2021 CVEs (page 107)
Page 107 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-40496 | Medium | 4.3 | 2021-10-12 | SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon funct… |
CVE-2021-40495 | Medium | 5.3 | 2021-10-12 | There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 75… |
CVE-2021-38183 | Medium | 6.1 | 2021-10-12 | SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential victim to supply a… |
CVE-2021-38181 | High | 7.5 | 2021-10-12 | SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allows an attacker to prevent legitimate us… |
CVE-2021-38180 | Critical | 9.8 | 2021-10-12 | SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data… |
CVE-2021-38179 | Medium | 4.9 | 2021-10-12 | Debug function of Admin UI of SAP Business One Integration is enabled by default. This allows Admin User to see the captured packet contents which may include… |
CVE-2021-38178 | High | 8.8 | 2021-10-12 | The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enabl… |
CVE-2021-37730 | High | 7.2 | 2021-10-12 | A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aru… |
CVE-2021-37727 | High | 7.2 | 2021-10-12 | A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5… |
CVE-2021-37726 | Critical | 9.8 | 2021-10-12 | A remote buffer overflow vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 8.7.x.x: 8.7.0.0 through 8.7.1.2. Aruba has released… |
CVE-2021-38460 | High | 7.5 | 2021-10-12 | A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files… |
CVE-2021-38458 | Critical | 9.8 | 2021-10-12 | A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files… |
CVE-2021-38456 | Critical | 9.8 | 2021-10-12 | A use of hard-coded password vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to gain access through ac… |
CVE-2021-38454 | Critical | 10.0 | 2021-10-12 | A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files… |
CVE-2021-38452 | High | 7.5 | 2021-10-12 | A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files… |
CVE-2021-25634 | High | 7.5 | 2021-10-12 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since… |
CVE-2021-21941 | Critical | 9.0 | 2021-10-12 | A use-after-free vulnerability exists in the pushMuxer CreatePushThread functionality of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network pac… |
CVE-2021-21940 | Critical | 10.0 | 2021-10-12 | A heap-based buffer overflow vulnerability exists in the pushMuxer processRtspInfo functionality of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted network… |
CVE-2021-41546 | High | 7.5 | 2021-10-12 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All… |
CVE-2021-37199 | High | 7.5 | 2021-10-12 | A vulnerability has been identified in SINUMERIK 808D (All versions), SINUMERIK 828D (All versions < V4.95). Affected devices don't process correctly certain s… |
CVE-2021-33736 | High | 7.2 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in th… |
CVE-2021-33735 | High | 7.2 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in th… |
CVE-2021-33734 | High | 7.2 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in th… |
CVE-2021-33733 | High | 7.2 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in th… |
CVE-2021-33732 | High | 7.2 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in th… |
CVE-2021-33731 | High | 7.2 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in th… |
CVE-2021-33730 | High | 7.2 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in th… |
CVE-2021-33729 | High | 8.8 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker that is able to import firmware containers to an… |
CVE-2021-33728 | High | 7.2 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to upload JSON objects that are deserialized to… |
CVE-2021-33727 | Medium | 6.5 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker could download the user profile of any user. Wit… |
CVE-2021-33726 | High | 7.5 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to download arbitrary files under a user contro… |
CVE-2021-33725 | Critical | 9.1 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to delete arbitrary files or directories under… |
CVE-2021-33724 | Critical | 9.1 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system contains an Arbitrary File Deletion vulnerability that… |
CVE-2021-33723 | Medium | 6.5 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker could change the user profile of any user withou… |
CVE-2021-33722 | Medium | 4.9 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system has a Path Traversal vulnerability when exporting a fi… |
CVE-2021-27395 | High | 8.1 | 2021-10-12 | A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6)… |
CVE-2021-42009 | Medium | 4.3 | 2021-10-12 | An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliver… |
CVE-2021-23448 | Medium | 6.5 | 2021-10-11 | All versions of package config-handler are vulnerable to Prototype Pollution when loading config files. |
