Skip to content
OpenAdvisories

Archive

16 November 2021

Vulnerabilities first published on this day (UTC), newest first.

← October 2021 2021 / November /16 December 2021 →
  1. 169
  2. 297
  3. 378
  4. 467
  5. 588
  6. 6 
  7. 76
  8. 891
  9. 971
  10. 10131
  11. 1123
  12. 1273
  13. 1314
  14. 1417
  15. 1566
  16. 1649
  17. 17106
  18. 1873
  19. 1973
  20. 2019
  21. 211
  22. 2254
  23. 2389
  24. 2444
  25. 251
  26. 2617
  27. 271
  28. 282
  29. 2953
  30. 3049
All Critical High Medium Low Exploited only Public exploit

49 results · Feed

  • High 7.8
    CVE-2021-25985

    FactorJS - Insufficient Session Expiration Leads to a Local Account Takeover

    In Factor (App Framework & Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expirat…

    FactorJS Factor
  • Medium 6.1
    CVE-2021-25984

    FactorJS - Stored Cross-Site Scripting (XSS) in Post Reply Functionality

    In Factor (App Framework & Headless CMS) forum plugin, versions v1.3.3 to v1.8.30, are vulnerable to stored Cross-Site Scripting (XSS) at the “post reply” section. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies.

    FactorJS Factor
  • Medium 6.1
    CVE-2021-25983

    FactorJS - Reflected Cross-Site Scripting (XSS) in Tags and Categories Functionality

    In Factor (App Framework & Headless CMS) forum plugin, versions v1.3.8 to v1.8.30, are vulnerable to reflected Cross-Site Scripting (XSS) at the “tags” and “category” parameters in the URL. An unauthenticated attacker can execute malicious JavaScript code and…

    FactorJS Factor
  • Medium 6.1
    CVE-2021-25982

    FactorJS - Reflected Cross-Site Scripting (XSS) in Search Functionality

    In Factor (App Framework & Headless CMS) forum plugin, versions 1.3.5 to 1.8.30, are vulnerable to reflected Cross-Site Scripting (XSS) at the “search” parameter in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the sessi…

    FactorJS Factor
  • Critical 9.8
    CVE-2021-37580 Public exploit Scanner template EPSS 41%

    Apache ShenYu Admin bypass JWT authentication

    A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0

    Apache Software Foundation Apache ShenYu Admin org.apache.shenyu:shenyu-admin Maven
  • High 8.8
    CVE-2021-25940

    ArangoDB - Insufficient Session Expiration after Password Change

    In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated, allowing a malicious user to still be logged in and perform arbitrary actions…

    Arangodb arangodb
  • High 8.8
    CVE-2021-25965

    Calibre-web - Admin Account Takeover via Cross-Site Request Forgery (CSRF)

    In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF). By luring an authenticated user to click on a link, an attacker can create a new user role with admin privileges and attacker-controlled credentials, allowing them t…

    Calibre Web calibreweb
  • High 8.1
    CVE-2021-25976

    Piranha CMS - Site-wide Cross-Site Request Forgery (CSRF)

    In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when …

    PiranhaCMS Piranha Piranha NuGet
  • Medium 4.3
    CVE-2021-42337

    TVN-202110009

    The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the remote attacker can access account information except passwords by crafting URL parameters.

    AIFU Information Technology Co. CASH