CVE-2021-23344

Remote Code Execution (RCE)

The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.

CVSS 3.1 · 9.8 Critical EPSS 4.9% KEV · Not listed

Vendors

Totaljs

Products

Total.js

CVE-2021-23343

Regular Expression Denial of Service (ReDoS)

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

CVSS 3.1 · 5.3 Medium EPSS 2.2% KEV · Not listed

Vendors

Path-parse Project Redhat

Products

Path-parse Acm Advanced Cluster Security and 4 more

CVE-2021-23342

Cross-site Scripting (XSS)

This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTML code on the main page is sanitized, but this sanitization is not taking place in the sidebar. 2) The isURL external check can be bypassed by inserting more “////” characters

CVSS 3.1 · 8.6 High EPSS 1.7% KEV · Not listed

Vendors

Docsifyjs

Products

Docsify

CVE-2021-23341

Regular Expression Denial of Service (ReDoS)

The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed

Vendors

Prismjs

Products

Prism

CVE-2021-23340

Local File Inclusion

This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability.

CVSS 3.1 · 7.1 High EPSS 1.3% KEV · Not listed

Vendors

Pimcore

Products

Pimcore

CVE-2021-23339

HTTP Request Smuggling

This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Lightbend

Products

Akka-http

CVE-2021-23338

Deserialization of Untrusted Data

This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function.

CVSS 3.1 · 6.6 Medium EPSS 3.9% KEV · Not listed

Vendors

Microsoft

Products

Qlib

CVE-2021-23335

LDAP Injection

All versions of package is-user-valid are vulnerable to LDAP Injection which can lead to either authentication bypass or information exposure.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Is-user-valid Project

Products

Is-user-valid

CVE-2021-23331

Insecure Temporary File

This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded by downloadFileFromResponse will be visible to all other users on the local system. A workaround fix for this issue is to set the system property java.io.tmpdir to a safe directory as remediation. Note: This version of the SDK is end of life and no longer maintained, please upgrade to the latest version.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Squareup

Products

Connect Java Software Development Kit

CVE-2021-23330

Command Injection

All versions of package launchpad are vulnerable to Command Injection via stop.

CVSS 3.1 · 9.8 Critical EPSS 5.3% KEV · Not listed

Vendors

Bitovi

Products

Launchpad

CVE-2021-23329

Prototype Pollution

The package nested-object-assign before 1.0.4 are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Getadigital

Products

Nested-object-assign

CVE-2021-23328

Prototype Pollution

This affects all versions of package iniparserjs. This vulnerability relates when ini_parser.js is concentrating arrays. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Iniparserjs Project

Products

Iniparserjs

CVE-2021-23327

Cross-site Scripting (XSS)

The package apexcharts before 3.24.0 are vulnerable to Cross-site Scripting (XSS) via lack of sanitization of graph legend fields.

CVSS 3.1 · 6.3 Medium EPSS 1.4% KEV · Not listed

Vendors

Fusioncharts

Products

Apexcharts

CVE-2021-23326

Command Injection

This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection.

CVSS 3.1 · 6.3 Medium EPSS 2.8% KEV · Not listed

Vendors

The-guild

Products

Graphql-tools

CVE-2021-23288

Security issues in Intelligent Power Protector

The vulnerability exists due to insufficient validation of input from certain resources by the IPP software. The attacker would need access to the local Subnet and an administrator interaction to compromise the system. This issue affects: Intelligent Power Protector versions prior to 1.69.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Eaton

Products

Intelligent Power Protector

CVE-2021-23287

Security issues in Intelligent Power Manager (IPM 1)

The vulnerability exists due to insufficient validation of input of certain resources within the IPM software. This issue affects: Intelligent Power Manager (IPM 1) versions prior to 1.70.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Eaton

Products

Intelligent Power Manager

CVE-2021-23286

Security issues in Eaton Intelligent Power Manager Infrastructure

Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to CSV Formula Injection. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) all version 1.5.0plus205 and prior versions.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Eaton

Products

Intelligent Power Manager

CVE-2021-23285

Security issues in Eaton Intelligent Power Manager Infrastructure

Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to reflected Cross-site Scripting vulnerability. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) all version 1.5.0plus205 and prior versions.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Eaton

Products

Intelligent Power Manager

CVE-2021-23284

Security issues in Eaton Intelligent Power Manager Infrastructure

Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to Stored Cross-site Scripting vulnerability. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) all version 1.5.0plus205 and prior versions.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Eaton

Products

Intelligent Power Manager Infrastructure

CVE-2021-23283

Security issues in Eaton Intelligent Power Protector (IPP)

Eaton Intelligent Power Protector (IPP) prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient validation of user input and improper encoding of the output for certain resources within the IPP software.

CVSS 3.1 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Eaton

Products

Intelligent Power Protector