--- title: Security Advisories | The Missing Link UK description: Our security analysts practise responsible disclosure and report the zero-day vulnerabilities they discover. --- Our security analysts practise responsible disclosure and report the zero-day vulnerabilities they discover. Below is a list that they have permission to publish. Due to security risks associated not all zero-days are published and accredited.   [CVE-2021-41750 Reflected cross-site scripting in CraftCMS SEOmatic plugin by Nystudio 107 ](https://www.themissinglink.co.uk/security-advisories/cve-2021-41750?hsLang=en) Jack Misiura [CVE-2021-44618 Server-side Template Injection in CraftCMS SEOmatic plugin by Nystudio107 ](https://www.themissinglink.co.uk/security-advisories/cve-2021-44618?hsLang=en) Jack Misiura [CVE-2021-41971 Cross-site scripting filter evasion in Alfresco Content Services ](https://www.themissinglink.co.uk/security-advisories/cve-2021-41971?hsLang=en) Jack Misiura and Stefano Lanaro [CVE-2021-41790 Broken access controls in Alfresco Content Services ](https://www.themissinglink.co.uk/security-advisories/cve-2021-41790?hsLang=en) Jack Misiura and Stefano Lanaro [CVE-2021-28316 FDE bypass and EoP on domain joined Windows workstations | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2021-28316?hsLang=en) Matthew Johnson [CVE-2020-28001 Stored cross-site scripting in Serv-U File Server by SolarWinds | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2020-28001?hsLang=en) Jack Misiura [CVE-2020-27994 Path traversal in Serv-U File Server by SolarWinds | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2020-27994?hsLang=en) Jack Misiura [CVE-2020-28861 Missing access controls in OpenAsset Digital Asset Management by OpenAsset | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2020-28861?hsLang=en) Jack Misiura [CVE-2020-28860 Authenticated blind SQL injection in OpenAsset Digital Asset Management by OpenAsset | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2020-28860?hsLang=en) Jack Misiura [CVE-2020-28859 Reflected cross-site scripting in OpenAsset Digital Asset Management by OpenAsset | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2020-28859?hsLang=en) Jack Misiura [CVE-2020-28858 Cross-site request forgery in OpenAsset Digital Asset Management by OpenAsset | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2020-28858?hsLang=en) Jack Misiura [CVE-2020-28857 Stored cross-site scripting in OpenAsset Digital Asset Management by OpenAsset | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2020-28857?hsLang=en) Jack Misiura [CVE-2020-28856 IP access control bypass in OpenAsset Digital Asset Management by OpenAsset | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2020-28856?hsLang=en) Jack Misiura [CVE-2020-29304 Self-reflected cross-site scripting in DirectoriesPro by SabaiApps | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2020-29304?hsLang=en) Jack Misiura [CVE-2020-29303 Reflected cross-site scripting in DirectoriesPro by SabaiApps | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2020-29303?hsLang=en) Jack Misiura [CVE-2020-11497 Payment system bypass in NAB Transact WooCommerce Plugin by Tyson Armstrong | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2020-11497?hsLang=en) Jack Misiura [CVE-2020-11727 Reflected cross-site scripting in Advanced Order Export for WooCommerce by AlgolPlus | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2020-11727?hsLang=en) Jack Misiura [CVE-2019-13181 CSV injection vulnerability in SolarWinds Serv-U | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2019-13181?hsLang=en) Richard Tan [CVE-2019-13182 Stored cross-site scripting in SolarWinds Serv-U | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2019-13182?hsLang=en) Richard Tan [CVE-2019-0972 Local Security Authority Subsystem Service (LSASS) Remote Denial of Service | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2019-0972?hsLang=en) Danyal Drew and Elad Shamir [ Linux Privilege Escalation via LXD | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-linux-privilege-escalation-via-lxd?hsLang=en) Chris Moberly [CVE-2018-19999 Local Privilege Escalation via Serv-U FTP Server | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2018-19999?hsLang=en) Chris Moberly [CVE-2019-7304 Local privilege escalation in Ubuntu Linux and derivatives | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2019-7304?hsLang=en) Chris Moberly [CVE-2018-7669 Sitecore Directory Traversal Vulnerability | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2018-7669?hsLang=en) Chris Moberly [CVE-2018-13415 Out-of-Band XXE in SSDP Processing of Plex Media Server | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2018-13415?hsLang=en) Chris Moberly [CVE-2018-13416 Out-of-Band XXE in SSDP Processing of Universal Media Server | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2018-13416?hsLang=en) Chris Moberly [CVE-2018-13417 Out-of-Band XXE in SSDP Processing of Vuze Bitorrent Client | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2018-13417?hsLang=en) Chris Moberly [CVE-2018-19934 Reflected XSS in SolarWinds Serv-U FTP Server | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2018-19934?hsLang=en) Chris Moberly [CVE-2018-15906 Application Privilege Escalation in SolarWinds Serv-U | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2018-15906?hsLang=en) Chris Moberly [CVE-2018-11002 Pulse Secure Desktop Client (Windows) 5.3 Elevation of Privilege Vulnerability | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2018-11002?hsLang=en) Matt Bush [CVE-2017-16878 Reflected cross-site scripting in PAN-OS Captive Portal | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2017-16878?hsLang=en) Shaun Wheelhouse [CVE-2016-4573 FortiSwitch rest_admin account exposed under certain conditions | The Missing Link ](https://www.themissinglink.co.uk/security-advisories/cve-2016-4573?hsLang=en) Emma Ferguson [ How to build a cyber security plan: A guide for SMEs ](https://www.themissinglink.co.uk/news/how-to-build-a-cyber-security-plan?hsLang=en) [ Cyber Essentials Decoded: Firewalls and User Access Control ](https://www.themissinglink.co.uk/news/cyber-essentials-decoded-firewalls-and-user-access?hsLang=en) [ Cyber Essentials Decoded: Malware Protection ](https://www.themissinglink.co.uk/news/cyber-essentials-decoded-malware-protection?hsLang=en) [ See All News ](https://www.themissinglink.co.uk/news?hsLang=en) ![](https://www.themissinglink.co.uk/hubfs/TML-Infy-Core-Logo-RGB-Org%20-%20Edited.png) **Follow us on** - [** ** ](https://www.instagram.com/themissinglink.it/) - [** ** ](https://www.linkedin.com/company/the-missing-link-pty-ltd/) - [** ** ](https://www.youtube.com/channel/UC2kd4mDmBs3SjW4lX3fFHnQ) - More - [Contact Us ​](https://www.themissinglink.co.uk/contact-us?hsLang=en) - [Careers](https://www.themissinglink.co.uk/careers?hsLang=en) - Legal - [Terms & Conditions​](https://www.themissinglink.co.uk/terms-and-conditions?hsLang=en) - [Fair Use Policy](https://www.themissinglink.co.uk/fair-use-policy?hsLang=en) - [Terms of Use](https://www.themissinglink.co.uk/terms-of-use?hsLang=en) - [Privacy Policy](https://www.themissinglink.co.uk/privacy-policy?hsLang=en) - [Acceptable Usage Policy](https://www.themissinglink.co.uk/acceptable-usage-policy?hsLang=en) - [Cookie Policy](https://www.themissinglink.co.uk/cookie-policy?hsLang=en) - [Vulnerability Disclosure Policy](https://www.themissinglink.co.uk/vulnerability-disclosure-policy?hsLang=en)