Security Vulnerabilities - CVEs Published In 2021
A vulnerability in the \inc\config.php component of joyplus-cms v1.6 allows attackers to access sensitive information.
CVSS Score
7.5
EPSS Score
0.01
Published
2021-08-18
Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.
CVSS Score
7.5
EPSS Score
0.015
Published
2021-08-18
liveMedia/FramedSource.cpp in Live555 through 1.08 allows an assertion failure and application exit via multiple SETUP and PLAY commands.
CVSS Score
5.5
EPSS Score
0.009
Published
2021-08-18
All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.
CVSS Score
5.3
EPSS Score
0.019
Published
2021-08-18
Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl (velocity) files.
CVSS Score
8.8
EPSS Score
0.02
Published
2021-08-18
Path Traversal vulneraility exists in webTareas 2.0 via the extpath parameter in general_serv.php, which could let a malicious user read arbitrary files.
CVSS Score
6.5
EPSS Score
0.016
Published
2021-08-18
Cross Site Scripting (XSS) vulnerability exists in Eyoucms v1.4.7 and earlier via the addonfieldext parameter.
CVSS Score
6.1
EPSS Score
0.015
Published
2021-08-18
This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.
CVSS Score
7.5
EPSS Score
0.018
Published
2021-08-18
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.3.0, the Nextcloud Desktop client fails to check if a private key belongs to previously downloaded public certificate. If the Nextcloud instance serves a malicious public key, the data would be encrypted for this key and thus could be accessible to a malicious actor. This issue is fixed in Nextcloud Desktop Client version 3.3.0. There are no known workarounds aside from upgrading.
CVSS Score
6.5
EPSS Score
0.009
Published
2021-08-18
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.
CVSS Score
7.5
EPSS Score
0.067
Published
2021-08-18