2021 CVEs (page 105)
Page 105 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-40988 | High | 7.2 | 2021-10-15 | A remote directory traversal vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - Cle… |
CVE-2021-40987 | High | 7.2 | 2021-10-15 | A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2… |
CVE-2021-40986 | High | 7.2 | 2021-10-15 | A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2… |
CVE-2021-3881 | Critical | 9.8 | 2021-10-15 | libmobi is vulnerable to Out-of-bounds Read |
CVE-2021-3878 | Critical | 9.8 | 2021-10-15 | corenlp is vulnerable to Improper Restriction of XML External Entity Reference |
CVE-2021-3875 | Medium | 5.5 | 2021-10-15 | vim is vulnerable to Heap-based Buffer Overflow |
CVE-2021-3874 | Medium | 6.5 | 2021-10-15 | bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2021-37739 | High | 7.2 | 2021-10-15 | A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2… |
CVE-2021-37738 | High | 7.5 | 2021-10-15 | A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior t… |
CVE-2021-39349 | Medium | 5.5 | 2021-10-15 | The Author Bio Box WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters f… |
CVE-2021-39345 | Medium | 5.5 | 2021-10-15 | The HAL WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the… |
CVE-2021-39344 | Medium | 5.5 | 2021-10-15 | The KJM Admin Notices WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameter… |
CVE-2021-39338 | Medium | 5.5 | 2021-10-15 | The MyBB Cross-Poster WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameter… |
CVE-2021-39337 | Medium | 5.5 | 2021-10-15 | The job-portal WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found… |
CVE-2021-39336 | Medium | 5.5 | 2021-10-15 | The Job Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters foun… |
CVE-2021-39335 | Medium | 5.5 | 2021-10-15 | The WpGenius Job Listing WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parame… |
CVE-2021-39334 | Medium | 5.5 | 2021-10-15 | The Job Board Vanila WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the psjb_exp_in an… |
CVE-2021-39332 | Medium | 5.5 | 2021-10-15 | The Business Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization found throughout the p… |
CVE-2021-38431 | Medium | 4.3 | 2021-10-15 | An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users. |
CVE-2021-37737 | High | 8.8 | 2021-10-15 | A remote SQL injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass… |
CVE-2021-37736 | Critical | 9.8 | 2021-10-15 | A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - C… |
CVE-2021-42336 | Medium | 4.3 | 2021-10-15 | The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can access other users’ and… |
CVE-2021-42335 | Medium | 5.4 | 2021-10-15 | Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user’s privilege, remote attacker… |
CVE-2021-42334 | High | 8.8 | 2021-10-15 | The Easytest contains SQL injection vulnerabilities. After obtaining a user’s privilege, remote attackers can inject SQL commands into the parameters of the el… |
CVE-2021-42333 | High | 8.8 | 2021-10-15 | The Easytest contains SQL injection vulnerabilities. After obtaining user’s privilege, remote attackers can inject SQL commands into the parameters of the lear… |
CVE-2021-42332 | Medium | 4.3 | 2021-10-15 | The “List View” function of ShinHer StudyOnline System is not under authority control. After logging in with user’s privilege, remote attackers can access the… |
CVE-2021-42331 | Medium | 5.4 | 2021-10-15 | The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can acces… |
CVE-2021-42330 | High | 8.8 | 2021-10-15 | The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can acce… |
CVE-2021-42329 | Medium | 5.4 | 2021-10-15 | The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logging in with user’s… |
CVE-2021-40999 | High | 7.2 | 2021-10-15 | A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2… |
CVE-2021-42340 | High | 7.5 | 2021-10-14 | The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. Th… |
CVE-2021-38295 | High | 7.3 | 2021-10-14 | In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin ope… |
CVE-2021-36389 | High | 7.5 | 2021-10-14 | In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sen… |
CVE-2021-36388 | High | 7.5 | 2021-10-14 | In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable… |
CVE-2021-36387 | Medium | 5.4 | 2021-10-14 | In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP PO… |
CVE-2021-42369 | Critical | 9.9 | 2021-10-14 | Imagicle Application Suite (for Cisco UC) before 2021.Summer.2 allows SQL injection. A low-privileged user could inject a SQL statement through the "Export to… |
CVE-2021-32571 | Medium | 4.9 | 2021-10-14 | In OSS-RC systems of the release 18B and older during data migration procedures certain files containing usernames and passwords are left in the system undelet… |
