Security Vulnerabilities - CVEs Published In 2021
Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are affected. This affects users who open a crafted link or third-party web page.
CVSS Score
5.4
EPSS Score
0.766
Published
2021-07-30
Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter. This affects users who open a crafted link or third-party web page.
CVSS Score
5.4
EPSS Score
0.132
Published
2021-07-30
Adobe InDesign version 16.0 (and earlier) is affected by an Out-of-bounds Write vulnerability in the CoolType library. An unauthenticated attacker could leverage this vulnerability to achieve remote code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score
8.8
EPSS Score
0.022
Published
2021-07-30
OX Documents before 7.10.5-rev5 has Incorrect Access Control of converted images because hash collisions can occur, due to use of Adler32.
CVSS Score
6.5
EPSS Score
0.011
Published
2021-07-30
OX Documents before 7.10.5-rev7 has Incorrect Access Control for converted documents because hash collisions can occur, due to use of CRC32.
CVSS Score
6.5
EPSS Score
0.011
Published
2021-07-30
OX Documents before 7.10.5-rev5 has Incorrect Access Control for documents that contain XML structures because hash collisions can occur, due to use of CRC32.
CVSS Score
4.8
EPSS Score
0.009
Published
2021-07-30
The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the attacker's perimeter) via an account with write permissions. This occurs because node IDs are predictable (with incrementing numbers) and the access control on Services/NodeManagement.asmx/DeleteObjNow is incorrect. To exploit this, an attacker must be authenticated and must have node management rights associated with at least one valid group on the platform.
CVSS Score
5.4
EPSS Score
0.009
Published
2021-07-30
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
CVSS Score
7.5
EPSS Score
0.58
Published
2021-07-30
The unofficial vscode-phpmd (aka PHP Mess Detector) extension before 1.3.0 for Visual Studio Code allows remote attackers to execute arbitrary code via a crafted phpmd.command value in a workspace folder.
CVSS Score
9.8
EPSS Score
0.03
Published
2021-07-30
isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.
CVSS Score
5.3
EPSS Score
0.022
Published
2021-07-30