Skip to content
OpenAdvisories

Archive

18 November 2021

Vulnerabilities first published on this day (UTC), newest first.

← October 2021 2021 / November /18 December 2021 →
  1. 169
  2. 297
  3. 378
  4. 467
  5. 588
  6. 6 
  7. 76
  8. 891
  9. 971
  10. 10131
  11. 1123
  12. 1273
  13. 1314
  14. 1417
  15. 1566
  16. 1649
  17. 17106
  18. 1873
  19. 1973
  20. 2019
  21. 211
  22. 2254
  23. 2389
  24. 2444
  25. 251
  26. 2617
  27. 271
  28. 282
  29. 2953
  30. 3049
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Medium 5.5
    CVE-2021-40131

    Cisco Common Services Platform Collector Stored Cross-Site Scripting Vulnerability

    A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to…

    Cisco Cisco Common Services Platform Collector Software Network devices
  • Medium 4.9
    CVE-2021-40130

    Cisco Common Services Platform Collector Improper Logging Restriction Vulnerability

    A vulnerability in the web application of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to specify non-log files as sources for syslog reporting. This vulnerability is due to improper restriction of the syslog c…

    Cisco Cisco Common Services Platform Collector Software Network devices
  • Medium 4.9
    CVE-2021-40129

    Cisco Common Services Platform Collector SQL Injection Vulnerability

    A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to submit a SQL query through the CSPC configuration dashboard. This vulnerability is due to insufficient input val…

    Cisco Cisco Common Services Platform Collector Software Network devices
  • Medium 5.4
    CVE-2021-41278 Public exploit

    Broken encryption in app-functions-sdk “AES” transform in EdgeX Foundry releases prior to Jakarta allows attackers to decrypt messages via unspecified vectors

    Functions SDK for EdgeX is meant to provide all the plumbing necessary for developers to get started in processing/transforming/exporting data out of the EdgeX IoT platform. In affected versions broken encryption in app-functions-sdk “AES” transform in EdgeX …

    edgexfoundry app-functions-sdk-go github.com/edgexfoundry/app-functions-sdk-go github.com/edgexfoundry/app-functions-sdk-go/v2 Go
  • Medium 4.2
    CVE-2021-43017

    Adobe Creative Cloud DLL Hijacking Local Application Denial of Service

    Adobe Creative Cloud version 5.5 (and earlier) are affected by an Application denial of service vulnerability in the Creative Cloud Desktop installer. An authenticated attacker with root privileges could leverage this vulnerability to achieve denial of servic…

    Adobe GoCart
  • Medium 5.2
    CVE-2021-23197

    Unquoted service path vulnerability in the Gallagher Controller Service allows an unprivileged user to execute arbitrar…

    Gallagher Command Centre
  • Medium 5.5
    CVE-2021-42268

    Adobe Animate FLA File Parsing Null Pointer Dereference Application Denial of Service

    Adobe Animate version 21.0.9 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted FLA file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the cont…

    Adobe Animate
  • Medium 5.5
    CVE-2021-40761

    Adobe After Effects NULL Pointer Dereference Application Denial of Service

    Adobe After Effects version 18.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the co…

    Adobe After Effects
  • Medium 5.5
    CVE-2021-40756

    Adobe After Effects NULL Pointer Dereference Application Denial of Service

    Adobe After Effects version 18.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the co…

    Adobe After Effects
  • Medium —
    CVE-2021-37939

    Kibana Sensitive Data Disclosure

    It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create co…

    Elastic Kibana kibana npm
  • Medium 5.5
    CVE-2021-43668

    Denial of Service in Go-Ethereum

    Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered. They will crash with "runtime error: invalid memory address or nil pointer dereference" and arise a SEGV signal.

    github.com/ethereum/go-ethereum golang-goleveldb Ubuntu Go
  • Medium 6.5
    CVE-2021-27023

    Unsafe HTTP Redirect in Puppet Agent and Puppet Server

    A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007

    puppet puppet puppet Debian Ubuntu RubyGems
  • Medium 6.5
    CVE-2021-27025

    Silent Configuration Failure in Puppet Agent

    A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.

    puppet puppet puppet Debian Ubuntu RubyGems
  • Medium 6.9
    CVE-2021-43549

    OSIsoft PI Web API

    A remote authenticated attacker with write access to a PI Server could trick a user into interacting with a PI Web API endpoint and redirect them to a malicious website. As a result, a victim may disclose sensitive information to the attacker or be provided w…

    OSIsoft PI Web API