2021 CVEs (page 112)
Page 112 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-41465 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in concrete/elements/collection_theme.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbi… |
CVE-2021-41464 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitr… |
CVE-2021-41463 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in toos/permissions/dialogs/access/entity/types/group_combination.php in concrete5-legacy 5.6.4.0 and below allows rem… |
CVE-2021-41462 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitr… |
CVE-2021-41461 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitr… |
CVE-2021-40975 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in application/modules/admin/views/ecommerce/products.php in Ecommerce-CodeIgniter-Bootstrap (Codeigniter 3.1.11, Boot… |
CVE-2021-40973 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web scri… |
CVE-2021-40972 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web scri… |
CVE-2021-40971 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web scri… |
CVE-2021-40970 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web scri… |
CVE-2021-40969 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web scri… |
CVE-2021-40968 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web scri… |
CVE-2021-40928 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in index.php in FlexTV beta development version allows remote attackers to inject arbitrary web script or HTML via the… |
CVE-2021-40927 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in callback.php in Spotify-for-Alfred 0.13.9 and below allows remote attackers to inject arbitrary web script or HTML… |
CVE-2021-40926 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML… |
CVE-2021-40925 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject arbitrary web script… |
CVE-2021-40924 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2021-40923 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2021-40922 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2021-40921 | Medium | 6.1 | 2021-10-01 | Cross-site scripting (XSS) vulnerability in _contactform.inc.php in Detector 0.8.5 and below version allows remote attackers to inject arbitrary web script or… |
CVE-2021-41647 | Critical | 9.1 | 2021-10-01 | An un-authenticated error-based and time-based blind SQL injection vulnerability exists in Kaushik Jadhav Online Food Ordering Web App 1.0. An attacker can exp… |
CVE-2021-3825 | Critical | 9.6 | 2021-10-01 | On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. An attacker with an access to the confi… |
CVE-2021-29110 | Medium | 5.4 | 2021-10-01 | Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home a… |
CVE-2021-29109 | Medium | 6.1 | 2021-10-01 | A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link w… |
CVE-2021-29108 | High | 8.8 | 2021-10-01 | There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authe… |
CVE-2021-41649 | Critical | 9.8 | 2021-10-01 | An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. Using a post request d… |
CVE-2021-41648 | High | 7.5 | 2021-10-01 | An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId parameter. Using a post request does no… |
CVE-2021-40960 | Critical | 9.8 | 2021-10-01 | Galera WebTemplate 1.0 is affected by a directory traversal vulnerability that could reveal information from /etc/passwd and /etc/shadow. |
CVE-2021-41110 | Critical | 9.1 | 2021-10-01 | cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulner… |
CVE-2021-35297 | High | 7.8 | 2021-10-01 | Scalabium dBase Viewer version 2.6 (Build 5.751) is vulnerable to remote code execution via a crafted DBF file that triggers a buffer overflow. An attacker can… |
CVE-2021-41459 | High | 7.5 | 2021-10-01 | There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1008 in the nhmldmx_send_sample() function szXmlFrom parameter which leads to a den… |
CVE-2021-41457 | High | 7.5 | 2021-10-01 | There is a stack buffer overflow in MP4Box 1.1.0 at src/filters/dmx_nhml.c in nhmldmx_init_parsing which leads to a denial of service vulnerability. |
CVE-2021-41456 | High | 7.5 | 2021-10-01 | There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1004 in the nhmldmx_send_sample() function szXmlTo parameter which leads to a denia… |
CVE-2021-23893 | High | 8.8 | 2021-10-01 | Privilege Escalation vulnerability in a Windows system driver of McAfee Drive Encryption (DE) prior to 7.3.0 could allow a local non-admin user to gain elevate… |
