2021 CVEs (page 114)
Page 114 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-36165 | Medium | 5.3 | 2021-09-28 | RICON Industrial Cellular Router S9922L 16.10.3(3794) is affected by cleartext storage of sensitive information and sends username and password as base64. |
CVE-2021-33601 | High | 7.6 | 2021-09-28 | A vulnerability was discovered in the web user interface of F-Secure Internet Gatekeeper. An authenticated user can modify settings through the web user interf… |
CVE-2021-33600 | Medium | 5.4 | 2021-09-28 | A denial-of-service (DoS) vulnerability was discovered in the web user interface of F-Secure Internet Gatekeeper. The vulnerability occurs because of an attack… |
CVE-2021-37274 | High | 8.8 | 2021-09-27 | Kingdee KIS Professional Edition has a privilege escalation vulnerability. Attackers can use the vulnerability to gain computer administrator rights via unspec… |
CVE-2021-37270 | Critical | 9.8 | 2021-09-27 | There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0. Attackers can use this vulnerability to directly access th… |
CVE-2021-41098 | High | 7.5 | 2021-09-27 | Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX… |
CVE-2021-41096 | High | 7.5 | 2021-09-27 | Rucky is a USB HID Rubber Ducky Launch Pad for Android. Versions 2.2 and earlier for release builds and versions 425 and earlier for nightly builds suffer from… |
CVE-2021-41095 | Medium | 4.2 | 2021-09-27 | Discourse is an open source discussion platform. There is a cross-site scripting (XSS) vulnerability in versions 2.7.7 and earlier of the `stable` branch, vers… |
CVE-2021-41097 | Critical | 9.1 | 2021-09-27 | aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before… |
CVE-2021-20035 | Medium | 6.5 | 2021-09-27 | Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody… |
CVE-2021-20034 | Critical | 9.1 | 2021-09-27 | An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file po… |
CVE-2021-41753 | High | 7.5 | 2021-09-27 | A denial-of-service attack in WPA2, and WPA3-SAE authentication methods in D-Link DIR-X1560, v1.04B04, and DIR-X6060, v1.11B04 allows a remote unauthenticated… |
CVE-2021-41558 | Critical | 9.8 | 2021-09-27 | The set_user extension module before 3.0.0 for PostgreSQL allows ProcessUtility_hook bypass via set_config. |
CVE-2021-40329 | Critical | 9.8 | 2021-09-27 | The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management. |
CVE-2021-37761 | Critical | 9.8 | 2021-09-27 | Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to unrestricted file upload, leading to remote code execution. |
CVE-2021-36134 | High | 7.4 | 2021-09-27 | Out of bounds write vulnerability in the JPEG parsing code of Netop Vision Pro up to and including 9.7.2 allows an adjacent unauthenticated attacker to write t… |
CVE-2021-23445 | Low | 3.1 | 2021-09-27 | This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped. |
CVE-2021-40714 | Medium | 6.1 | 2021-09-27 | Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the accesskey parameter. If an a… |
CVE-2021-40713 | Medium | 5.9 | 2021-09-27 | Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a improper certificate validation vulnerability in the cold storage component. If an atta… |
CVE-2021-40712 | Medium | 6.5 | 2021-09-27 | Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a improper input validation vulnerability via the path parameter. An authenticated attack… |
CVE-2021-40711 | Medium | 5.4 | 2021-09-27 | Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a stored XSS vulnerability when creating Content Fragments. An authenticated attacker can… |
CVE-2021-40709 | High | 7.8 | 2021-09-27 | Adobe Photoshop versions 21.2.11 (and earlier) and 22.5 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted SVG file… |
CVE-2021-40703 | High | 7.8 | 2021-09-27 | Adobe Premiere Elements version 2021.2235820 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious m4a file, p… |
CVE-2021-40702 | High | 7.8 | 2021-09-27 | Adobe Premiere Elements version 2021.2235820 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious psd file, p… |
