2021-07-28

CVE-2021-23417 Jul 28, 16:15 CRITICAL POC Act Now

All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-23415 Jul 28, 16:15 HIGH POC PATCH This Week

This affects the package elFinder.AspNet before 1.1.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2021-32000 Jul 28, 10:15 HIGH POC This Week

A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterprise Server 12 SP3, SUSE Linux Enterprise Server 15 SP1;. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-23416 Jul 28, 16:15 MEDIUM POC This Month

This affects all versions of package curly-bracket-parser. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-23414 Jul 28, 08:15 MEDIUM POC PATCH This Month

This affects the package video.js before 7.14.3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2021-32001 Jul 28, 10:15 MEDIUM This Month

K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority private. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.