CVE-2021-42260 | High | 7.5 | 2021-10-11 | TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML… |
CVE-2021-42257 | High | 7.1 | 2021-10-11 | check_smart before 6.9.1 allows unintended drive access by an unprivileged user because it only checks for a substring match of a device path (the /dev/bus sub… |
CVE-2021-42252 | High | 7.8 | 2021-10-11 | An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the A… |
CVE-2021-40617 | Critical | 9.8 | 2021-10-11 | An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotPassUserName.php. |
CVE-2021-40239 | Critical | 9.8 | 2021-10-11 | A Buffer Overflow vulnerability exists in the latest version of Miniftpd in the do_retr function in ftpproto.c |
CVE-2021-40189 | High | 7.2 | 2021-10-11 | PHPFusion 9.03.110 is affected by a remote code execution vulnerability. The theme function will extract a file to "webroot/themes/{Theme Folder], where an att… |
CVE-2021-40188 | High | 7.2 | 2021-10-11 | PHPFusion 9.03.110 is affected by an arbitrary file upload vulnerability. The File Manager function in admin panel does not filter all PHP extensions such as "… |
CVE-2021-25738 | Medium | 6.7 | 2021-10-11 | Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution. |
CVE-2021-41117 | High | 8.7 | 2021-10-11 | keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing from other librarie… |
CVE-2021-32028 | Medium | 6.5 | 2021-10-11 | A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arb… |
CVE-2021-27002 | High | 7.5 | 2021-10-11 | NetApp Cloud Manager versions prior to 3.9.10 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to retrieve sensitive data… |
CVE-2021-26588 | Critical | 9.8 | 2021-10-11 | A potential security vulnerability has been identified in HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage array firmware. An unauthenticat… |
CVE-2021-25633 | High | 7.5 | 2021-10-11 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since… |
CVE-2021-22263 | Medium | 5.5 | 2021-10-11 | An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions sta… |
CVE-2021-20122 | High | 7.2 | 2021-10-11 | The Telus Wi-Fi Hub (PRV65B444A-S-TS) with firmware version 3.00.20 is affected by an authenticated command injection vulnerability in multiple parameters pass… |
CVE-2021-20121 | Medium | 4.0 | 2021-10-11 | The Telus Wi-Fi Hub (PRV65B444A-S-TS) with firmware version 3.00.20 is vulnerable to an authenticated arbitrary file read. An authenticated user with physical… |
CVE-2021-39317 | High | 8.8 | 2021-10-11 | A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX… |
CVE-2021-37123 | Critical | 9.8 | 2021-10-11 | There is an improper authentication vulnerability in Hero-CT060 before 1.0.0.200. The vulnerability is due to that when an user wants to do certain operation… |
CVE-2021-27665 | High | 7.5 | 2021-10-11 | An unauthenticated remote user could exploit a potential integer overflow condition in the exacqVision Server with a specially crafted script and cause denial-… |
CVE-2021-27664 | Critical | 9.8 | 2021-10-11 | Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server. |
CVE-2021-0583 | High | 7.3 | 2021-10-11 | In onCreate of BluetoothPairingDialog, there is a possible way to enable Bluetooth without user consent due to a tapjacking/overlay attack. This could lead to… |
CVE-2021-40541 | Medium | 6.1 | 2021-10-11 | PHPFusion 9.03.110 is affected by cross-site scripting (XSS) in the preg patterns filter html tag without "//" in descript() function An authenticated user can… |
CVE-2021-40191 | Medium | 5.4 | 2021-10-11 | Dzzoffice Version 2.02.1 is affected by cross-site scripting (XSS) due to a lack of sanitization of input data at all upload functions in webroot/dzz/attach/Up… |
CVE-2021-40543 | Critical | 9.8 | 2021-10-11 | Opensis-Classic Version 8.0 is affected by a SQL injection vulnerability due to a lack of sanitization of input data at two parameters $_GET['usrid'] and $_GET… |
CVE-2021-40542 | Medium | 6.1 | 2021-10-11 | Opensis-Classic Version 8.0 is affected by cross-site scripting (XSS). An unauthenticated user can inject and execute JavaScript code through the link_url para… |
CVE-2021-29006 | Medium | 6.5 | 2021-10-11 | rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server. |
CVE-2021-29005 | High | 8.8 | 2021-10-11 | Insecure permission of chmod command on rConfig server 3.9.6 exists. After installing rConfig apache user may execute chmod as root without password which may… |
CVE-2021-29004 | High | 8.8 | 2021-10-11 | rConfig 3.9.6 is affected by SQL Injection. A user must be authenticated to exploit the vulnerability. If --secure-file-priv in MySQL server is not set and the… |
CVE-2021-40888 | Medium | 5.4 | 2021-10-11 | Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function. A low privi… |
CVE-2021-40887 | Critical | 9.8 | 2021-10-11 | Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add… |
CVE-2021-40886 | Medium | 6.5 | 2021-10-11 | Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` parameter to bypass `fil… |
