Skip to content
OpenAdvisories

Archive

1 December 2021

Vulnerabilities first published on this day (UTC), newest first.

← November 2021 2021 / December /1 January 2022 →
  1. 176
  2. 238
  3. 331
  4. 41
  5. 57
  6. 655
  7. 7135
  8. 8138
  9. 954
  10. 1033
  11. 112
  12. 123
  13. 13108
  14. 14116
  15. 15255
  16. 1644
  17. 1766
  18. 183
  19. 193
  20. 2073
  21. 2166
  22. 22117
  23. 2394
  24. 2417
  25. 2532
  26. 26244
  27. 2755
  28. 2828
  29. 2921
  30. 3050
  31. 3134
All Critical High Medium Low Exploited only Public exploit

22 results · Clear filters · Feed

  • Medium 4.3
    CVE-2021-43793

    Bypass of Poll voting limits in Discourse

    Discourse is an open source discussion platform. In affected versions a vulnerability in the Polls feature allowed users to vote multiple times in a single-option poll. The problem is patched in the latest tests-passed, beta and stable versions of Discourse

    Discourse Discourse
  • Medium 5.3
    CVE-2021-43794

    Anonymous user cache poisoning via development-mode header in Discourse

    Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown a JSON blob instead of the HTML page. This can lead to a partial denial-of-service. …

    Discourse Discourse
  • Medium 4.3
    CVE-2021-43792

    Notifications leak in Discourse

    Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who use the "Tags are visible only to the following groups" feature. A tag group may only allow a certain group (e.g. staff) to view certain tags…

    Discourse Discourse
  • Medium —
    GHSA-9jp8-cwwx-p64q

    XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext

    The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be …

    ezsystems/ezplatform-admin-ui Packagist
  • Medium —
    GHSA-fxwm-rx68-p5vx

    XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext

    The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be …

    ezsystems/ezplatform-richtext Packagist
  • Medium 5.4
    CVE-2021-29863

    IBM QRadar SIEM 7.3 and 7.4 is vulnerable to server side request forgery (SSRF). This may allow an authenticated attack…

    IBM QRadar SIEM
  • Medium 5.4
    CVE-2021-29849

    IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J…

    IBM QRadar SIEM
  • Medium 5.9
    CVE-2021-29779

    IBM QRadar SIEM 7.3 and 7.4 could allow an attacker to obtain sensitive information due to the server performing key ex…

    IBM QRadar SIEM
  • Medium 5.9
    CVE-2021-20400

    IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt …

    IBM QRadar SIEM
  • Medium 6.1
    CVE-2021-44479

    NXP Kinetis K82 devices have a buffer over-read via a crafted wlength value in a GET Status-Other request during use of…

  • Medium 6.1
    CVE-2021-40154 Public exploit

    NXP LPC55S69 devices before A3 have a buffer over-read via a crafted wlength value in a GET Descriptor Configuration re…

  • Medium 5.4
    CVE-2021-25967

    CKAN - Stored Cross-Site Scripting (XSS) via SVG File Upload

    In CKAN, versions 2.9.0 to 2.9.3 are affected by a stored XSS vulnerability via SVG file upload of users’ profile picture. This allows low privileged application users to store malicious scripts in their profile picture. These scripts are executed in a victim…

    ckan ckan ckan PyPI
  • Medium 6.1
    CVE-2021-44277

    Cross-site Scripting in LibreNMS

    Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/common/alert-log.inc.php.

    librenms/librenms Packagist
  • Medium 6.1
    CVE-2021-44279

    Cross-site Scripting in LibreNMS

    Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/forms/poller-groups.inc.php.

    librenms/librenms Packagist
  • Medium 4.3
    CVE-2021-3964

    Authorization Bypass Through User-Controlled Key in elgg/elgg

    elgg is vulnerable to Authorization Bypass Through User-Controlled Key

    Elgg elgg/elgg elgg/elgg Packagist
  • Medium 6.3
    CVE-2021-3983

    Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2

    kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    kevinpapst kevinpapst/kimai2 kevinpapst/kimai2 Packagist
  • Medium 6.5
    CVE-2021-3989

    Open Redirect in star7th/showdoc

    showdoc is vulnerable to URL Redirection to Untrusted Site

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Medium 6.5
    CVE-2021-3990

    Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in star7th/showdoc

    showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Medium 6.5
    CVE-2021-3992

    Improper Access Control in kevinpapst/kimai2

    kimai2 is vulnerable to Improper Access Control

    kevinpapst kevinpapst/kimai2 kevinpapst/kimai2 Packagist
  • Medium 4.3
    CVE-2021-3993

    Cross-Site Request Forgery (CSRF) in star7th/showdoc

    showdoc is vulnerable to Cross-Site Request Forgery (CSRF)

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Medium 4.3
    CVE-2021-4015

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

    firefly-iii firefly-iii/firefly-iii grumpydictator/firefly-iii Packagist
  • Medium 6.3
    CVE-2021-4018

    Cross-site Scripting (XSS) - Stored in snipe/snipe-it

    snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    snipe snipe/snipe-it snipe/snipe-it Packagist