2021 CVEs (page 108)
Page 108 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-41055 | High | 7.5 | 2021-10-11 | Gajim 1.2.x and 1.3.x before 1.3.3 allows remote attackers to cause a denial of service (crash) via a crafted XMPP Last Message Correction (XEP-0308) message i… |
CVE-2021-42134 | Medium | 6.1 | 2021-10-11 | The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021-42053. |
CVE-2021-25966 | High | 8.8 | 2021-10-10 | In “Orchard core CMS” application, versions 1.0.0-beta1-3383 to 1.0.0 are vulnerable to an improper session termination after password change. When a password… |
CVE-2021-37976 | Medium | 6.5 | 2021-10-08 | Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from proces… |
CVE-2021-37975 | High | 8.8 | 2021-10-08 | Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-37974 | High | 8.8 | 2021-10-08 | Use after free in Safebrowsing in Google Chrome prior to 94.0.4606.71 allowed a remote attacker who had compromised the renderer process to potentially exploit… |
CVE-2021-37973 | Critical | 9.6 | 2021-10-08 | Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sa… |
CVE-2021-37972 | High | 8.8 | 2021-10-08 | Out of bounds read in libjpeg-turbo in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2021-37971 | Medium | 4.3 | 2021-10-08 | Incorrect security UI in Web Browser UI in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c… |
CVE-2021-37970 | High | 8.8 | 2021-10-08 | Use after free in File System API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2021-37969 | High | 7.8 | 2021-10-08 | Inappropriate implementation in Google Updater in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to perform local privilege escalatio… |
CVE-2021-37968 | Medium | 4.3 | 2021-10-08 | Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2021-37967 | Medium | 4.3 | 2021-10-08 | Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process… |
CVE-2021-37966 | Medium | 4.3 | 2021-10-08 | Inappropriate implementation in Compositing in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (U… |
CVE-2021-37965 | Medium | 4.3 | 2021-10-08 | Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2021-37964 | Low | 3.3 | 2021-10-08 | Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0.4606.54 allowed an attacker with a rogue wireless access point t… |
CVE-2021-37963 | Medium | 4.3 | 2021-10-08 | Side-channel information leakage in DevTools in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
CVE-2021-37962 | High | 8.8 | 2021-10-08 | Use after free in Performance Manager in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2021-37961 | High | 8.8 | 2021-10-08 | Use after free in Tab Strip in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-37959 | High | 8.8 | 2021-10-08 | Use after free in Task Manager in Google Chrome prior to 94.0.4606.54 allowed an attacker who convinced a user to enage in a series of user gestures to potenti… |
CVE-2021-37958 | Medium | 5.4 | 2021-10-08 | Inappropriate implementation in Navigation in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to inject scripts or HTML into a privile… |
CVE-2021-37957 | High | 8.8 | 2021-10-08 | Use after free in WebGPU in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-37956 | High | 8.8 | 2021-10-08 | Use after free in Offline use in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2021-42112 | Medium | 6.1 | 2021-10-08 | The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js. |
CVE-2021-30633 | Critical | 9.6 | 2021-10-08 | Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perfo… |
CVE-2021-30632 | High | 8.8 | 2021-10-08 | Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30630 | Medium | 4.3 | 2021-10-08 | Inappropriate implementation in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to leak cross-o… |
CVE-2021-30629 | High | 8.8 | 2021-10-08 | Use after free in Permissions in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially exploit… |
CVE-2021-30628 | High | 8.8 | 2021-10-08 | Stack buffer overflow in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. |
CVE-2021-30627 | High | 8.8 | 2021-10-08 | Type confusion in Blink layout in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30626 | High | 8.8 | 2021-10-08 | Out of bounds memory access in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2021-30625 | High | 8.8 | 2021-10-08 | Use after free in Selection API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who convinced the user the visit a malicious website to potent… |
CVE-2021-42109 | Critical | 9.8 | 2021-10-08 | VITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root. |
CVE-2021-29906 | Medium | 5.5 | 2021-10-08 | IBM App Connect Enterprise Certified Container 1.0, 1.1, 1.2, 1.3, 1.4 and 1.5 could disclose sensitive information to a local user when it is configured to us… |
