Skip to content
OpenAdvisories

Archive

19 November 2021

Vulnerabilities first published on this day (UTC), newest first.

← October 2021 2021 / November /19 December 2021 →
  1. 169
  2. 297
  3. 378
  4. 467
  5. 588
  6. 6 
  7. 76
  8. 891
  9. 971
  10. 10131
  11. 1123
  12. 1273
  13. 1314
  14. 1417
  15. 1566
  16. 1649
  17. 17106
  18. 1873
  19. 1973
  20. 2019
  21. 211
  22. 2254
  23. 2389
  24. 2444
  25. 251
  26. 2617
  27. 271
  28. 282
  29. 2953
  30. 3049
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.8
    CVE-2021-41280

    OS command injection in Sharetribe Go

    Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service (SNS) notification token configured via …

    sharetribe sharetribe
  • Critical 10.0
    CVE-2021-40391

    An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (c…

    gerbv gerbv Debian Ubuntu
  • Critical 9.3
    CVE-2021-43409

    WPO365 | LOGIN - Wordpress Plugin Persistent Cross-Site Scripting

    The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application…

    wpo365.com WordPress + Microsoft Office 365 / Azure AD | LOGIN Web / CMS
  • Critical 9.1
    CVE-2021-39233

    Container-related datanode operations can be called without authorization

    In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.

    Apache Software Foundation Apache Ozone org.apache.ozone:ozone-main Maven
  • Critical 9.1
    CVE-2021-39231

    Missing authentication/authorization on internal RPC endpoints

    In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.

    Apache Software Foundation Apache Ozone org.apache.ozone:ozone-main Maven
  • Critical 9.8
    CVE-2021-36372

    Original block tokens are persisted and can be retrieved

    In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.

    Apache Software Foundation Apache Ozone org.apache.ozone:ozone-main Maven
  • Critical 9.8
    CVE-2021-42338

    4MOSAn GCB Doctor - Improper Authorization

    4MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in cookie, and arbitrarily manipulate the system or interrupt services by upload and execution of arbi…

    4MOSAn GCB Doctor
  • Critical 9.8
    CVE-2021-44026 Exploited Public exploit EPSS 70%

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

    roundcube roundcube Debian Ubuntu
    KEV Jun 22, 2023