Search vulnerabilities

Expected end of text, found ':' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,865

CVE-2021-3780

Cross-site Scripting (XSS) - Stored in chocobozzz/peertube

peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Framasoft
Products
Peertube
CVE-2021-3779

Ruby-MySQL Gem Client File Read

A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. This issue was resolved in version 2.10.0 and later.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Ruby-mysql Project
Products
Ruby-mysql
CVE-2021-3777

Inefficient Regular Expression Complexity in daaku/nodejs-tmpl

nodejs-tmpl is vulnerable to Inefficient Regular Expression Complexity

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Tmpl Project
Products
Tmpl
CVE-2021-3776

Cross-Site Request Forgery (CSRF) in star7th/showdoc

showdoc is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2021-3775

Cross-Site Request Forgery (CSRF) in star7th/showdoc

showdoc is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2021-3772

kernel: sctp: Invalid chunks may be used to remotely remove existing associations

A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Linux Netapp and 2 more
Products
Debian Linux Linux Kernel E-series Santricity Os Controller and 23 more
CVE-2021-3769

OS Command Injection in ohmyzsh/ohmyzsh

# Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied strings to print them to the terminal. All of them do that on git information, particularly the branch name, so if the branch has a specially-crafted name the vulnerability can be exploited. **Fixed in**: [b3ba9978](https://github.com/ohmyzsh/ohmyzsh/commit/b3ba9978). **Impacted areas**: - `pygmalion` theme. - `pygmalion-virtualenv` theme. - `refined` theme.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Planetargon
Products
Oh My Zsh
CVE-2021-3768

Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack

bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Bookstackapp
Products
Bookstack
CVE-2021-3767

Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack

bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Bookstackapp
Products
Bookstack
CVE-2021-3766

Prototype Pollution in vincit/objection.js

objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed
Vendors
Objection Project
Products
Objection
CVE-2021-3764

kernel: DoS in ccp_run_aes_gcm_cmd() function

A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2021-3763

7: Incorrect privilege in Management Console

A flaw was found in the Red Hat AMQ Broker management console in version 7.8 where an existing user is able to access some limited information even when the role the user is assigned to should not be allow access to the management console. The main impact is to confidentiality as this flaw means some role bindings are incorrectly checked, some privileged meta information such as queue names and configuration details are disclosed but the impact is limited as not all information is accessible and there is no affect to integrity.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Amq Broker
CVE-2021-3762

quay/claircore: directory traversal when scanning crafted container image layer allows for arbitrary file write

A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 4.8% KEV · Not listed
Vendors
Redhat
Products
Clair Quay
CVE-2021-3761

OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values

Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) prior to launching a BGP hijack which during normal operations would be rejected as "RPKI invalid". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Cloudflare Debian
Products
Octorpki Debian Linux
CVE-2021-3760

kernel: nfc: Use-After-Free vulnerability of ndev->rf_conn_info object

A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat to confidentiality, integrity, and system availability.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 16 more
CVE-2021-3758

Server-Side Request Forgery (SSRF) in bookstackapp/bookstack

bookstack is vulnerable to Server-Side Request Forgery (SSRF)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Bookstackapp
Products
Bookstack
CVE-2021-3757

Prototype Pollution in immerjs/immer

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CVSS 3.1 · 9.8 Critical EPSS 1.7% KEV · Not listed
Vendors
Immer Project Redhat
Products
Immer Rhmt