Security Vulnerabilities - CVEs Published In 2021
matio (aka MAT File I/O Library) 1.5.18 through 1.5.21 has a heap-based buffer overflow in ReadInt32DataDouble (called from ReadInt32Data and Mat_VarRead4).
CVSS Score
8.8
EPSS Score
0.014
Published
2021-07-20
Variant_encodeJson in open62541 1.x before 1.0.4 has an out-of-bounds write for a large recursion depth.
CVSS Score
5.5
EPSS Score
0.003
Published
2021-07-20
libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.
CVSS Score
7.8
EPSS Score
0.011
Published
2021-07-20
Unicorn Engine 1.0.2 has an out-of-bounds write in helper_wfe_arm.
CVSS Score
5.5
EPSS Score
0.003
Published
2021-07-20
Minecraft before 1.17.1, when online-mode=false is configured, allows path traversal for deletion of arbitrary JSON files.
CVSS Score
7.5
EPSS Score
0.014
Published
2021-07-20
libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).
CVSS Score
6.5
EPSS Score
0.028
Published
2021-07-20
matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry), related to use of HDF5 1.12.0.
CVSS Score
6.5
EPSS Score
0.015
Published
2021-07-20
The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a stored cross site scripting vulnerability.
CVSS Score
5.4
EPSS Score
0.01
Published
2021-07-20
Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability.
CVSS Score
5.4
EPSS Score
0.006
Published
2021-07-20
REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to enumerate usernames via a Sensitive Data Exposure vulnerability in the `/rest/api/latest/user/avatar/temporary` endpoint.
CVSS Score
5.3
EPSS Score
0.013
Published
2021-07-20