Archive
December 2021
Vulnerabilities first published in this month (UTC), newest first.
332 results · Clear filters · Feed
-
Medium 5.6
IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to access the Spring Boot console wi…
-
Medium 5.9
IBM Spectrum Copy Data Management 2.2.13 and earlier uses weaker than expected cryptographic algorithms that could allo…
-
Medium 4.3
Missing authorization in GitLab EE versions between 12.4 and 14.3.6, between 14.4.0 and 14.4.4, and between 14.5.0 and …
-
Medium 6.5
An uncontrolled resource consumption vulnerability in GitLab Runner affecting all versions starting from 13.7 before 14…
-
Medium 6.8
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions star…
KEV Feb 3, 2026 -
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions star…
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions star…
-
Medium 4.3
Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions s…
-
Medium 4.3
Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the con…
-
Medium 4.4
In all versions of GitLab CE/EE starting version 14.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all…
-
Medium 5.3
Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all…
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions sta…
-
Medium 5.9
A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 …
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 before 14.3.6, all versions star…
-
Medium 4.2
A Hidden Functionality in Fortinet FortiOS 7.x before 7.0.1, FortiOS 6.4.x before 6.4.7 allows attacker to Execute unau…
-
Medium 4.7
reflected XSS in search functionality of WP Cloud Plugins - Lets-Box
Insufficient Input Validation in the search functionality of Wordpress plugin Lets-Box prior to 1.15.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
-
Medium 4.7
reflected XSS in search functionality of WP Cloud Plugins - Share-one-Drive
Insufficient Input Validation in the search functionality of Wordpress plugin Share-one-Drive prior to 1.15.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
-
Medium 4.7
reflected XSS in search functionality of WP Cloud Plugins - Out-of-the-Box
Insufficient Input Validation in the search functionality of Wordpress plugin Out-of-the-Box prior to 1.20.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
-
Medium 4.7
Reflected XSS in search functionality of WP Cloud Plugins - Use-Your-Drive
Insufficient Input Validation in the search functionality of Wordpress plugin Use-Your-Drive prior to 1.18.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
-
Medium 6.3
CRLF Injection in phpservermon/phpservermon
phpservermon is vulnerable to Improper Neutralization of CRLF Sequences
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in yetiforcecompany/yetiforcecrm
yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 4.3
Grafana directory traversal for `.cvs` files
Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source e…
-
Medium 6.5
Prototype Pollution
All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function.
-
Medium 6.5
Prototype Pollution
All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function.
-
Medium 6.5
Prototype Pollution
All versions of package comb are vulnerable to Prototype Pollution via the deepMerge() function.
-
Medium 4.3
Improper Access Control in snipe/snipe-it
snipe-it is vulnerable to Improper Access Control
-
Medium 6.3
IBM PowerVM Hypervisor FW940, FW950, and FW1010 could allow an authenticated user to cause the system to crash using a …
-
Medium 4.3CVE-2021-43813 EPSS 57%
Directory Traversal in Grafana
Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allo…
-
Medium 4.8
WordPress Comment Engine Pro plugin <= 1.0 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or higher role.
-
Medium 4.3
User interface Spoofing in F-Secure SAFE browser for Android
A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a specially crafted seemingly legitimate URL SAFE browser goes into full screen and hides the user interface. A remote attacker can leverage this to…
-
Medium 5.5
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in pimcore/pimcore
pimcore is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 5.8
Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails.
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium —
Server side request forgery in SwaggerUI
SwaggerUI supports displaying remote OpenAPI definitions through the `?url` parameter. This enables robust demonstration capabilities on sites like `petstore.swagger.io`, `editor.swagger.io`, and similar sites, where users often want to see what their OpenAPI…
-
Medium 5.9
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 uses weaker than expe…
-
Medium 6.5
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1, and 11.5 is vulnerable to an information disclo…
-
Medium 5.5
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local u…
-
Medium 5.9
IBM Db2 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an Information Disclosure when using the LOAD utility as u…
-
Medium 4.8
NSM vulnerable to XSS
Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) prior to 10.1 Minor 7 allows a remote authenticated administrator to embed a XSS in the administrator interface via specially crafted custom rules containing HTML. NSM did not c…