Skip to content
OpenAdvisories

Archive

26 November 2021

Vulnerabilities first published on this day (UTC), newest first.

← October 2021 2021 / November /26 December 2021 →
  1. 169
  2. 297
  3. 378
  4. 467
  5. 588
  6. 6 
  7. 76
  8. 891
  9. 971
  10. 10131
  11. 1123
  12. 1273
  13. 1314
  14. 1417
  15. 1566
  16. 1649
  17. 17106
  18. 1873
  19. 1973
  20. 2019
  21. 211
  22. 2254
  23. 2389
  24. 2444
  25. 251
  26. 2617
  27. 271
  28. 282
  29. 2953
  30. 3049
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.6
    CVE-2021-43785

    Cross Site Scripting Vulnerability in @joeattardi/emoji-button

    @joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a `script…

    joeattardi emoji-button @joeattardi/emoji-button npm
  • High 7.4
    CVE-2021-43776

    XSS vulnerability in @backstage/plugin-auth-backend

    Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacke…

    backstage backstage @backstage/plugin-auth-backend npm
  • High 7.7
    CVE-2021-41279

    Zip Slip Vulnerability in BaserCMS

    BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload privilege may upload crafted zip files capable of path traversal on the host operating system. This is a vulnerability that …

    baserproject basercms baserproject/basercms Packagist
  • High 7.5
    CVE-2021-35533

    Specially Crafted IEC 60870-5-104 Packet Vulnerability in RTU500 series

    Improper Input Validation vulnerability in the APDU parser in the Bidirectional Communication Interface (BCI) IEC 60870-5-104 function of Hitachi Energy RTU500 series allows an attacker to cause the receiving RTU500 CMU of which the BCI is enabled to reboot w…

    Hitachi Energy RTU500 series ICS / OT
  • High 7.8
    CVE-2021-26615

    bandisoft ARK library integer overflow vulnerability

    ARK library allows attackers to execute remote code via the parameter(path value) of Ark_NormalizeAndDupPAthNameW function because of an integer overflow.

    Bandisoft ARK
  • High 8.1
    CVE-2021-26611

    HejHome IP Camera use of hard-coded credentials vulnerability

    HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability. This issue allows remote attackers to operate the IP Camera.(reboot, factory reset, snapshot etc..)

    Goqual GKW-IC052
  • High 7.5
    CVE-2020-7881

    AfreecaTV streamer service stack-based buffer overflow

    The vulnerability function is enabled when the streamer service related to the AfreecaTV communicated through web socket using 21201 port. A stack-based buffer overflow leading to remote code execution was discovered in strcpy() operate by "FanTicket" field. …

    AfreecaTV afreecatvstreamer.exe
  • High 8.8
    CVE-2021-36807

    An authenticated user could potentially execute code via an SQLi vulnerability in the user portal of SG UTM before vers…

    Sophos SG UTM Network devices
  • High 8.8
    CVE-2021-38686

    Improper Authentication Vulnerability in VioStor

    An improper authentication vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of QVR: Q…

    QNAP Systems QVR