9 
  10. 103
  11. 1166
  12. 1274
  13. 13120
  14. 1434
  15. 1559
  16. 16 
  17. 17 
  18. 1864
  19. 19120
  20. 20191
  21. 2159
  22. 22101
  23. 23 
  24. 24 
  25. 2584
  26. 2643
  27. 2770
  28. 28106
  29. 2931
  30. 301
  31. 3111
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 6.5
    CVE-2021-41179

    Two-Factor Authentication not enforced for pages marked as public

    Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as `@PublicPage` could thus be accessed w…

    Nextcloud security-advisories
  • Medium 4.8
    CVE-2021-39223

    File path disclosure of shared files in Richdocuments application

    Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Richdocuments application prior to versions 3.8.6 and 4.2.3 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. (e.g. an a…

    Nextcloud security-advisories
  • Medium 6.4
    CVE-2021-39221

    XSS in Contacts

    Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, a user would need to right-click on a malicious fi…

    Nextcloud security-advisories
  • Medium 6.5
    CVE-2021-34860

    This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-L…

    D-Link DAP-2020 Network devices
  • Medium 6.5
    CVE-2021-34855

    This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…

    Parallels Desktop
  • Medium 4.3
    CVE-2021-41176

    logout CSRF in Pterodactyl Panel

    Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-…

    pterodactyl panel pterodactyl/panel Packagist
  • Medium 6.8
    CVE-2021-21319

    Several stored XSS

    Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscription page. The self subscription feature can be disabled as a…

    galette galette galette Ubuntu
  • Medium 5.3
    CVE-2017-20007

    Information Exposure in INGEPAC DA AU

    Ingeteam INGEPAC DA AU AUC_1.13.0.28 (and before) web application allows access to a certain path that contains sensitive information that could be used by an attacker to execute more sophisticated attacks. An unauthenticated remote attacker with access to th…

    Ingeteam INGEPAC DA AU
  • Medium 5.4
    CVE-2021-25977

    Piranha CMS - Stored XSS in Page Title

    In PiranhaCMS, versions 7.0.0 to 9.1.1 are vulnerable to stored XSS due to the page title improperly sanitized. By creating a page with a specially crafted page title, a low privileged user can trigger arbitrary JavaScript execution.

    PiranhaCMS Piranha Piranha NuGet
  • Medium 6.7
    CVE-2021-35231

    Unquoted Path (SMB Login) Vulnerability

    As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry. Example vulnerab…

    SolarWinds Kiwi Syslog Server
  • Medium 4.8
    CVE-2021-40526

    Incorrect calculation of buffer size vulnerability in Peleton TTR01 up to and including PTV55G allows a remote attacker…