2021 CVEs (page 109)
Page 109 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-37926 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37924 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37923 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37922 | Medium | 5.3 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to path traversal which allows copying of files from one directory to another. |
CVE-2021-37921 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37920 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37919 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37918 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37762 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file overwrite leading to remote code execution. |
CVE-2021-28129 | High | 7.8 | 2021-10-07 | While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but instead used a userid and groupid of 500… |
CVE-2021-41794 | High | 7.5 | 2021-10-07 | ogs_fqdn_parse in Open5GS 1.0.0 through 2.3.3 inappropriately trusts a client-supplied length value, leading to a buffer overflow. The attacker can send a PFCP… |
CVE-2021-35067 | High | 8.1 | 2021-10-07 | Meross MSG100 devices before 3.2.3 allow an attacker to replay the same data or similar data (e.g., an attacker who sniffs a Close message can transmit an acce… |
CVE-2021-33903 | High | 8.8 | 2021-10-07 | In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCOM devices, changing the password of the root user via the CLI does not change the password of the r… |
CVE-2021-28661 | Medium | 4.3 | 2021-10-07 | Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass. |
CVE-2021-41865 | Medium | 6.5 | 2021-10-07 | HashiCorp Nomad and Nomad Enterprise 1.1.1 through 1.1.5 allowed authenticated users with job submission capabilities to cause denial of service by submitting… |
CVE-2021-40978 | High | 7.5 | 2021-10-07 | The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the v… |
CVE-2021-3832 | Critical | 9.8 | 2021-10-07 | Integria IMS in its 5.0.92 version is vulnerable to a Remote Code Execution attack through file uploading. An unauthenticated attacker could abuse the AsyncUpl… |
CVE-2021-36150 | Medium | 6.1 | 2021-10-07 | SilverStripe Framework through 4.8.1 allows XSS. |
CVE-2021-22958 | Critical | 9.8 | 2021-10-07 | A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in plac… |
CVE-2021-22930 | Critical | 9.8 | 2021-10-07 | Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to chang… |
CVE-2021-32172 | Critical | 9.8 | 2021-10-07 | Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin. |
CVE-2021-41770 | High | 7.5 | 2021-10-07 | Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure. |
CVE-2021-42054 | High | 7.5 | 2021-10-07 | ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the client exits after authentication. |
CVE-2021-42053 | Medium | 5.4 | 2021-10-07 | The Unicorn framework through 0.35.3 for Django allows XSS via component.name. |
CVE-2021-26557 | High | 7.8 | 2021-10-07 | When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-load… |
CVE-2021-26556 | High | 7.8 | 2021-10-07 | When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loadin… |
CVE-2021-21684 | Medium | 6.1 | 2021-10-06 | Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause… |
CVE-2021-21683 | Medium | 6.5 | 2021-10-06 | The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal… |
CVE-2021-21682 | Medium | 4.3 | 2021-10-06 | Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replacing the configurat… |
CVE-2021-42044 | Medium | 4.8 | 2021-10-06 | An issue was discovered in the Mentor dashboard in the GrowthExperiments extension in MediaWiki through 1.36.2. The Growthexperiments-mentor-dashboard-mentee-o… |
CVE-2021-42043 | Medium | 6.1 | 2021-10-06 | An issue was discovered in Special:MediaSearch in the MediaSearch extension in MediaWiki through 1.36.2. The suggestion text (a parameter to mediasearch-did-yo… |
CVE-2021-42042 | Medium | 4.8 | 2021-10-06 | An issue was discovered in SpecialEditGrowthConfig in the GrowthExperiments extension in MediaWiki through 1.36.2. The growthexperiments-edit-config-error-inva… |
CVE-2021-42041 | Medium | 6.1 | 2021-10-06 | An issue was discovered in CentralAuth in MediaWiki through 1.36.2. The rightsnone MediaWiki message was not being properly sanitized and allowed for the injec… |
CVE-2021-42040 | High | 7.5 | 2021-10-06 | An issue was discovered in MediaWiki through 1.36.2. A parser function related to loop control allowed for an infinite loop (and php-fpm hang) within the Loops… |
CVE-2021-41129 | High | 8.1 | 2021-10-06 | Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a `confirmation_token`… |
CVE-2021-34788 | High | 7.0 | 2021-10-06 | A vulnerability in the shared library loading mechanism of Cisco AnyConnect Secure Mobility Client for Linux and Mac OS could allow an authenticated, local att… |
CVE-2021-34782 | Medium | 4.3 | 2021-10-06 | A vulnerability in the API endpoints for Cisco DNA Center could allow an authenticated, remote attacker to gain access to sensitive information that should be… |
CVE-2021-34780 | Medium | 4.3 | 2021-10-06 | Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches. An unauthenticate… |
