Skip to content
OpenAdvisories

Archive

1 November 2021

Vulnerabilities first published on this day (UTC), newest first.

← October 2021 2021 / November /1 December 2021 →
  1. 169
  2. 297
  3. 378
  4. 467
  5. 588
  6. 6 
  7. 76
  8. 891
  9. 971
  10. 10131
  11. 1123
  12. 1273
  13. 1314
  14. 1417
  15. 1566
  16. 1649
  17. 17106
  18. 1873
  19. 1973
  20. 2019
  21. 211
  22. 2254
  23. 2389
  24. 2444
  25. 251
  26. 2617
  27. 271
  28. 282
  29. 2953
  30. 3049
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.1
    CVE-2021-41187

    SQL Injection in DHIS2 Tracker API

    DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability has been found in specific versions of DHIS2. This vulnerability affects the API endpoints for /api/trackedEntityInst…

    dhis2 dhis2-core
  • High 8.2
    CVE-2021-39341 Scanner template EPSS 22%

    OptinMonster <= 2.6.4 Unprotected REST-API Endpoints

    The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploi…

    OptinMonster OptinMonster Web / CMS
  • High 8.1
    CVE-2021-39333

    Hashthemes Demo Importer <= 1.1.1 Improper Access Control Allowing Content Deletion

    The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to execute a function that truncated nearly all database tables and …

    HashThemes HashThemes Demo Importer
  • High 8.4
    CVE-2021-31848

    Data Loss Prevention (DLP) ePO extension - Cross site scripting (XSS)

    Cross site scripting (XSS) vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.7.100 allows a remote attacker to highjack an active DLP ePO administrator session by convincing the logged in administrator to click on a carefully crafte…

    McAfee Data Loss Prevention (DLP) ePO extension
  • High 8.4
    CVE-2021-31849

    Data Loss Prevention (DLP) ePO extension - SQL injection

    SQL injection vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.7.100 allows a remote attacker logged into ePO as an administrator to inject arbitrary SQL into the ePO database through the user management section of the DLP ePO exte…

    McAfee Data Loss Prevention (DLP) ePO extension
  • High 8.8
    CVE-2021-27644

    DolphinScheduler mysql jdbc connector parameters deserialize remote code execution

    In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)

    Apache Software Foundation Apache DolphinScheduler org.apache.dolphinscheduler:dolphinscheduler-server Maven
  • High 8.3
    CVE-2021-42694 Public exploit

    An issue was discovered in the character definitions of the Unicode Specification through 14.0. The specification allow…