CVE-2021-3747 | High | 8.8 | 2021-10-01 | The MacOS version of Multipass, version 1.7.0, fixed in 1.7.2, accidentally installed the application directory with incorrect owner. |
CVE-2021-3710 | Medium | 6.5 | 2021-10-01 | An information disclosure via path traversal was discovered in apport/hookutils.py function read_file(). This issue affects: apport 2.14.1 versions prior to 2… |
CVE-2021-3709 | Medium | 6.5 | 2021-10-01 | Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issu… |
CVE-2021-3626 | High | 8.8 | 2021-10-01 | The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating sys… |
CVE-2021-38675 | Medium | 5.4 | 2021-10-01 | A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Image2PDF. If exploited, this vulnerability allows remote attackers… |
CVE-2021-34356 | High | 7.6 | 2021-10-01 | A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows remote attack… |
CVE-2021-34355 | High | 7.6 | 2021-10-01 | A cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, this vulnerability allows remote attackers… |
CVE-2021-34354 | High | 7.6 | 2021-10-01 | A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows remote attack… |
CVE-2021-34352 | High | 7.2 | 2021-10-01 | A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arb… |
CVE-2021-33626 | High | 7.8 | 2021-10-01 | A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer… |
CVE-2021-41324 | Medium | 6.5 | 2021-09-30 | Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal files (or Cells files b… |
CVE-2021-41101 | Medium | 5.7 | 2021-09-30 | wire-server is an open-source back end for Wire, a secure collaboration platform. Before version 2.106.0, the CORS ` Access-Control-Allow-Origin ` header set b… |
CVE-2021-33583 | Critical | 9.8 | 2021-09-30 | REINER timeCard 6.05.07 installs a Microsoft SQL Server with an sa password that is hardcoded in the TCServer.jar file. |
CVE-2021-41325 | Medium | 6.5 | 2021-09-30 | Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter. (In addition, su… |
CVE-2021-41323 | Medium | 6.5 | 2021-09-30 | Directory traversal in the Compress feature in Pydio Cells 2.2.9 allows remote authenticated users to overwrite personal files, or Cells files belonging to any… |
CVE-2021-41288 | Critical | 9.8 | 2021-09-30 | Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API. |
CVE-2021-35205 | Medium | 5.4 | 2021-09-30 | NETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows URL redirection in redirector. |
CVE-2021-35204 | Medium | 5.4 | 2021-09-30 | NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Reflected Cross-Site Scripting (XSS) in the support endpoint. |
CVE-2021-35203 | Medium | 5.7 | 2021-09-30 | NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Arbitrary File Read operations via the FDSQueryService endpoint. |
CVE-2021-35202 | Medium | 4.3 | 2021-09-30 | NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Authorization Bypass (to access an endpoint) in FDSQueryService. |
CVE-2021-35201 | Medium | 6.5 | 2021-09-30 | NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks. |
CVE-2021-35200 | Medium | 4.8 | 2021-09-30 | NETSCOUT nGeniusONE 6.3.0 build 1196 allows high-privileged users to achieve Stored Cross-Site Scripting (XSS) in FDSQueryService. |
CVE-2021-35199 | Medium | 5.4 | 2021-09-30 | NETSCOUT nGeniusONE 6.3.0 build 1196 and earlier allows Stored Cross-Site Scripting (XSS) in UploadFile. |
CVE-2021-35198 | Medium | 5.4 | 2021-09-30 | NETSCOUT nGeniusONE 6.3.0 build 1004 and earlier allows Stored Cross-Site Scripting (XSS) in the Packet Analysis module. |
CVE-2021-29894 | High | 7.5 | 2021-09-30 | IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to dec… |
CVE-2021-20578 | Critical | 9.8 | 2021-09-30 | IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized actions due to improper or missing aut… |
CVE-2021-20554 | Medium | 6.1 | 2021-09-30 | IBM Sterling Order Management 9.4, 9.5, and 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t… |
CVE-2021-24017 | Medium | 5.4 | 2021-09-30 | An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via… |
CVE-2021-24016 | Low | 3.7 | 2021-09-30 | An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbit… |
CVE-2021-41109 | High | 7.5 | 2021-09-30 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) qu… |
CVE-2021-21089 | Low | 3.3 | 2021-09-30 | Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an out-of-bound… |
CVE-2021-41729 | Critical | 9.1 | 2021-09-30 | BaiCloud-cms v2.5.7 is affected by an arbitrary file deletion vulnerability, which allows an attacker to delete arbitrary files on the server through /user/pps… |
CVE-2021-41302 | High | 7.3 | 2021-09-30 | ECOA BAS controller stores sensitive data (backup exports) in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s… |
