Security Vulnerabilities - CVEs Published In 2021
An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is missing zeroization of plaintext buffers in mbedtls_ssl_read to erase unused application data from memory.
CVSS Score
7.5
EPSS Score
0.016
Published
2021-08-23
An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.
CVSS Score
7.5
EPSS Score
0.015
Published
2021-08-23
Canon Oce Print Exec Workgroup 1.3.2 allows Host header injection.
CVSS Score
5.3
EPSS Score
0.008
Published
2021-08-23
Canon Oce Print Exec Workgroup 1.3.2 allows XSS via the lang parameter.
CVSS Score
6.1
EPSS Score
0.007
Published
2021-08-23
In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
CVSS Score
5.9
EPSS Score
0.009
Published
2021-08-22
An XSS issue was discovered in ReCaptcha Solver 5.7. A response from Anti-Captcha.com, RuCaptcha.com, 2captcha.com, DEATHbyCAPTCHA.com, ImageTyperz.com, or BestCaptchaSolver.com in setCaptchaCode() is inserted into the DOM as HTML, resulting in full control over the user's browser by these servers.
CVSS Score
6.1
EPSS Score
0.006
Published
2021-08-22
In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
CVSS Score
5.9
EPSS Score
0.007
Published
2021-08-22
In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
CVSS Score
5.9
EPSS Score
0.011
Published
2021-08-22
In GNOME libzapojit through 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
CVSS Score
5.9
EPSS Score
0.007
Published
2021-08-22
In GNOME evolution-rss through 0.3.96, network-soup.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
CVSS Score
5.9
EPSS Score
0.006
Published
2021-08-22