CVE-2021-41802 | Low | 2.9 | 2021-10-08 | HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another u… |
CVE-2021-32029 | Medium | 6.5 | 2021-10-08 | A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of… |
CVE-2021-20600 | Medium | 5.9 | 2021-10-08 | Uncontrolled resource consumption in Mitsubishi Electric MELSEC iQ-R series C Controller Module R12CCPU-V Firmware Versions "16" and prior allows a remote unau… |
CVE-2021-41976 | Medium | 5.3 | 2021-10-08 | Tad Uploader edit book list function is vulnerable to authorization bypass, thus remote attackers can use the function to amend the folder names in the book li… |
CVE-2021-41975 | High | 7.5 | 2021-10-08 | TadTools special page is vulnerable to authorization bypass, thus remote attackers can use the specific parameter to delete arbitrary files in the system witho… |
CVE-2021-41974 | Critical | 9.1 | 2021-10-08 | Tad Book3 editing book page does not perform identity verification. Remote attackers can use the vulnerability to view and modify arbitrary content of books wi… |
CVE-2021-41920 | High | 7.5 | 2021-10-08 | webTareas version 2.4 and earlier allows an unauthenticated user to perform Time and Boolean-based blind SQL Injection on the endpoint /includes/library.php, v… |
CVE-2021-41919 | High | 8.8 | 2021-10-08 | webTareas version 2.4 and earlier allows an authenticated user to arbitrarily upload potentially dangerous files without restrictions. This is working by addin… |
CVE-2021-41918 | Medium | 5.4 | 2021-10-08 | webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and a… |
CVE-2021-41917 | Medium | 5.4 | 2021-10-08 | webTareas version 2.4 and earlier allows an authenticated user to store arbitrary web script or HTML by creating or editing a client name in the clients sectio… |
CVE-2021-41916 | High | 8.8 | 2021-10-08 | A Cross-Site Request Forgery (CSRF) vulnerability in webTareas version 2.4 and earlier allows a remote attacker to create a new administrative profile and add… |
CVE-2021-41825 | Medium | 5.3 | 2021-10-08 | Verint Workforce Optimization (WFO) 15.2.5.1033 allows HTML injection via the /wfo/control/signin username parameter. |
CVE-2021-41568 | Medium | 5.3 | 2021-10-08 | Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original function of viewing bulletin boards and… |
CVE-2021-41567 | Medium | 6.1 | 2021-10-08 | The new add subject parameter of Tad Uploader view book list function fails to filter special characters. Unauthenticated attackers can remotely inject JavaScr… |
CVE-2021-41566 | Critical | 9.8 | 2021-10-08 | The file extension of the TadTools file upload function fails to filter, thus remote attackers can upload any types of files and execute arbitrary code without… |
CVE-2021-41565 | Medium | 6.1 | 2021-10-08 | TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can inject JavaScript syntax without logging… |
CVE-2021-41564 | Medium | 5.3 | 2021-10-08 | Tad Honor viewing book list function is vulnerable to authorization bypass, thus remote attackers can use special parameters to delete articles arbitrarily wit… |
CVE-2021-41563 | Medium | 6.1 | 2021-10-08 | Tad Book3 editing book function does not filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS atta… |
CVE-2021-3312 | Medium | 6.5 | 2021-10-08 | An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate file… |
CVE-2021-36767 | Critical | 9.8 | 2021-10-08 | In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection inef… |
CVE-2021-35979 | High | 8.1 | 2021-10-08 | An issue was discovered in Digi RealPort through 4.8.488.0. The 'encrypted' mode is vulnerable to man-in-the-middle attacks and does not perform authentication. |
CVE-2021-35977 | Critical | 9.8 | 2021-10-08 | An issue was discovered in Digi RealPort for Windows through 4.8.488.0. A buffer overflow exists in the handling of ADDP discovery response messages. This coul… |
CVE-2021-41133 | High | 8.8 | 2021-10-08 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with… |
CVE-2021-41947 | High | 7.2 | 2021-10-08 | A SQL injection vulnerability exists in Subrion CMS v4.2.1 in the visual-mode. |
CVE-2021-40832 | Medium | 5.5 | 2021-10-08 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the AVRDL unpacking module component used in certain F-Secure products can cr… |
CVE-2021-33603 | Medium | 5.5 | 2021-10-08 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the AVPACK module component used in certain F-Secure products can crash while… |
CVE-2021-25271 | Medium | 6.0 | 2021-10-08 | A local attacker could read or write arbitrary files with administrator privileges in HitmanPro before version Build 318. |
CVE-2021-25270 | Medium | 6.7 | 2021-10-08 | A local attacker could execute arbitrary code with administrator privileges in HitmanPro.Alert before version Build 901. |
CVE-2021-41115 | Medium | 4.3 | 2021-10-07 | Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers" that automaticall… |
