Skip to content
OpenAdvisories

Archive

29 November 2021

Vulnerabilities first published on this day (UTC), newest first.

← October 2021 2021 / November /29 December 2021 →
  1. 169
  2. 297
  3. 378
  4. 467
  5. 588
  6. 6 
  7. 76
  8. 891
  9. 971
  10. 10131
  11. 1123
  12. 1273
  13. 1314
  14. 1417
  15. 1566
  16. 1649
  17. 17106
  18. 1873
  19. 1973
  20. 2019
  21. 211
  22. 2254
  23. 2389
  24. 2444
  25. 251
  26. 2617
  27. 271
  28. 282
  29. 2953
  30. 3049
All Critical High Medium Low Exploited only Public exploit

53 results · Feed

  • Unscored —
    CVE-2021-24751

    GenerateBlocks < 1.4.0 - Contributor+ Stored Cross-Site Scripting

    The GenerateBlocks WordPress plugin before 1.4.0 does not validate the generateblocks/container block's tagName attribute, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.

    Web / CMS
  • Unscored —
    CVE-2021-24749

    URL Shortify < 1.5.1 - Arbitrary Link/Group Deletion via CSRF

    The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logged in admin delete arbitrary link and group via a CSRF attack.

    Web / CMS
  • Unscored —
    CVE-2021-24748

    Email Before Download < 6.8 - Admin+ SQL Injection

    The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before using them in SQL statements, leading to authenticated SQL injection issues

    Web / CMS
  • Unscored —
    CVE-2021-24745

    About Author Box < 1.0.2 - Contributor+ Stored Cross-Site Scripting

    The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks.

    Web / CMS
  • Unscored —
    CVE-2017-20008

    myCRED < 1.7.8 - Reflected Cross-Site Scripting

    The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting

    Web / CMS
  • Unscored —
    CVE-2021-38283

    Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read application log files containing s…

  • Unscored —
    CVE-2021-38147 Scanner template EPSS 53%

    Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as repor…

  • Medium 5.3
    CVE-2021-21707 Public exploit EPSS 25%

    Special characters break path parsing in XML functions

    In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function …

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • Critical 9.8
    CVE-2021-44077 Exploited Public exploit Scanner template EPSS 94%

    Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014…

    KEV Dec 1, 2021
  • Medium 5.3
    CVE-2021-32061

    S3Scanner allows Directory Traversal

    S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a <Key>../ substring in a ListBucketResult element.

    s3scanner PyPI
  • Unscored —
    CVE-2021-3802

    A vulnerability found in udisks2. This flaw allows an attacker to input a specially crafted image file/USB leading to k…

    udisks2 udisks2 udisks2 Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2019-8922

    A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there…

    bluez bluez Debian Ubuntu
  • Medium 6.5
    CVE-2019-8921

    An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ b…

    bluez bluez Debian Ubuntu