CVE-2021-34779 | Medium | 4.3 | 2021-10-06 | Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches. An unauthenticate… |
CVE-2021-34778 | Medium | 4.3 | 2021-10-06 | Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches. An unauthenticate… |
CVE-2021-34777 | Medium | 4.3 | 2021-10-06 | Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches. An unauthenticate… |
CVE-2021-34776 | Medium | 4.3 | 2021-10-06 | Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches. An unauthenticate… |
CVE-2021-34775 | Medium | 4.3 | 2021-10-06 | Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business 220 Series Smart Switches. An unauthenticate… |
CVE-2021-34772 | Medium | 4.7 | 2021-10-06 | A vulnerability in the web-based management interface of Cisco Orbital could allow an unauthenticated, remote attacker to redirect users to a malicious webpage… |
CVE-2021-34766 | Medium | 5.4 | 2021-10-06 | A vulnerability in the web UI of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges and cre… |
CVE-2021-34758 | Medium | 4.4 | 2021-10-06 | A vulnerability in the memory management of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an authenticated, loc… |
CVE-2021-34757 | Medium | 4.9 | 2021-10-06 | Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login c… |
CVE-2021-34748 | High | 8.8 | 2021-10-06 | A vulnerability in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to perform a command… |
CVE-2021-34744 | Medium | 4.9 | 2021-10-06 | Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login c… |
CVE-2021-34742 | Medium | 6.1 | 2021-10-06 | A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to conduct a cro… |
CVE-2021-34735 | High | 8.8 | 2021-10-06 | Multiple vulnerabilities in the Cisco ATA 190 Series Analog Telephone Adapter Software could allow an attacker to perform a command injection attack resulting… |
CVE-2021-34711 | Medium | 5.5 | 2021-10-06 | A vulnerability in the debug shell of Cisco IP Phone software could allow an authenticated, local attacker to read any file on the device file system. This vul… |
CVE-2021-34710 | High | 8.8 | 2021-10-06 | Multiple vulnerabilities in the Cisco ATA 190 Series Analog Telephone Adapter Software could allow an attacker to perform a command injection attack resulting… |
CVE-2021-34706 | Medium | 6.4 | 2021-10-06 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive… |
CVE-2021-34702 | Medium | 4.3 | 2021-10-06 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive… |
CVE-2021-34698 | High | 8.6 | 2021-10-06 | A vulnerability in the proxy service of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to exhaust system… |
CVE-2021-1594 | High | 7.5 | 2021-10-06 | A vulnerability in the REST API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform a command injection attack a… |
CVE-2021-1534 | Medium | 5.8 | 2021-10-06 | A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote… |
CVE-2021-41128 | Critical | 9.1 | 2021-10-06 | Hygeia is an application for collecting and processing personal and case data in connection with communicable diseases. In affected versions all CSV Exports (S… |
CVE-2021-41126 | High | 7.2 | 2021-10-06 | October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had pre… |
CVE-2021-41125 | Medium | 5.7 | 2021-10-06 | Scrapy is a high-level web crawling and scraping framework for Python. If you use `HttpAuthMiddleware` (i.e. the `http_user` and `http_pass` spider attributes)… |
CVE-2021-41121 | High | 7.5 | 2021-10-06 | Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a function call inside a literal struct, there is a memory corrup… |
CVE-2021-38923 | Critical | 9.1 | 2021-10-06 | IBM PowerVM Hypervisor FW1010 could allow a privileged user to gain access to another VM due to assigning duplicate WWPNs. IBM X-Force ID: 210162. |
CVE-2021-29908 | Critical | 9.8 | 2021-10-06 | The IBM TS7700 Management Interface is vulnerable to unauthenticated access. By accessing a specially-crafted URL, an attacker may gain administrative access t… |
CVE-2021-25499 | High | 7.1 | 2021-10-06 | Intent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access content provider of Gal… |
CVE-2021-25498 | High | 7.3 | 2021-10-06 | A possible buffer overflow vulnerability in maetd_eco_cb_mode of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary… |
CVE-2021-25497 | High | 7.3 | 2021-10-06 | A possible buffer overflow vulnerability in maetd_cpy_slice of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary c… |
CVE-2021-25496 | High | 7.3 | 2021-10-06 | A possible buffer overflow vulnerability in maetd_dec_slice of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary c… |
CVE-2021-25495 | High | 7.3 | 2021-10-06 | A possible heap buffer overflow vulnerability in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows arbitrary code execution. |
CVE-2021-25494 | Medium | 4.0 | 2021-10-06 | A possible buffer overflow vulnerability in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows arbitrary code execution. |
CVE-2021-25493 | Medium | 4.0 | 2021-10-06 | Lack of boundary checking of a buffer in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows OOB read |
