2021 CVEs (page 103)
Page 103 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-3454 | Medium | 4.3 | 2021-10-19 | Truncated L2CAP K-frame causes assertion failure. Zephyr versions >= 2.4.0, >= v.2.50 contain Improper Handling of Length Parameter Inconsistency (CWE-130), Re… |
CVE-2021-41150 | High | 8.2 | 2021-10-19 | Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not… |
CVE-2021-31386 | Medium | 5.3 | 2021-10-19 | A Protection Mechanism Failure vulnerability in the J-Web HTTP service of Juniper Networks Junos OS allows a remote unauthenticated attacker to perform Person-… |
CVE-2021-31385 | High | 8.8 | 2021-10-19 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in J-Web of Juniper Networks Junos OS allows any low-privileged… |
CVE-2021-31384 | High | 7.2 | 2021-10-19 | Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Ne… |
CVE-2021-31383 | High | 7.5 | 2021-10-19 | In Point to MultiPoint (P2MP) scenarios within established sessions between network or adjacent neighbors the improper use of a source to destination copy writ… |
CVE-2021-31382 | Medium | 6.5 | 2021-10-19 | On PTX1000 System, PTX10002-60C System, after upgrading to an affected release, a Race Condition vulnerability between the chassis daemon (chassisd) and firewa… |
CVE-2021-31381 | Medium | 6.5 | 2021-10-19 | A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted… |
CVE-2021-31380 | Medium | 5.3 | 2021-10-19 | A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted… |
CVE-2021-31379 | High | 7.5 | 2021-10-19 | An Incorrect Behavior Order vulnerability in the MAP-E automatic tunneling mechanism of Juniper Networks Junos OS allows an attacker to send certain malformed… |
CVE-2021-31378 | Medium | 6.8 | 2021-10-19 | In broadband environments, including but not limited to Enhanced Subscriber Management, (CHAP, PPP, DHCP, etc.), on Juniper Networks Junos OS devices where RAD… |
CVE-2021-31377 | Medium | 5.5 | 2021-10-19 | An Incorrect Permission Assignment for Critical Resource vulnerability of a certain file in the filesystem of Junos OS allows a local authenticated attacker to… |
CVE-2021-31376 | High | 7.5 | 2021-10-19 | An Improper Input Validation vulnerability in Packet Forwarding Engine manager (FXPC) process of Juniper Networks Junos OS allows an attacker to cause a Denial… |
CVE-2021-31375 | High | 7.2 | 2021-10-19 | An Improper Input Validation vulnerability in routing process daemon (RPD) of Juniper Networks Junos OS devices configured with BGP origin validation using Res… |
CVE-2021-31374 | High | 7.5 | 2021-10-19 | On Juniper Networks Junos OS and Junos OS Evolved devices processing a specially crafted BGP UPDATE or KEEPALIVE message can lead to a routing process daemon (… |
CVE-2021-31373 | High | 8.0 | 2021-10-19 | A persistent Cross-Site Scripting (XSS) vulnerability in Juniper Networks Junos OS on SRX Series, J-Web interface may allow a remote authenticated user to inje… |
CVE-2021-31372 | High | 8.8 | 2021-10-19 | An Improper Input Validation vulnerability in J-Web of Juniper Networks Junos OS allows a locally authenticated J-Web attacker to escalate their privileges to… |
CVE-2021-31371 | Medium | 5.3 | 2021-10-19 | Juniper Networks Junos OS uses the 128.0.0.0/2 subnet for internal communications between the RE and PFEs. It was discovered that packets utilizing these IP ad… |
CVE-2021-31370 | Medium | 6.5 | 2021-10-19 | An Incomplete List of Disallowed Inputs vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on QFX5000 Series and EX4600 Series allows… |
CVE-2021-31369 | Medium | 5.3 | 2021-10-19 | On MX Series platforms with MS-MPC/MS-MIC, an Allocation of Resources Without Limits or Throttling vulnerability in Juniper Networks Junos OS allows an unauthe… |
CVE-2021-31368 | High | 7.5 | 2021-10-19 | An Uncontrolled Resource Consumption vulnerability in the kernel of Juniper Networks JUNOS OS allows an unauthenticated network based attacker to cause 100% CP… |
CVE-2021-31367 | Medium | 6.5 | 2021-10-19 | A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on PTX Series allows an a… |