CVE-2021-41301 | Critical | 9.8 | 2021-09-30 | ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will e… |
CVE-2021-41300 | Critical | 9.8 | 2021-09-30 | ECOA BAS controller’s special page displays user account and passwords in plain text, thus unauthenticated attackers can access the page and obtain privilege w… |
CVE-2021-41299 | Critical | 9.8 | 2021-09-30 | ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers can obtain administrator’s privilege wit… |
CVE-2021-41298 | High | 8.8 | 2021-09-30 | ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied… |
CVE-2021-41297 | High | 8.8 | 2021-09-30 | ECOA BAS controller is vulnerable to weak access control mechanism allowing authenticated user to remotely escalate privileges by disclosing credentials of adm… |
CVE-2021-41296 | Critical | 9.8 | 2021-09-30 | ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the syst… |
CVE-2021-41295 | High | 8.8 | 2021-09-30 | ECOA BAS controller has a Cross-Site Request Forgery vulnerability, thus authenticated attacker can remotely place a forged request at a malicious web page and… |
CVE-2021-41294 | Critical | 9.1 | 2021-09-30 | ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Using the specific GET parameter, unauthenticated attackers… |
CVE-2021-41293 | High | 7.5 | 2021-09-30 | ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attacke… |
CVE-2021-41292 | Critical | 9.8 | 2021-09-30 | ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authenticatio… |
CVE-2021-41291 | High | 7.5 | 2021-09-30 | ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remo… |
CVE-2021-41290 | Critical | 9.8 | 2021-09-30 | ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely se… |
CVE-2021-41616 | Critical | 9.8 | 2021-09-30 | Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY, VARBINARY, LONGVAR… |
CVE-2021-25963 | Medium | 6.1 | 2021-09-30 | In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of arbitrary javascript code on a victim b… |
CVE-2021-41829 | High | 7.5 | 2021-09-30 | Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key. |
CVE-2021-41828 | High | 7.5 | 2021-09-30 | Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml. |
CVE-2021-41827 | High | 7.5 | 2021-09-30 | Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access. The credentials are in the source code that corresponds… |
CVE-2021-41826 | Medium | 6.1 | 2021-09-30 | PlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessions_controller.rb open redirect. |
CVE-2021-41824 | High | 8.8 | 2021-09-30 | Craft CMS before 3.7.14 allows CSV injection. |
CVE-2021-41821 | Medium | 6.5 | 2021-09-29 | Wazuh Manager in Wazuh through 4.1.5 is affected by a remote Integer Underflow vulnerability that might lead to denial of service. A crafted message must be se… |
CVE-2021-41034 | High | 8.1 | 2021-09-29 | The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such… |
CVE-2021-41795 | Medium | 6.5 | 2021-09-29 | The Safari app extension bundled with 1Password for Mac 7.7.0 through 7.8.x before 7.8.7 is vulnerable to authorization bypass. By targeting a vulnerable compo… |
CVE-2021-41764 | High | 8.8 | 2021-09-29 | A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3. The application does not have CSRF checks in place when perfor… |
CVE-2021-3653 | High | 8.8 | 2021-09-29 | A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provi… |
CVE-2021-39342 | Medium | 5.3 | 2021-09-29 | The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site… |
CVE-2021-35945 | High | 7.5 | 2021-09-29 | Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached. |
CVE-2021-35944 | High | 7.5 | 2021-09-29 | Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached. |
CVE-2021-35943 | Critical | 9.8 | 2021-09-29 | Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty password, per RFC45… |
CVE-2021-22947 | Medium | 5.9 | 2021-09-29 | When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and sen… |
CVE-2021-22946 | High | 7.5 | 2021-09-29 | A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command l… |
CVE-2021-41732 | High | 7.5 | 2021-09-29 | An issue was discovered in zeek version 4.1.0. There is a HTTP request splitting vulnerability that will invalidate any ZEEK HTTP based security analysis. NOTE… |
CVE-2021-41573 | High | 7.5 | 2021-09-29 | Hitachi Content Platform Anywhere (HCP-AW) 4.4.5 and later allows information disclosure. If authenticated user creates a link to a file or folder while the sy… |
CVE-2021-23446 | High | 7.5 | 2021-09-29 | The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Han… |