CVE-2021-40701 | High | 7.8 | 2021-09-27 | Adobe Premiere Elements version 2021.2235820 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious m4a file, p… |
CVE-2021-40700 | High | 7.8 | 2021-09-27 | Adobe Premiere Elements version 2021.2235820 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious TIFF file… |
CVE-2021-39828 | Medium | 5.8 | 2021-09-27 | Adobe Digital Editions 4.5.11.187646 (and earlier) are affected by a privilege escalation vulnerability in the Digital Editions installer. An authenticated att… |
CVE-2021-39827 | Medium | 6.5 | 2021-09-27 | Adobe Digital Editions 4.5.11.187646 (and earlier) are affected by an arbitrary file write vulnerability in the Digital Editions installer. An authenticated at… |
CVE-2021-39826 | High | 8.6 | 2021-09-27 | Adobe Digital Editions 4.5.11.187646 (and earlier) are affected by an arbitrary command execution vulnerability. An authenticated attacker could leverage this… |
CVE-2021-39825 | High | 7.8 | 2021-09-27 | Photoshop Elements versions 2021 build 19.0 (20210304.m.156367) (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitra… |
CVE-2021-39824 | High | 7.8 | 2021-09-27 | Adobe Premiere Elements version 2021.2235820 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious png file, p… |
CVE-2021-39823 | High | 7.8 | 2021-09-27 | Adobe svg-native-viewer 8182d14dfad5d1e10f53ed830328d7d9a3cfa96d and earlier versions are affected by a heap buffer overflow vulnerability due to insecure hand… |
CVE-2021-39819 | High | 7.8 | 2021-09-27 | Adobe InCopy version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious XML file, potentially resultin… |
CVE-2021-39818 | High | 7.8 | 2021-09-27 | Adobe InCopy version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious TIFF file, potentially resulti… |
CVE-2021-36880 | High | 8.6 | 2021-09-27 | Unauthenticated SQL Injection (SQLi) vulnerability in WordPress uListing plugin (versions <= 2.0.3), vulnerable parameter: custom. |
CVE-2021-36879 | Critical | 9.8 | 2021-09-27 | Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Possible if WordPress configuration allows user registrati… |
CVE-2021-36877 | Medium | 4.3 | 2021-09-27 | Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to modify user roles. |
CVE-2021-36876 | Medium | 5.4 | 2021-09-27 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WordPress uListing plugin (versions <= 2.0.5) as it lacks CSRF checks on plugin administration pa… |
CVE-2021-36875 | Medium | 5.9 | 2021-09-27 | Cross-site Scripting (XSS) vulnerability in Stylemix Directory Listings WordPress plugin – uListing allows Reflected XSS.This issue affects Directory Listings… |
CVE-2021-36874 | High | 7.1 | 2021-09-27 | Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5). |
CVE-2021-36845 | Medium | 6.9 | 2021-09-27 | Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.8, there are 46 vulnerable… |
CVE-2021-36841 | Medium | 6.9 | 2021-09-27 | Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.7, vulnerable parameter &yith_mainten… |
CVE-2021-28613 | High | 7.4 | 2021-09-27 | Adobe Creative Cloud Desktop Application version 5.4 (and earlier) is affected by a file handling vulnerability that could allow an attacker to arbitrarily ove… |
CVE-2021-24671 | Medium | 5.4 | 2021-09-27 | The MX Time Zone Clocks WordPress plugin before 3.4.1 does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcode, allowing users with a r… |
CVE-2021-24670 | Medium | 5.4 | 2021-09-27 | The CoolClock WordPress plugin before 4.3.5 does not escape some shortcode attributes, allowing users with a role as low as Contributor toperform Stored Cross-… |
CVE-2021-24666 | Critical | 9.8 | 2021-09-27 | The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds the rest route '/serv… |
CVE-2021-24661 | Medium | 4.3 | 2021-09-27 | The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with Contributor roles or higher to… |
CVE-2021-24660 | Medium | 5.4 | 2021-09-27 | The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with a role as low as Contributor t… |
