Vulnerabilities > Debian > Debian Linux > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-11-15 | CVE-2021-22959 | HTTP Request Smuggling vulnerability in multiple products The parser in accepts requests with a space (SP) right after the header name before the colon. | 6.5 |
| 2021-11-12 | CVE-2021-41229 | Memory Leak vulnerability in multiple products BlueZ is a Bluetooth protocol stack for Linux. | 6.5 |
| 2021-11-12 | CVE-2021-43331 | Cross-site Scripting vulnerability in multiple products In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS. | 6.1 |
| 2021-11-12 | CVE-2021-43332 | Insufficiently Protected Credentials vulnerability in multiple products In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. | 6.5 |
| 2021-11-11 | CVE-2021-3911 | Unchecked Return Value vulnerability in multiple products If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash. | 6.5 |
| 2021-11-11 | CVE-2021-3912 | Allocation of Resources Without Limits or Throttling vulnerability in multiple products OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repository that makes OctoRPKI run out of memory (and thus crash). | 6.5 |
| 2021-11-04 | CVE-2021-43389 | Out-of-bounds Read vulnerability in multiple products An issue was discovered in the Linux kernel before 5.14.15. | 5.5 |
| 2021-11-03 | CVE-2021-22960 | HTTP Request Smuggling vulnerability in multiple products The parse function in llhttp < 2.1.4 and < 6.0.6. | 6.5 |
| 2021-11-03 | CVE-2021-40985 | Out-of-bounds Read vulnerability in multiple products A stack-based buffer under-read in htmldoc before 1.9.12, allows attackers to cause a denial of service via a crafted BMP image to image_load_bmp. | 5.5 |
| 2021-11-03 | CVE-2021-38502 | Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. | 5.9 |