CVE-2021-42228 | High | 8.8 | 2021-10-14 | A Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html. |
CVE-2021-42227 | Medium | 6.1 | 2021-10-14 | Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .html file on the websit… |
CVE-2021-32569 | Medium | 6.1 | 2021-10-14 | In OSS-RC systems of the release 18B and older customer documentation browsing libraries under ALEX are subject to Cross-Site Scripting. This problem is comple… |
CVE-2021-41142 | Medium | 5.4 | 2021-10-14 | Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. There is a cross-site scripting vulnerabili… |
CVE-2021-41132 | Critical | 9.8 | 2021-10-14 | OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through… |
CVE-2021-38346 | High | 8.8 | 2021-10-14 | The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_crea… |
CVE-2021-38345 | High | 7.1 | 2021-10-14 | The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-ad… |
CVE-2021-38344 | Medium | 6.4 | 2021-10-14 | The Brizy Page Builder plugin <= 2.3.11 for WordPress was vulnerable to stored XSS by lower-privileged users such as a subscribers. It was possible to add mali… |
CVE-2021-37933 | High | 7.5 | 2021-10-14 | An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LD… |
CVE-2021-33179 | Medium | 6.1 | 2021-10-14 | The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. An authenticated victim, who acc… |
CVE-2021-33178 | Medium | 6.5 | 2021-10-14 | The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. Exploitation of thi… |
CVE-2021-33177 | High | 8.8 | 2021-10-14 | The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be authe… |
CVE-2021-22964 | High | 8.8 | 2021-10-14 | A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary web… |
CVE-2021-22963 | Medium | 6.1 | 2021-10-14 | A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // fol… |
CVE-2021-20599 | Critical | 9.1 | 2021-10-14 | Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCP… |
CVE-2021-3882 | Medium | 6.8 | 2021-10-14 | LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy… |
CVE-2021-42342 | Critical | 9.8 | 2021-10-14 | An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts without being prefixed… |
CVE-2021-42341 | High | 7.5 | 2021-10-14 | checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the end of the string. Th… |
CVE-2021-40854 | High | 7.8 | 2021-10-14 | AnyDesk before 6.2.6 and 6.3.x before 6.3.3 allows a local user to obtain administrator privileges by using the Open Chat Log feature to launch a privileged No… |
CVE-2021-41075 | Critical | 9.8 | 2021-10-13 | The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API. |
CVE-2021-40493 | Critical | 9.8 | 2021-10-13 | Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the… |
CVE-2021-26318 | Medium | 4.7 | 2021-10-13 | A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked kernel address space… |
CVE-2021-42224 | Critical | 9.8 | 2021-10-13 | SQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via the searchifsccode POST parameter in /search.php. |
CVE-2021-42223 | Medium | 6.1 | 2021-10-13 | Cross Site Scripting (XSS).vulnerability exists in Online DJ Booking Management System 1.0 in view-booking-detail.php. |
CVE-2021-40843 | High | 7.3 | 2021-10-13 | Proofpoint Insider Threat Management Server contains an unsafe deserialization vulnerability in the Web Console. An attacker with write access to the local dat… |
CVE-2021-40842 | Critical | 9.8 | 2021-10-13 | Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web Console. The vulnerability exists due to improper input validatio… |
CVE-2021-20131 | High | 8.8 | 2021-10-13 | ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the Perso… |
CVE-2021-20130 | High | 8.8 | 2021-10-13 | ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the Passw… |
CVE-2021-41139 | High | 8.1 | 2021-10-13 | Anuko Time Tracker is an open source, web-based time tracking application written in PHP. When a logged on user selects a date in Time Tracker, it is being pas… |
CVE-2021-40732 | Medium | 6.1 | 2021-10-13 | XMP Toolkit version 2020.1 (and earlier) is affected by a null pointer dereference vulnerability that could result in leaking data from certain memory location… |
CVE-2021-35498 | Critical | 9.8 | 2021-10-13 | The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, and TIBCO Product and Service Catalog powered by TIBCO EBX contain… |
CVE-2021-41138 | Medium | 5.3 | 2021-10-13 | Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a large part of transac… |
CVE-2021-3057 | High | 8.1 | 2021-10-13 | A stack-based buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect app that enables a man-in-the-middle attacker to disrupt system proc… |
CVE-2021-22036 | Medium | 6.5 | 2021-10-13 | VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling. A malicious actor may be able to redire… |
