Skip to content
OpenAdvisories

Archive

13 December 2021

Vulnerabilities first published on this day (UTC), newest first.

← November 2021 2021 / December /13 January 2022 →
  1. 176
  2. 238
  3. 331
  4. 41
  5. 57
  6. 655
  7. 7135
  8. 8138
  9. 954
  10. 1033
  11. 112
  12. 123
  13. 13108
  14. 14116
  15. 15255
  16. 1644
  17. 1766
  18. 183
  19. 193
  20. 2073
  21. 2166
  22. 22117
  23. 2394
  24. 2417
  25. 2532
  26. 26244
  27. 2755
  28. 2828
  29. 2921
  30. 3050
  31. 3134
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 7.5
    CVE-2021-41272

    SHL, SHR, and SAR operations trigger native exception at key values in besu

    Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations resulted in the introduction of a signed type coercion error in values that represent negative values for 32 bit signed …

    hyperledger besu
  • High 8.5
    CVE-2021-43822

    SQL injection in jackalope/jackalope-doctrine-dbal

    Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to res…

    jackalope jackalope-doctrine-dbal jackalope/jackalope-doctrine-dbal Packagist
  • High 8.2
    CVE-2021-43817

    Reflected Cross-Site-Scripting vulnerability in Collabora Online

    Collabora Online is a collaborative online office suite based on LibreOffice technology. In affected versions a reflected XSS vulnerability was found in Collabora Online. An attacker could inject unescaped HTML into a variable as they created the Collabora On…

    CollaboraOnline online
  • High 7.7
    CVE-2021-43814

    Heap-based OOB write when parsing dwarf DIE info in Rizin

    Rizin is a UNIX-like reverse engineering framework and command-line toolset. In versions up to and including 0.3.1 there is a heap-based out of bounds write in parse_die() when reversing an AMD64 ELF binary with DWARF debug info. When a malicious AMD64 ELF bi…

    rizinorg rizin
  • High 7.5
    CVE-2021-43801

    Uncaught Exception in mercurius

    Mercurius is a GraphQL adapter for Fastify. Any users from Mercurius@8.10.0 to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to `/graphql` unless they are using a custom error handler. The vulnerability has been fixed in https…

    mercurius-js mercurius mercurius npm
  • High 8.1
    CVE-2021-32024

    A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an…

    BlackBerry QNX Software Development Platform (SDP)
  • High 8.2
    CVE-2021-43818

    HTML Cleaner allows crafted and SVG embedded scripts to pass through

    lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ th…

    lxml lxml lxml lxml Debian Ubuntu Alpine PyPI
  • High 8.1
    CVE-2021-39065

    IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to execute arbitrary commands on the…

    IBM Spectrum Copy Data Management
  • High 7.8
    CVE-2021-43983

    WECON LeviStudioU

    WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to multiple stack-based buffer overflow instances while parsing project files, which may allow an attacker to execute arbitrary code.

    WECON LeviStudioU
  • High 7.1
    CVE-2021-39944

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions star…

    GitLab GitLab gitlab Web / CMS Ubuntu