CVE-2021-31366 | Medium | 6.5 | 2021-10-19 | An Unchecked Return Value vulnerability in the authd (authentication daemon) of Juniper Networks Junos OS on MX Series configured for subscriber management / B… |
CVE-2021-31365 | Medium | 6.5 | 2021-10-19 | An Uncontrolled Resource Consumption vulnerability in Juniper Networks Junos OS on EX2300, EX3400 and EX4300 Series platforms allows an adjacent attacker sendi… |
CVE-2021-31364 | Medium | 5.9 | 2021-10-19 | An Improper Check for Unusual or Exceptional Conditions vulnerability combined with a Race Condition in the flow daemon (flowd) of Juniper Networks Junos OS on… |
CVE-2021-31363 | Medium | 6.5 | 2021-10-19 | In an MPLS P2MP environment a Loop with Unreachable Exit Condition vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS… |
CVE-2021-31362 | Medium | 6.5 | 2021-10-19 | A Protection Mechanism Failure vulnerability in RPD (routing protocol daemon) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthentica… |
CVE-2021-31361 | Medium | 5.3 | 2021-10-19 | An Improper Check for Unusual or Exceptional Conditions vulnerability combined with Improper Handling of Exceptional Conditions in Juniper Networks Junos OS on… |
CVE-2021-31360 | High | 7.1 | 2021-10-19 | An improper privilege management vulnerability in the Juniper Networks Junos OS and Junos OS Evolved command-line interpreter (CLI) allows a low-privileged use… |
CVE-2021-31359 | High | 7.8 | 2021-10-19 | A local privilege escalation vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged user to cause the Juniper DHCP daem… |
CVE-2021-31358 | High | 7.8 | 2021-10-19 | A command injection vulnerability in sftp command processing on Juniper Networks Junos OS Evolved allows an attacker with authenticated CLI access to be able t… |
CVE-2021-31357 | High | 7.8 | 2021-10-19 | A command injection vulnerability in tcpdump command processing on Juniper Networks Junos OS Evolved allows an attacker with authenticated CLI access to be abl… |
CVE-2021-31356 | High | 7.8 | 2021-10-19 | A command injection vulnerability in command processing on Juniper Networks Junos OS Evolved allows an attacker with authenticated CLI access to be able to byp… |
CVE-2021-31355 | High | 8.0 | 2021-10-19 | A persistent cross-site scripting (XSS) vulnerability in the captive portal graphical user interface of Juniper Networks Junos OS may allow a remote authentica… |
CVE-2021-31354 | High | 7.1 | 2021-10-19 | An Out Of Bounds (OOB) access vulnerability in the handling of responses by a Juniper Agile License (JAL) Client in Juniper Networks Junos OS and Junos OS Evol… |
CVE-2021-31353 | High | 7.5 | 2021-10-19 | An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an attacker to inject a specific BGP upda… |
CVE-2021-31352 | Medium | 5.3 | 2021-10-19 | An Information Exposure vulnerability in Juniper Networks SRC Series devices configured for NETCONF over SSH permits the negotiation of weak ciphers, which cou… |
CVE-2021-31351 | High | 7.5 | 2021-10-19 | An Improper Check for Unusual or Exceptional Conditions in packet processing on the MS-MPC/MS-MIC utilized by Juniper Networks Junos OS allows a malicious atta… |
CVE-2021-31350 | High | 7.5 | 2021-10-19 | An Improper Privilege Management vulnerability in the gRPC framework, used by the Juniper Extension Toolkit (JET) API on Juniper Networks Junos OS and Junos OS… |
CVE-2021-31349 | Critical | 9.8 | 2021-10-19 | The usage of an internal HTTP header created an authentication bypass vulnerability (CWE-287), allowing an attacker to view internal files, change settings, ma… |
CVE-2021-0299 | High | 7.5 | 2021-10-19 | An Improper Handling of Exceptional Conditions vulnerability in the processing of a transit or directly received malformed IPv6 packet in Juniper Networks Juno… |
CVE-2021-0298 | Medium | 4.7 | 2021-10-19 | A Race Condition in the 'show chassis pic' command in Juniper Networks Junos OS Evolved may allow an attacker to crash the port interface concentrator daemon (… |
CVE-2021-0297 | Medium | 6.5 | 2021-10-19 | A vulnerability in the processing of TCP MD5 authentication in Juniper Networks Junos OS Evolved may allow a BGP or LDP session configured with MD5 authenticat… |
