Security Vulnerabilities - CVEs Published In 2021
Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path.
CVSS Score
7.5
EPSS Score
0.008
Published
2021-12-02
bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score
3.1
EPSS Score
0.001
Published
2021-12-02
An issue was discovered in the eGeeTouch 3rd Generation Travel Padlock application for Android. The lock sends a pairing code before each operation (lock or unlock) activated via the companion app. The code is sent unencrypted, allowing any attacker with the same app (either Android or iOS) to add the lock and take complete control. For successful exploitation, the attacker must be able to touch the lock's power button, and must be able to capture BLE network communication.
CVSS Score
6.8
EPSS Score
0.001
Published
2021-12-02
Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE).
CVSS Score
4.2
EPSS Score
0.003
Published
2021-12-02
Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotely(RCE).
CVSS Score
4.2
EPSS Score
0.004
Published
2021-12-02
Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.
CVSS Score
6.5
EPSS Score
0.008
Published
2021-12-02
Authenticated administrators may override the system configuration file and cause a denial of service.
CVSS Score
4.5
EPSS Score
0.004
Published
2021-12-02
Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE.
CVSS Score
4.2
EPSS Score
0.005
Published
2021-12-02
Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).
CVSS Score
5.9
EPSS Score
0.009
Published
2021-12-02
Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.
CVSS Score
8.1
EPSS Score
0.011
Published
2021-12-02