CVE-2021-22035 | Medium | 4.3 | 2021-10-13 | VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. An authe… |
CVE-2021-22033 | Low | 2.7 | 2021-10-13 | Releases prior to VMware vRealize Operations 8.6 contain a Server Side Request Forgery (SSRF) vulnerability. |
CVE-2021-20129 | High | 7.5 | 2021-10-13 | An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3, allowing an unauthenticated attacker to export system logs. |
CVE-2021-20128 | Medium | 5.4 | 2021-10-13 | The Profile Name field in the floor plan (Network Menu) page in Draytek VigorConnect 1.6.0-B3 was found to be vulnerable to stored XSS, as user input is not pr… |
CVE-2021-20127 | High | 8.1 | 2021-10-13 | An arbitrary file deletion vulnerability exists in the file delete functionality of the Html5Servlet endpoint of Draytek VigorConnect 1.6.0-B3. This allows an… |
CVE-2021-20126 | High | 8.8 | 2021-10-13 | Draytek VigorConnect 1.6.0-B3 lacks cross-site request forgery protections and does not sufficiently verify whether a well-formed, valid, consistent request wa… |
CVE-2021-20125 | Critical | 9.8 | 2021-10-13 | An arbitrary file upload and directory traversal vulnerability exists in the file upload functionality of DownloadFileServlet in Draytek VigorConnect 1.6.0-B3… |
CVE-2021-20124 | High | 7.5 | 2021-10-13 | A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated… |
CVE-2021-20123 | High | 7.5 | 2021-10-13 | A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthe… |
CVE-2021-39304 | High | 7.5 | 2021-10-13 | Proofpoint Enterprise Protection before 8.12.0-2108090000 allows security control bypass. |
CVE-2021-34814 | High | 7.5 | 2021-10-13 | Proofpoint Spam Engine before 8.12.0-2106240000 has a Security Control Bypass. |
CVE-2021-41137 | High | 8.8 | 2021-10-13 | Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerability that involves b… |
CVE-2021-33609 | Medium | 4.3 | 2021-10-13 | Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network at… |
CVE-2021-20834 | Medium | 6.1 | 2021-10-13 | Improper authorization in handler for custom URL scheme vulnerability in Nike App for Android versions prior to 2.177 and Nike App for iOS versions prior to 2… |
CVE-2021-20833 | High | 7.4 | 2021-10-13 | The SNKRDUNK Market Place App for iOS versions prior to 2.2.0 does not verify server certificate properly, which allows man-in-the-middle attackers to eavesdro… |
CVE-2021-20832 | Medium | 5.3 | 2021-10-13 | InBody App for iOS versions prior to 2.3.30 and InBody App for Android versions prior to 2.2.90(510) contain a vulnerability which may lead to information disc… |
CVE-2021-20831 | High | 8.8 | 2021-10-13 | Cross-site request forgery (CSRF) vulnerability in OG Tags versions prior to 2.0.2 allows a remote attacker to hijack the authentication of administrators and… |
CVE-2021-20807 | Medium | 6.1 | 2021-10-13 | Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.0.0 to 3.1.9 allows a remote attacker to inject an arbitrary script via… |
CVE-2021-20806 | Medium | 6.1 | 2021-10-13 | Open redirect vulnerability in Cybozu Remote Service 3.0.0 to 3.1.9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attac… |
CVE-2021-20805 | Medium | 5.4 | 2021-10-13 | Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.7 to 3.1.9 allows a remote authenticated attacker to inject an arbitra… |
CVE-2021-20804 | Medium | 6.5 | 2021-10-13 | Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to cause a denial of service (DoS) condition via unspecified vectors. |
CVE-2021-20803 | Medium | 5.4 | 2021-10-13 | Operation restriction bypass in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to alter the data of the m… |
CVE-2021-20802 | Medium | 5.3 | 2021-10-13 | HTTP header injection vulnerability in Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to alter the information stored in the product. |
CVE-2021-20801 | Medium | 6.5 | 2021-10-13 | Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to conduct XML External Entity (XXE) attacks and obtain the information stored in t… |
CVE-2021-20800 | Medium | 5.4 | 2021-10-13 | Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 allows a remote authenticated attacker to inject an arbitrary script… |
CVE-2021-20799 | Medium | 5.4 | 2021-10-13 | Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to inject an arbitra… |
CVE-2021-20798 | Medium | 5.4 | 2021-10-13 | Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to inject an arbitra… |
CVE-2021-20797 | Medium | 5.4 | 2021-10-13 | Cross-site script inclusion vulnerability in the management screen of Cybozu Remote Service 3.1.8 allows a remote authenticated attacker to obtain the informat… |
CVE-2021-20796 | Medium | 6.5 | 2021-10-13 | Directory traversal vulnerability in the management screen of Cybozu Remote Service 3.1.8 allows a remote authenticated attacker to upload an arbitrary file vi… |