CVE-2021-0296 | High | 7.4 | 2021-10-19 | The Juniper Networks CTPView server is not enforcing HTTP Strict Transport Security (HSTS). HSTS is an optional response header which allows servers to indicat… |
CVE-2021-41149 | High | 8.2 | 2021-10-19 | Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not… |
CVE-2021-41140 | Medium | 5.3 | 2021-10-19 | Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to… |
CVE-2021-41131 | High | 7.5 | 2021-10-19 | python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vul… |
CVE-2021-35323 | Medium | 6.1 | 2021-10-19 | Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login. |
CVE-2021-32664 | High | 8.1 | 2021-10-19 | Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as admin… |
CVE-2021-32663 | High | 8.7 | 2021-10-19 | iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific… |
CVE-2021-33988 | Medium | 6.1 | 2021-10-19 | Cross Site Scripting (XSS). vulnerability exists in Microweber CMS 1.2.7 via the Login form, which could let a malicious user execute Javascript by Inserting c… |
CVE-2021-38911 | Medium | 4.9 | 2021-10-19 | IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by a an authenticatedl privileged user. IBM X-Force ID… |
CVE-2021-29912 | Medium | 5.4 | 2021-10-19 | IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2021-3746 | Medium | 6.5 | 2021-10-19 | A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 co… |
CVE-2021-39355 | Medium | 5.5 | 2021-10-19 | The Indeed Job Importer WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several paramet… |
CVE-2021-39343 | Medium | 5.5 | 2021-10-19 | The MPL-Publisher WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters fo… |
CVE-2021-39329 | Medium | 5.5 | 2021-10-19 | The JobBoardWP WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found… |
CVE-2021-37137 | High | 7.5 | 2021-10-19 | The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable… |
CVE-2021-37136 | High | 7.5 | 2021-10-19 | The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during… |
CVE-2021-36832 | Medium | 4.8 | 2021-10-19 | WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input. |
CVE-2021-27001 | Medium | 5.5 | 2021-10-19 | Clustered Data ONTAP versions 9.x prior to 9.5P18, 9.6P16, 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which could allow an authenticated priv… |
CVE-2021-26589 | Medium | 6.1 | 2021-10-19 | A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripti… |
CVE-2021-30850 | Medium | 5.5 | 2021-10-19 | An access issue was addressed with improved access restrictions. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6, tvOS 15. A user… |
CVE-2021-30849 | High | 7.8 | 2021-10-19 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, watchOS 8, Safari 15, tvOS 15… |
CVE-2021-30848 | High | 7.8 | 2021-10-19 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, Safari 15, iOS 15 and iPadOS 15. Proces… |
CVE-2021-30847 | High | 7.8 | 2021-10-19 | This issue was addressed with improved checks. This issue is fixed in watchOS 8, macOS Big Sur 11.6, Security Update 2021-005 Catalina, tvOS 15, iOS 15 and iPa… |
CVE-2021-30846 | High | 7.8 | 2021-10-19 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, Safari 15, tvOS 15, iOS 15 and iPadOS 1… |
CVE-2021-30845 | Medium | 5.5 | 2021-10-19 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.6. A local user may be able to read kernel memory. |
CVE-2021-30844 | High | 7.5 | 2021-10-19 | A logic issue was addressed with improved state management. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6. A remote attacker may… |
CVE-2021-30843 | High | 7.8 | 2021-10-19 | This issue was addressed with improved checks. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, Security Update 2021-005 Catalina, tvOS 15… |
CVE-2021-30842 | High | 7.8 | 2021-10-19 | This issue was addressed with improved checks. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, Security Update 2021-005 Catalina, tvOS 15… |
CVE-2021-30841 | High | 7.8 | 2021-10-19 | This issue was addressed with improved checks. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, Security Update 2021-005 Catalina, tvOS 15… |
CVE-2021-30838 | High | 7.8 | 2021-10-19 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15 and iPadOS 15. A malicious application may be able to exec… |
CVE-2021-30837 | High | 7.8 | 2021-10-19 | A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 15 and iPadOS 15, watchOS 8, tvOS 15. An application may be… |
CVE-2021-30835 | High | 7.8 | 2021-10-19 | This issue was addressed with improved checks. This issue is fixed in Security Update 2021-005 Catalina, iTunes 12.12 for Windows, tvOS 15, iOS 15 and iPadOS 1… |
CVE-2021-30832 | High | 7.8 | 2021-10-19 | A memory corruption issue was addressed with improved state management. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6. A local a… |
CVE-2021-30830 | High | 7.8 | 2021-10-19 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6. A maliciou… |
CVE-2021-30829 | High | 7.8 | 2021-10-19 | A URI parsing issue was addressed with improved parsing. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6. A local user may be able… |
CVE-2021-30828 | Medium | 5.5 | 2021-10-19 | This issue was addressed with improved checks. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6. A local user may be able to read a… |
CVE-2021-30827 | High | 7.8 | 2021-10-19 | A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in Security Update 2021-005 Catalina, macOS Big… |
CVE-2021-30826 | High | 7.5 | 2021-10-19 | A logic issue was addressed with improved state management. This issue is fixed in iOS 15 and iPadOS 15. In certain situations, the baseband would fail to enab… |
CVE-2021-30825 | High | 7.8 | 2021-10-19 | This issue was addressed with improved checks. This issue is fixed in iOS 15 and iPadOS 15. A local attacker may be able to cause unexpected application termin… |
CVE-2021-30820 | Critical | 9.8 | 2021-10-19 | A logic issue was addressed with improved state management. This issue is fixed in iOS 14.8 and iPadOS 14.8. A remote attacker may be able to cause arbitrary c… |
CVE-2021-30819 | Medium | 5.5 | 2021-10-19 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 15 and iPadOS 15. Processing a maliciously crafted USD file may… |
CVE-2021-30815 | Low | 2.4 | 2021-10-19 | A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in iOS 15 and i… |
CVE-2021-30811 | Medium | 5.5 | 2021-10-19 | This issue was addressed with improved checks. This issue is fixed in iOS 15 and iPadOS 15, watchOS 8. A local attacker may be able to read sensitive informati… |
CVE-2021-30810 | Medium | 4.3 | 2021-10-19 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 15 and iPadOS 15, watchOS 8, tvOS 15. An attacker in physical p… |
CVE-2021-30807 | High | 7.8 | 2021-10-19 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1… |
CVE-2021-30358 | High | 7.2 | 2021-10-19 | Mobile Access Portal Native Applications who's path is defined by the administrator with environment variables may run applications from other locations by the… |
CVE-2021-3889 | High | 8.1 | 2021-10-19 | libmobi is vulnerable to Use of Out-of-range Pointer Offset |
CVE-2021-3888 | High | 8.1 | 2021-10-19 | libmobi is vulnerable to Use of Out-of-range Pointer Offset |
CVE-2021-3879 | Medium | 5.4 | 2021-10-19 | snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3872 | High | 7.8 | 2021-10-19 | vim is vulnerable to Heap-based Buffer Overflow |
CVE-2021-3869 | High | 7.5 | 2021-10-19 | corenlp is vulnerable to Improper Restriction of XML External Entity Reference |
CVE-2021-3863 | Medium | 6.1 | 2021-10-19 | snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3858 | High | 8.8 | 2021-10-19 | snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3851 | Medium | 5.4 | 2021-10-19 | firefly-iii is vulnerable to URL Redirection to Untrusted Site |
CVE-2021-3846 | High | 8.8 | 2021-10-19 | firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type |
CVE-2021-38486 | High | 8.0 | 2021-10-19 | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements… |
CVE-2021-38484 | Critical | 9.1 | 2021-10-19 | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not have a filter or signature check to detect or prevent an upload of malicious files t… |