Skip to content
OpenAdvisories

Archive

November 2021

Vulnerabilities first published in this month (UTC), newest first.

← October 2021 2021 / November December 2021 →
  1. 169
  2. 297
  3. 378
  4. 467
  5. 588
  6. 6 
  7. 76
  8. 891
  9. 971
  10. 10131
  11. 1123
  12. 1273
  13. 1314
  14. 1417
  15. 1566
  16. 1649
  17. 17106
  18. 1873
  19. 1973
  20. 2019
  21. 211
  22. 2254
  23. 2389
  24. 2444
  25. 251
  26. 2617
  27. 271
  28. 282
  29. 2953
  30. 3049
All Critical High Medium Low Exploited only Public exploit

332 results · Clear filters · Feed

  • Medium 5.4
    CVE-2021-29771

    IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed …

    IBM InfoSphere Information Server
  • Medium 5.4
    CVE-2021-29738

    IBM InfoSphere Data Flow Designer (IBM InfoSphere Information Server 11.7 ) is vulnerable to server-side request forger…

    IBM InfoSphere Information Server
  • Medium 5.9
    CVE-2021-29737

    IBM InfoSphere Data Flow Designer Engine (IBM InfoSphere Information Server 11.7 ) component has improper validation of…

    IBM InfoSphere Information Server
  • Medium 6.1
    CVE-2021-33611

    Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14

    Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL

    vaadin vaadin vaadin-menu-bar com.vaadin:vaadin-bom Maven
  • Medium 5.3
    CVE-2021-3765

    Inefficient Regular Expression Complexity in validatorjs/validator.js

    validator.js is vulnerable to Inefficient Regular Expression Complexity

    validatorjs validatorjs/validator.js validator validator.js Ubuntu npm
  • Medium 6.5
    CVE-2021-25973

    Publify - Improper Authorization Leads to Guest Signup Restriction Bypass

    In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happens due to front-end restriction only.

    publify_core publify_core publify_core RubyGems
  • Medium 4.8
    CVE-2021-39340

    Notification – Custom Notifications and Alerts for WordPress <= 7.2.4 Authenticated Stored Cross-Site Scripting

    The Notification WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/src/classes/Utils/Settings.php file which made it possible for attackers with administra…

    Notification – Custom Notifications and Alerts for WordPress Notification – Custom Notifications and Alerts for WordPress Web / CMS
  • Medium 6.1
    CVE-2021-38356

    NextScripts: Social Networks Auto-Poster <= 4.3.20 Reflected Cross-Site Scripting

    The NextScripts: Social Networks Auto-Poster <= 4.3.20 WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $_REQUEST['page'] parameter which is echoed out on inc/nxs_class_snap.php by supplying the appropriate value 'nxssnap-post' to load…

    nextscripts NextScripts: Social Networks Auto-Poster Web / CMS
  • Medium 4.8
    CVE-2021-39346

    Google Maps Easy <= 1.9.33 Authenticated Stored Cross-Site Scripting

    The Google Maps Easy WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/modules/marker_groups/views/tpl/mgrEditMarkerGroup.php file which allowed attackers …

    Google Maps Easy Google Maps Easy Web / CMS
  • Medium 4.5
    CVE-2021-22564

    Out of bounds Copy in Libjxl in large image groups

    For certain valid JPEG XL images with a size slightly larger than an integer number of groups (256x256 pixels) when processing the groups out of order the decoder can perform an out of bounds copy of image pixels from an image buffer in the heap to another. T…

    Google libjxl
  • Medium 4.5
    CVE-2021-22563

    Memory Overread in libjxl

    Invalid JPEG XL images using libjxl can cause an out of bounds access on a std::vector<std::vector<T>> when rendering splines. The OOB read access can either lead to a segfault, or rendering splines based on other process memory. It is recommended to upgrade …

    Google libjxl
  • Medium 6.5
    CVE-2021-41973

    Apache MINA HTTP listener DOS

    In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update …

    Apache Software Foundation Apache MINA mina2 mina Debian Ubuntu Maven