CVE-2021-38298 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE. |
CVE-2021-42095 | High | 7.5 | 2021-10-07 | Xshell before 7.0.0.76 allows attackers to cause a crash by triggering rapid changes to the title bar. |
CVE-2021-42091 | Critical | 9.1 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. SSRF can occur via GitHub or GitLab integration. |
CVE-2021-42090 | Critical | 9.8 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserialization is mishandled. |
CVE-2021-42089 | High | 7.5 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information. |
CVE-2021-42088 | Medium | 6.1 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled. |
CVE-2021-42087 | Medium | 4.9 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API. |
CVE-2021-42086 | High | 8.8 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request. |
CVE-2021-42085 | Medium | 5.4 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar. |
CVE-2021-42084 | Medium | 6.5 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. An attacker with valid agent credentials may send a series of crafted requests that cause an endless loop and t… |
CVE-2021-42094 | Critical | 9.8 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. Command Injection can occur via custom Packages. |
CVE-2021-42093 | High | 7.2 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a crafted request that manipulates triggers. |
CVE-2021-42092 | Medium | 5.4 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket. |
CVE-2021-41130 | Medium | 6.4 | 2021-10-07 | Extensible Service Proxy, a.k.a. ESP is a proxy which enables API management capabilities for JSON/REST or gRPC API services. ESPv1 can be configured to authen… |
CVE-2021-29700 | Medium | 4.3 | 2021-10-07 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authneticated attacker to obtain sensitive information from configuration f… |
CVE-2021-20584 | High | 7.5 | 2021-10-07 | IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote attacker to upload arbitrary files, caused by improper access controls. IBM X-Force ID… |
CVE-2021-20571 | Medium | 5.4 | 2021-10-07 | IBM Sterling B2B Integrator 5.2.0.0 through 6.1.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2021-20561 | Medium | 6.1 | 2021-10-07 | IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2021-20552 | Medium | 4.3 | 2021-10-07 | IBM Sterling File Gateway 6.0.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is retu… |
CVE-2021-20489 | High | 8.8 | 2021-10-07 | IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthoriz… |
CVE-2021-20481 | Medium | 6.1 | 2021-10-07 | IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2021-20473 | Medium | 6.5 | 2021-10-07 | IBM Sterling File Gateway User Interface 2.2.0.0 through 6.1.1.0 does not invalidate session after logout which could allow an authenticated user to impersonat… |
CVE-2021-20376 | Medium | 4.3 | 2021-10-07 | IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated attacker to enumerate usernames due to there being an observable discrepancy in… |
CVE-2021-20375 | Medium | 6.5 | 2021-10-07 | IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to intercept and replace a message sent by another user due to improper acc… |
CVE-2021-20372 | Medium | 4.3 | 2021-10-07 | IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote authenticated user to cause a denial of another user's service due to insufficient permi… |
CVE-2021-42071 | Critical | 9.8 | 2021-10-07 | In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py Use… |
CVE-2021-23447 | Medium | 5.4 | 2021-10-07 | This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization when the model content is an array (instea… |
CVE-2021-42013 | Critical | 9.8 | 2021-10-07 | It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files… |
CVE-2021-40726 | High | 7.8 | 2021-10-07 | Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnera… |
CVE-2021-40725 | High | 7.8 | 2021-10-07 | Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnera… |
CVE-2021-40439 | Medium | 6.5 | 2021-10-07 | Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of servi… |
CVE-2021-3834 | Medium | 5.4 | 2021-10-07 | Integria IMS in its 5.0.92 version does not filter correctly some fields related to the login.php file. An attacker could exploit this vulnerability in order t… |
CVE-2021-3833 | Critical | 9.8 | 2021-10-07 | Integria IMS login check uses a loose comparator ("==") to compare the MD5 hash of the password provided by the user and the MD5 hash stored in the database. A… |
CVE-2021-37931 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37930 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37929 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37928 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |