Skip to content
OpenAdvisories

Archive

17 November 2021

Vulnerabilities first published on this day (UTC), newest first.

← October 2021 2021 / November /17 December 2021 →
  1. 169
  2. 297
  3. 378
  4. 467
  5. 588
  6. 6 
  7. 76
  8. 891
  9. 971
  10. 10131
  11. 1123
  12. 1273
  13. 1314
  14. 1417
  15. 1566
  16. 1649
  17. 17106
  18. 1873
  19. 1973
  20. 2019
  21. 211
  22. 2254
  23. 2389
  24. 2444
  25. 251
  26. 2617
  27. 271
  28. 282
  29. 2953
  30. 3049
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 10.0
    CVE-2021-41277 Exploited Public exploit Scanner template EPSS 97%

    GeoJSON URL validation can expose server files and environment variables to unauthorized users

    Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment varia…

    metabase metabase
    KEV Nov 12, 2024
  • Critical 9.3
    CVE-2021-41274

    Authentication Bypass by CSRF Weakness

    solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of…

    solidusio solidus_auth_devise solidus_auth_devise RubyGems
  • Critical 9.3
    CVE-2021-41275

    Authentication Bypass by CSRF Weakness

    spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an underlying Devise authentication framework. In affected versions spree_auth_devise is subject to a CSR…

    spree spree_auth_devise spree_auth_devise RubyGems
  • Critical 9.8
    CVE-2021-43996

    Incorrect Access Control in Ignition

    The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control.

    facade/ignition Packagist