Skip to content
OpenAdvisories

Archive

29 December 2021

Vulnerabilities first published on this day (UTC), newest first.

← November 2021 2021 / December /29 January 2022 →
  1. 176
  2. 238
  3. 331
  4. 41
  5. 57
  6. 655
  7. 7135
  8. 8138
  9. 954
  10. 1033
  11. 112
  12. 123
  13. 13108
  14. 14116
  15. 15255
  16. 1644
  17. 1766
  18. 183
  19. 193
  20. 2073
  21. 2166
  22. 22117
  23. 2394
  24. 2417
  25. 2532
  26. 26244
  27. 2755
  28. 2828
  29. 2921
  30. 3050
  31. 3134
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 6.8
    CVE-2021-4187

    Use After Free in vim/vim

    vim is vulnerable to Use After Free

    vim vim/vim vim vim Debian Alpine
  • Medium 6.1
    CVE-2021-36724

    ForeScout - SecureConnector Local Service DoS

    ForeScout - SecureConnector Local Service DoS - A low privilaged user which doesn't have permissions to shutdown the secure connector service writes a large amount of characters in the installationPath. This will cause the buffer to overflow and override the …

    Forescout eServices / eNvoice
  • Medium 5.4
    CVE-2021-25993

    Requarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editor

    In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens t…

    requarks wiki
  • Medium 6.6
    CVE-2021-4175

    Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat

    livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    LiveHelperChat livehelperchat/livehelperchat
  • Medium 5.4
    CVE-2021-4176

    Cross-site Scripting (XSS) - Reflected in livehelperchat/livehelperchat

    livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    LiveHelperChat livehelperchat/livehelperchat
  • Medium 6.1
    CVE-2021-36723

    Emuse - eServices / eNvoice Exposure Of Private Personal Information

    Emuse - eServices / eNvoice Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs an attacker can scrape all the files on the service.

    Emuse eServices / eNvoice
  • Medium 5.3
    CVE-2021-38680

    Reflected XSS in Kazoo Server

    A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Kazoo Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of K…

    Linn Products Kazoo Server
  • Medium 4.9
    CVE-2021-35035

    A cleartext storage of sensitive information vulnerability in the Zyxel NBG6604 firmware could allow a remote, authenti…

    Zyxel NBG6604 series firmware Network devices
  • Medium 5.7
    CVE-2021-25991

    ifme - Improper Access Control leads to admin deactivation

    In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme.

    ifmeorg ifme
  • Medium 5.4
    CVE-2021-25990

    ifme - Stored Cross-Site Scripting (XSS) in Contacts section

    In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe.

    ifmeorg ifme
  • Medium 5.4
    CVE-2021-25989

    ifme - Stored Cross-Site Scripting (XSS) in Groups section

    In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them.

    ifmeorg ifme
  • Medium 5.4
    CVE-2021-25988

    ifme - Stored Cross-Site Scripting (XSS) in Notifications section

    In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability (notifications section) which can be directly triggered by sending an ally request to the admin.

    ifmeorg ifme