Archive
24 December 2021
Vulnerabilities first published on this day (UTC), newest first.
17 results · Feed
-
Unscored —
An issue was discovered in the Linux kernel before 5.15.11. There is a memory leak in the __rds_conn_create() function …
-
Medium 6.5
Cross-site Scripting (XSS) - Stored in invoiceninja/invoiceninja
invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
High 7.5
Regular Expression Denial of Service (ReDoS)
The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function.
-
High 7.5
Prototype Pollution
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of [CVE-2020-28442](https://snyk.io/vuln/SNYK-JS-JSDATA-1023655).
-
Critical 9.0
Cross-site Scripting (XSS) - Stored in elgg/elgg
elgg is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
High 7.5
Arbitrary File Write
This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the de…
-
Unscored —
dotenv is Unmaintained
dotenv by description is meant to be used in development or testing only. Using this in production may or may not be advisable. ## Alternatives The below may or may not be feasible alternative(s): - [dotenvy_codegen_impl](https://crates.io/crates/dotenvy_code…
-
Unscored —
dotenv is Unmaintained
dotenv by description is meant to be used in development or testing only. Using this in production may or may not be advisable. ## Alternatives The below may or may not be feasible alternative(s): - [dotenvy](https://crates.io/crates/dotenvy)
-
Unscored —
Path traversal vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earli…
-
Unscored —
Open redirect vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlie…
-
Unscored —
Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, …
-
Unscored —
Plaintext storage of a password vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earl…
-
Unscored —
Unprotected transport of credentials vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and…
-
Unscored —
In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items.
-
Unscored —
In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that…
-
Unscored —
In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL …
-
Unscored —
In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl p…