CVE-2021-24659 | Medium | 5.4 | 2021-09-27 | The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting… |
CVE-2021-24652 | Medium | 6.5 | 2021-09-27 | The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax bas… |
CVE-2021-24643 | Medium | 5.4 | 2021-09-27 | The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor t… |
CVE-2021-24634 | Medium | 5.4 | 2021-09-27 | The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block (such as in… |
CVE-2021-24633 | Medium | 4.3 | 2021-09-27 | The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authenticated user, such… |
CVE-2021-24632 | Medium | 6.1 | 2021-09-27 | The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading… |
CVE-2021-24610 | Medium | 4.8 | 2021-09-27 | The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_string' function only re… |
CVE-2021-24569 | Medium | 4.8 | 2021-09-27 | The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.1.2 does not escape the value of its Button Text setting when outputting it in an attr… |
CVE-2021-37539 | Critical | 9.8 | 2021-09-27 | Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution. |
CVE-2021-36878 | Medium | 4.3 | 2021-09-27 | Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to update settings. |
CVE-2021-26587 | Medium | 6.5 | 2021-09-27 | A potential DOM-based Cross Site Scripting security vulnerability has been identified in HPE StoreOnce. The vulnerability could be remotely exploited to cause… |
CVE-2021-37786 | Medium | 4.6 | 2021-09-27 | Certain Federal Office of Information Technology Systems and Telecommunication FOITT products are affected by improper handling of exceptional conditions. This… |
CVE-2021-36219 | Critical | 9.8 | 2021-09-27 | An issue was discovered in SKALE sgxwallet 1.58.3. The provided input for ECALL 14 triggers a branch in trustedEcdsaSign that frees a non-initialized pointer f… |
CVE-2021-36218 | High | 7.5 | 2021-09-27 | An issue was discovered in SKALE sgxwallet 1.58.3. sgx_disp_ippsAES_GCMEncrypt allows an out-of-bounds write, resulting in a segfault and compromised enclave… |
CVE-2021-34416 | Critical | 9.8 | 2021-09-27 | The network address administrative settings web portal for the Zoom on-premise Meeting Connector before version 4.6.360.20210325, Zoom on-premise Meeting Conne… |
CVE-2021-34415 | High | 7.5 | 2021-09-27 | The Zone Controller service in the Zoom On-Premise Meeting Connector Controller before version 4.6.358.20210205 does not verify the cnt field sent in incoming… |
CVE-2021-34414 | High | 7.2 | 2021-09-27 | The network proxy page on the web portal for the Zoom on-premise Meeting Connector Controller before version 4.6.348.20201217, Zoom on-premise Meeting Connecto… |
CVE-2021-34413 | High | 7.5 | 2021-09-27 | All versions of the Zoom Plugin for Microsoft Outlook for MacOS before 5.3.52553.0918 contain a Time-of-check Time-of-use (TOC/TOU) vulnerability during the pl… |
CVE-2021-34412 | High | 7.8 | 2021-09-27 | During the installation process for all versions of the Zoom Client for Meetings for Windows before 5.4.0, it is possible to launch Internet Explorer. If the i… |
CVE-2021-34411 | High | 7.8 | 2021-09-27 | During the installation process forZoom Rooms for Conference Room for Windows before version 5.3.0 it is possible to launch Internet Explorer with elevated pri… |
CVE-2021-34410 | High | 7.8 | 2021-09-27 | A user-writable application bundle unpacked during the install for all versions of the Zoom Plugin for Microsoft Outlook for Mac before 5.0.25611.0521 allows f… |
CVE-2021-34409 | High | 7.8 | 2021-09-27 | It was discovered that the installation packages of the Zoom Client for Meetings for MacOS (Standard and for IT Admin) installation before version 5.2.0, Zoom… |
CVE-2021-34408 | High | 7.8 | 2021-09-27 | The Zoom Client for Meetings for Windows in all versions before version 5.3.2 writes log files to a user writable directory as a privileged user during the ins… |
CVE-2021-33907 | Critical | 9.8 | 2021-09-27 | The Zoom Client for Meetings for Windows in all versions before 5.3.0 fails to properly validate the certificate information used to sign .msi files when perfo… |
