Security Vulnerabilities - CVEs Published In 2021
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a gallery do not contain malicious content. As a result, users allowed to add images to gallery can upload an SVG file containing JavaScript code, which will be executed when accessing the image directly (ie in the /wp-content/uploads/photo-gallery/ folder), leading to a Cross-Site Scripting (XSS) issue
CVSS Score
6.1
EPSS Score
0.008
Published
2021-08-16
This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is processed. When an arbitrary OS command is executed, the command output would be included in the HTML output.
CVSS Score
7.8
EPSS Score
0.008
Published
2021-08-16
This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing include, include-code or include-raw block is processed. The contents of arbitrary files could be disclosed in the HTML output.
CVSS Score
5.5
EPSS Score
0.011
Published
2021-08-16
A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.
CVSS Score
7.5
EPSS Score
0.462
Published
2021-08-16
If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.
CVSS Score
5.3
EPSS Score
0.054
Published
2021-08-16
D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to unauthorized configuration modification. An unauthenticated attacker on the local network may exploit this, with CVE-2021-3708, to execute any OS commands on the vulnerable device.
CVSS Score
5.5
EPSS Score
0.015
Published
2021-08-16
D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to OS command injection. An unauthenticated attacker on the local network may exploit this, with CVE-2021-3707, to execute any OS commands on the vulnerable device.
CVSS Score
7.8
EPSS Score
0.246
Published
2021-08-16
In gitit before 0.15.0.0, the Export feature can be exploited to leak information from files.
CVSS Score
7.5
EPSS Score
0.012
Published
2021-08-16
OneNav 0.9.12 allows Information Disclosure of the onenav.db3 contents. NOTE: the vendor's recommended solution is to block the access via an NGINX configuration file.
CVSS Score
7.5
EPSS Score
0.011
Published
2021-08-16
imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header.
CVSS Score
5.4
EPSS Score
0.005
Published
2021-08-16