CVE-2021-25492 | High | 7.3 | 2021-10-06 | Lack of boundary checking of a buffer in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows OOB read. |
CVE-2021-25491 | Low | 2.3 | 2021-10-06 | A vulnerability in mfc driver prior to SMR Oct-2021 Release 1 allows memory corruption via NULL-pointer dereference. |
CVE-2021-25490 | Medium | 6.0 | 2021-10-06 | A keyblob downgrade attack in keymaster prior to SMR Oct-2021 Release 1 allows attacker to trigger IV reuse vulnerability with privileged process. |
CVE-2021-25489 | Low | 3.3 | 2021-10-06 | Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to… |
CVE-2021-25488 | Medium | 5.5 | 2021-10-06 | Lack of boundary checking of a buffer in recv_data() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read. |
CVE-2021-25487 | High | 7.3 | 2021-10-06 | Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary c… |
CVE-2021-25486 | Low | 2.5 | 2021-10-06 | Exposure of information vulnerability in ipcdump prior to SMR Oct-2021 Release 1 allows an attacker detect device information via analyzing packet in log. |
CVE-2021-25485 | High | 7.5 | 2021-10-06 | Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Oct-2021 Release 1 allows attackers to write file as system UID via BT remote socket. |
CVE-2021-25484 | Medium | 4.0 | 2021-10-06 | Improper authentication in InputManagerService prior to SMR Oct-2021 Release 1 allows monitoring the touch event. |
CVE-2021-25483 | Medium | 4.0 | 2021-10-06 | Lack of boundary checking of a buffer in livfivextractor library prior to SMR Oct-2021 Release 1 allows OOB read. |
CVE-2021-25482 | Medium | 5.9 | 2021-10-06 | SQL injection vulnerabilities in CMFA framework prior to SMR Oct-2021 Release 1 allow untrusted application to overwrite some CMFA framework information. |
CVE-2021-25481 | Medium | 6.4 | 2021-10-06 | An improper error handling in Exynos CP booting driver prior to SMR Oct-2021 Release 1 allows local attackers to bypass a Secure Memory Protector of Exynos CP… |
CVE-2021-25480 | Medium | 4.4 | 2021-10-06 | A lack of replay attack protection in GUTI REALLOCATION COMMAND message process in Qualcomm modem prior to SMR Oct-2021 Release 1 can lead to remote denial of… |
CVE-2021-25479 | High | 7.2 | 2021-10-06 | A possible heap-based buffer overflow vulnerability in Exynos CP Chipset prior to SMR Oct-2021 Release 1 allows arbitrary memory write and code execution. |
CVE-2021-25478 | High | 7.2 | 2021-10-06 | A possible stack-based buffer overflow vulnerability in Exynos CP Chipset prior to SMR Oct-2021 Release 1 allows arbitrary memory write and code execution. |
CVE-2021-25477 | Medium | 4.4 | 2021-10-06 | An improper error handling in Mediatek RRC Protocol stack prior to SMR Oct-2021 Release 1 allows modem crash and remote denial of service. |
CVE-2021-25476 | Medium | 4.1 | 2021-10-06 | An information disclosure vulnerability in Widevine TA log prior to SMR Oct-2021 Release 1 allows attackers to bypass the ASLR protection mechanism in TEE. |
CVE-2021-25475 | Low | 3.9 | 2021-10-06 | A possible heap-based buffer overflow vulnerability in DSP kernel driver prior to SMR Oct-2021 Release 1 allows arbitrary memory write and code execution. |
CVE-2021-25474 | Medium | 4.4 | 2021-10-06 | Assuming a shell privilege is gained, an improper exception handling for multi_sim_bar_show_on_qspanel value in SystemUI prior to SMR Oct-2021 Release 1 allows… |
CVE-2021-25473 | Medium | 4.4 | 2021-10-06 | Assuming a shell privilege is gained, an improper exception handling for multi_sim_bar_hide_by_meadia_full value in SystemUI prior to SMR Oct-2021 Release 1 al… |
CVE-2021-25472 | Medium | 4.0 | 2021-10-06 | An improper access control vulnerability in BluetoothSettingsProvider prior to SMR Oct-2021 Release 1 allows untrusted application to overwrite some Bluetooth… |
CVE-2021-25471 | Low | 3.7 | 2021-10-06 | A lack of replay attack protection in Security Mode Command process prior to SMR Oct-2021 Release 1 can lead to denial of service on mobile network connection… |
CVE-2021-25470 | High | 7.9 | 2021-10-06 | An improper caller check logic of SMC call in TEEGRIS secure OS prior to SMR Oct-2021 Release 1 can be used to compromise TEE. |
CVE-2021-25469 | Medium | 6.0 | 2021-10-06 | A possible stack-based buffer overflow vulnerability in Widevine trustlet prior to SMR Oct-2021 Release 1 allows arbitrary code execution. |
CVE-2021-25468 | Medium | 4.4 | 2021-10-06 | A possible guessing and confirming a byte memory vulnerability in Widevine trustlet prior to SMR Oct-2021 Release 1 allows attackers to read arbitrary memory a… |
CVE-2021-25467 | Medium | 5.3 | 2021-10-06 | Assuming system privilege is gained, possible buffer overflow vulnerabilities in the Vision DSP kernel driver prior to SMR Oct-2021 Release 1 allows privilege… |
CVE-2021-38925 | High | 7.5 | 2021-10-06 | IBM Sterling B2B Integrator Standard Edition 5.2.0. 0 through 6.1.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decryp… |
CVE-2021-29903 | Critical | 9.8 | 2021-10-06 | IBM Sterling B2B Integrator Standard Edition 5.2.6.0 through 6.1.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL stateme… |
CVE-2021-29855 | Medium | 5.4 | 2021-10-06 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary… |