CVE-2021-22272 | Medium | 6.5 | 2021-09-27 | The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device… |
CVE-2021-40109 | Medium | 6.4 | 2021-09-27 | A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files fro… |
CVE-2021-40108 | High | 8.8 | 2021-09-27 | An issue was discovered in Concrete CMS through 8.5.5. The Calendar is vulnerable to CSRF. ccm_token is not verified on the ccm/calendar/dialogs/event/add/save… |
CVE-2021-3828 | High | 7.5 | 2021-09-27 | nltk is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-3822 | High | 7.5 | 2021-09-27 | jsoneditor is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-3820 | High | 7.5 | 2021-09-27 | inflect is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-3819 | High | 8.8 | 2021-09-27 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3818 | Medium | 5.3 | 2021-09-27 | grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking |
CVE-2021-3799 | Medium | 5.4 | 2021-09-27 | grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames |
CVE-2021-23243 | High | 7.8 | 2021-09-27 | In Oppo's battery application, the third-party SDK provides the function of loading a third-party Provider, which can be used. |
CVE-2021-40106 | Medium | 6.1 | 2021-09-27 | An issue was discovered in Concrete CMS through 8.5.5. There is unauthenticated stored XSS in blog comments via the website field. |
CVE-2021-40105 | Medium | 6.1 | 2021-09-27 | An issue was discovered in Concrete CMS through 8.5.5. There is XSS via Markdown Comments. |
CVE-2021-40104 | High | 7.5 | 2021-09-27 | An issue was discovered in Concrete CMS through 8.5.5. There is an SVG sanitizer bypass. |
CVE-2021-40103 | High | 7.5 | 2021-09-27 | An issue was discovered in Concrete CMS through 8.5.5. Path Traversal can lead to Arbitrary File Reading and SSRF. |
CVE-2021-40098 | Critical | 9.8 | 2021-09-27 | An issue was discovered in Concrete CMS through 8.5.5. Path Traversal leading to RCE via external form by adding a regular expression. |
CVE-2021-40097 | High | 8.8 | 2021-09-27 | An issue was discovered in Concrete CMS through 8.5.5. Authenticated path traversal leads to to remote code execution via uploaded PHP code, related to the bFi… |
CVE-2021-0660 | Medium | 4.9 | 2021-09-27 | In ccu, there is a possible out of bounds read due to incorrect error handling. This could lead to information disclosure with System execution privileges need… |
CVE-2021-0612 | High | 7.8 | 2021-09-27 | In m4u, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2021-0611 | High | 7.8 | 2021-09-27 | In m4u, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2021-0610 | High | 7.8 | 2021-09-27 | In memory management driver, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with no additio… |
CVE-2021-0425 | Medium | 5.5 | 2021-09-27 | In memory management driver, there is a possible side channel information disclosure. This could lead to local information disclosure with no additional execut… |
CVE-2021-0424 | Medium | 5.5 | 2021-09-27 | In memory management driver, there is a possible system crash due to a missing bounds check. This could lead to local denial of service with no additional exec… |
CVE-2021-0423 | Medium | 5.5 | 2021-09-27 | In memory management driver, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no addi… |
CVE-2021-0422 | Medium | 5.5 | 2021-09-27 | In memory management driver, there is a possible system crash due to a missing bounds check. This could lead to local denial of service with no additional exec… |
CVE-2021-0421 | Medium | 5.5 | 2021-09-27 | In memory management driver, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no… |
CVE-2021-23054 | Medium | 6.1 | 2021-09-27 | On version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (… |
CVE-2021-20317 | Medium | 4.4 | 2021-09-27 | A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timerqueue.c. This flaw… |
CVE-2021-34570 | High | 7.5 | 2021-09-27 | Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests. |