CVE-2021-40884 | High | 8.1 | 2021-10-11 | Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id para… |
CVE-2021-24737 | Medium | 4.8 | 2021-10-11 | The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page… |
CVE-2021-24720 | Medium | 5.4 | 2021-10-11 | The GeoDirectory Business Directory WordPress plugin before 2.1.1.3 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS). |
CVE-2021-24719 | Medium | 6.1 | 2021-10-11 | The Enfold Enfold WordPress theme before 4.8.4 was vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability is present on Enfold versions previous… |
CVE-2021-24712 | Medium | 5.4 | 2021-10-11 | The Appointment Hour Booking WordPress plugin before 1.3.17 does not properly sanitize values used when creating new calendars. |
CVE-2021-24711 | High | 8.8 | 2021-10-11 | The del_reistered_domains AJAX action of the Software License Manager WordPress plugin before 4.5.1 does not have any CSRF checks, and is vulnerable to a CSRF… |
CVE-2021-24709 | Medium | 4.8 | 2021-10-11 | The Weather Effect WordPress plugin before 1.3.6 does not properly validate and escape some of its settings (like *_size_leaf, *_flakes_leaf, *_speed) which co… |
CVE-2021-24691 | Medium | 4.8 | 2021-10-11 | The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high p… |
CVE-2021-24690 | Medium | 5.4 | 2021-10-11 | The Chained Quiz WordPress plugin before 1.2.7.2 does not properly sanitize or escape inputs in the plugin's settings. |
CVE-2021-24683 | Medium | 5.4 | 2021-10-11 | The Weather Effect WordPress plugin before 1.3.4 does not have any CSRF checks in place when saving its settings, and do not validate or escape them, which cou… |
CVE-2021-24681 | Medium | 4.8 | 2021-10-11 | The Duplicate Page WordPress plugin through 4.4.2 does not sanitise or escape the Duplicate Post Suffix settings before outputting it, which could allow high p… |
CVE-2021-24656 | Medium | 4.8 | 2021-10-11 | The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or post… |
CVE-2021-24651 | High | 7.5 | 2021-10-11 | The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. While the result is not… |
CVE-2021-24577 | Medium | 5.4 | 2021-10-11 | The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authenticated users when setting adding or mo… |
CVE-2021-24576 | Medium | 5.4 | 2021-10-11 | The Easy Accordion WordPress plugin before 2.0.22 does not properly sanitize inputs when adding new items to an accordion. |
CVE-2021-24563 | Medium | 6.1 | 2021-10-11 | The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a ma… |
CVE-2021-24546 | High | 8.8 | 2021-10-11 | The Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility se… |
CVE-2021-24545 | Medium | 5.4 | 2021-10-11 | The WP HTML Author Bio WordPress plugin through 1.2.0 does not sanitise the HTML allowed in the Bio of users, allowing them to use malicious JavaScript code, w… |
CVE-2021-40889 | Critical | 9.8 | 2021-10-11 | CMSUno version 1.7.2 is affected by a PHP code execution vulnerability. sauvePass action in {webroot}/uno/central.php file calls to file_put_contents() functio… |
CVE-2021-35060 | Medium | 5.3 | 2021-10-11 | /way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whether a specific paymen… |
CVE-2021-35059 | Medium | 6.1 | 2021-10-11 | OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way4acs/enroll action parameter. |
CVE-2021-41832 | High | 7.5 | 2021-10-11 | It is possible for an attacker to manipulate documents to appear to be signed by a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected… |
CVE-2021-41831 | Medium | 5.3 | 2021-10-11 | It is possible for an attacker to manipulate the timestamp of signed documents. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised… |
CVE-2021-41830 | High | 7.5 | 2021-10-11 | It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. All versions of Apache OpenOffice up to 4.1.1… |
CVE-2021-41801 | High | 8.8 | 2021-10-11 | The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked after submitting a replace job, the job is still run… |
CVE-2021-41800 | Medium | 5.3 | 2021-10-11 | MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). Visiting Special:Contributions can sometime… |
CVE-2021-41799 | High | 7.5 | 2021-10-11 | MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). ApiQueryBacklinks (action=query&list=backli… |
CVE-2021-41798 | Medium | 6.1 | 2021-10-11 | MediaWiki before 1.36.2 allows XSS. Month related MediaWiki messages are not escaped before being used on the Special:Search results page. |
CVE-2021-42139 | Critical | 9.8 | 2021-10-11 | Deno Standard Modules before 0.107.0 allows Code Injection via an untrusted YAML file in certain configurations. |
CVE-2021-42137 | Medium | 5.3 | 2021-10-11 | An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list of tickets that sh… |
CVE-2021-42135 | High | 8.1 | 2021-10-11 | HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine… |