Skip to content
OpenAdvisories

Archive

23 November 2021

Vulnerabilities first published on this day (UTC), newest first.

← October 2021 2021 / November /23 December 2021 →
  1. 169
  2. 297
  3. 378
  4. 467
  5. 588
  6. 6 
  7. 76
  8. 891
  9. 971
  10. 10131
  11. 1123
  12. 1273
  13. 1314
  14. 1417
  15. 1566
  16. 1649
  17. 17106
  18. 1873
  19. 1973
  20. 2019
  21. 211
  22. 2254
  23. 2389
  24. 2444
  25. 251
  26. 2617
  27. 271
  28. 282
  29. 2953
  30. 3049
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Medium 6.8
    CVE-2021-43780

    Server-Side Request Forgery (SSRF) in Redash

    Redash is a package for data visualization and sharing. In versions 10.0 and priorm the implementation of URL-loading data sources like JSON, CSV, or Excel is vulnerable to advanced methods of Server Side Request Forgery (SSRF). These vulnerabilities are only…

    getredash redash
  • Medium 6.8
    CVE-2021-43777

    Vulnerability in Redash OAuth2 flows due to misuse of state field (should be a nonce)

    Redash is a package for data visualization and sharing. In Redash version 10.0 and prior, the implementation of Google Login (via OAuth) incorrectly uses the `state` parameter to pass the next URL to redirect the user to after login. The `state` parameter sho…

    getredash redash
  • Medium 6.1
    CVE-2021-38000 Exploited

    Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remot…

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu
    KEV Nov 3, 2021
  • Medium 4.3
    CVE-2021-36335

    Dell EMC CloudLink 7.1 and all prior versions contain an Improper Input Validation Vulnerability. A remote low privileg…

    Dell CloudLink
  • Medium 5.9
    CVE-2021-36334

    Dell EMC CloudLink 7.1 and all prior versions contain a CSV formula Injection Vulnerability. A remote high privileged a…

    Dell CloudLink
  • Medium 5.5
    CVE-2021-36333

    Dell EMC CloudLink 7.1 and all prior versions contain a Buffer Overflow Vulnerability. A local low privileged attacker,…

    Dell CloudLink
  • Medium 5.4
    CVE-2021-36332

    Dell EMC CloudLink 7.1 and all prior versions contain a HTML and Javascript Injection Vulnerability. A remote low privi…

    Dell CloudLink
  • Medium 6.0
    CVE-2021-36311

    Dell EMC Networker versions prior to 19.5 contain an Improper Authorization vulnerability. Any local malicious user wit…

    Dell NetWorker
  • Medium 5.9
    CVE-2021-36301 EPSS 28%

    Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Rac…

    Dell Integrated Dell Remote Access Controller (iDRAC)
  • Medium 6.5
    CVE-2021-36300 EPSS 33%

    iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability. An unauthenticated remote attac…

    Dell Integrated Dell Remote Access Controller (iDRAC)
  • Medium 5.4
    CVE-2021-25986

    Django-wiki - Stored Cross-Site Scripting (XSS) in Notifications Section

    In Django-wiki, versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting (XSS) in Notifications Section. An attacker who has access to edit pages can inject JavaScript payload in the title field. When a victim gets a notification regarding the c…

    Django-wiki Django-wiki wiki PyPI
  • Medium 6.1
    CVE-2021-31851

    Cross-Site Scripting vulnerability in Policy Auditor

    A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the profileNodeID request parameters. The malicious script is reflected unmodified into …

    McAfee,LLC McAfee Policy Auditor
  • Medium 6.1
    CVE-2021-31852

    Cross-Site Scripting vulnerability in Policy Auditor

    A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the UID request parameter. The malicious script is reflected unmodified into the Policy …

    McAfee,LLC McAfee Policy Auditor
  • Medium 5.9
    CVE-2021-38891

    IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses weaker than expected cryptographic algorithms that could allo…

    IBM Connect:Direct Web Services
  • Medium 5.9
    CVE-2021-38890

    IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses an inadequate account lockout setting that could allow a remo…

    IBM Connect:Direct Web Services
  • Medium 6.5
    CVE-2021-38875

    IBM MQ 8.0, 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.1 CD, and 9.2 CD is vulnerable to a denial of service attack caused by an erro…

    IBM MQ