2021 CVEs (page 115)
Page 115 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-41580 | Medium | 5.3 | 2021-09-27 | The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use ca… |
CVE-2021-41385 | Medium | 6.5 | 2021-09-27 | The third party intelligence connector in Securonix SNYPR 6.3.1 Build 184295_0302 allows an authenticated user to obtain access to server configuration details… |
CVE-2021-41329 | Medium | 6.5 | 2021-09-27 | Datalust Seq before 2021.2.6259 allows users (with view filters applied to their accounts) to see query results not constrained by their view filter. This info… |
CVE-2021-40981 | High | 7.3 | 2021-09-27 | ASUS ROG Armoury Crate Lite before 4.2.10 allows local users to gain privileges by placing a Trojan horse file in the publicly writable %PROGRAMDATA%\ASUS\Gami… |
CVE-2021-40349 | Medium | 5.3 | 2021-09-27 | e7d Speed Test (aka speedtest) 0.5.3 allows a path-traversal attack that results in information disclosure via the "GET /.." substring. |
CVE-2021-38299 | Critical | 9.8 | 2021-09-27 | Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an… |
CVE-2021-31606 | High | 7.5 | 2021-09-27 | furlongm openvpn-monitor through 1.1.3 allows Authorization Bypass to disconnect arbitrary clients. |
CVE-2021-31605 | High | 7.5 | 2021-09-27 | furlongm openvpn-monitor through 1.1.3 allows %0a command injection via the OpenVPN management interface socket. This can shut down the server via signal%20SIG… |
CVE-2021-31604 | Medium | 6.5 | 2021-09-27 | furlongm openvpn-monitor through 1.1.3 allows CSRF to disconnect an arbitrary client. |
CVE-2021-34351 | Critical | 9.8 | 2021-09-27 | A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arb… |
CVE-2021-34349 | High | 7.2 | 2021-09-27 | A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arb… |
CVE-2021-34348 | Critical | 9.8 | 2021-09-27 | A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arb… |
CVE-2021-41617 | High | 7.0 | 2021-09-26 | sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not i… |
CVE-2021-3830 | Medium | 5.4 | 2021-09-26 | btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-21742 | Medium | 5.5 | 2021-09-25 | There is an information leak vulnerability in the message service app of a ZTE mobile phone. Due to improper parameter settings, attackers could use this vulne… |
CVE-2021-40655 | High | 7.5 | 2021-09-24 | An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request… |
CVE-2021-40654 | Medium | 6.5 | 2021-09-24 | An information disclosure issue exist in D-LINK-DIR-615 B2 2.01mt. An attacker can obtain a user name and password by forging a post request to the / getcfg.ph… |
CVE-2021-41504 | High | 8.0 | 2021-09-24 | An Elevated Privileges issue exists in D-Link DCS-5000L v1.05 and DCS-932L v2.17 and older. The use of the digest-authentication for the devices command interf… |
CVE-2021-41503 | High | 8.0 | 2021-09-24 | DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Control. The use of the basic authentication for the devices command interface all… |
CVE-2021-39246 | Medium | 6.1 | 2021-09-24 | Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion addresses. Exact timestamp… |
CVE-2021-2464 | High | 7.8 | 2021-09-24 | Vulnerability in Oracle Linux (component: OSwatcher). Supported versions that are affected are 7 and 8. Easily exploitable vulnerability allows low privileged… |
CVE-2021-22869 | Critical | 9.8 | 2021-09-24 | An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner group it should not have had acc… |
CVE-2021-22868 | Medium | 4.3 | 2021-09-24 | A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configurat… |
CVE-2021-40310 | Medium | 5.4 | 2021-09-24 | OpenSIS Community Edition version 8.0 is affected by a cross-site scripting (XSS) vulnerability in the TakeAttendance.php via the cp_id_miss_attn parameter. |
CVE-2021-40309 | High | 8.8 | 2021-09-24 | A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0. allows an attacker to inject their own SQL query. The cp_id_m… |
CVE-2021-28130 | High | 7.8 | 2021-09-24 | Dr.Web Firewall 12.5.2.4160 on Windows incorrectly restricts applications signed by Dr.Web. A DLL for a custom payload within a legitimate binary (e.g., frwl_s… |
CVE-2021-41588 | High | 8.1 | 2021-09-24 | In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. The attacker must have the encryption and… |
CVE-2021-41587 | High | 7.5 | 2021-09-24 | In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other resources. |
CVE-2021-41586 | High | 7.5 | 2021-09-24 | In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password. |
CVE-2021-40102 | Critical | 9.1 | 2021-09-24 | An issue was discovered in Concrete CMS through 8.5.5. Arbitrary File deletion can occur via PHAR deserialization in is_dir (PHP Object Injection associated wi… |
CVE-2021-40100 | Medium | 5.4 | 2021-09-24 | An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text. |
CVE-2021-40099 | High | 7.2 | 2021-09-24 | An issue was discovered in Concrete CMS through 8.5.5. Fetching the update json scheme over HTTP leads to remote code execution. |
CVE-2021-36749 | Medium | 6.5 | 2021-09-24 | In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to… |
CVE-2021-41584 | High | 7.5 | 2021-09-24 | Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sensitive build/configuration details) via a… |
CVE-2021-41583 | Medium | 6.5 | 2021-09-24 | vpn-user-portal (aka eduVPN or Let's Connect!) before 2.3.14, as packaged for Debian 10, Debian 11, and Fedora, allows remote authenticated users to obtain OS… |
CVE-2021-41581 | Medium | 5.5 | 2021-09-24 | x509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL through 3.4.0 has a stack-based buffer over-read. When the input exceeds DO… |
CVE-2021-31923 | Medium | 5.3 | 2021-09-24 | Ping Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation. |
CVE-2021-41088 | High | 8.0 | 2021-09-23 | Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (started by `elvish -web… |
CVE-2021-38877 | Medium | 5.4 | 2021-09-23 | IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in th… |
CVE-2021-38870 | Medium | 5.4 | 2021-09-23 | IBM Aspera Cloud is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering t… |
CVE-2021-29905 | Medium | 5.4 | 2021-09-23 | IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to cross-site scripting. This vulnerability allows users to embed arb… |
CVE-2021-29904 | Medium | 5.5 | 2021-09-23 | IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI displays user credentials in plain clear text which can be read by a local user. IB… |
CVE-2021-29833 | Medium | 5.4 | 2021-09-23 | IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to em… |
CVE-2021-29832 | Medium | 5.4 | 2021-09-23 | IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to em… |
CVE-2021-29816 | Medium | 6.5 | 2021-09-23 | IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to cross-site request forgery which could allow an attacker to execut… |
CVE-2021-29815 | Medium | 5.4 | 2021-09-23 | IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to em… |
CVE-2021-29814 | Medium | 5.4 | 2021-09-23 | IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to em… |
CVE-2021-29813 | Medium | 5.4 | 2021-09-23 | IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to em… |
CVE-2021-29812 | Medium | 5.4 | 2021-09-23 | IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to em… |
CVE-2021-29810 | Medium | 5.4 | 2021-09-23 | IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to em… |
CVE-2021-38864 | High | 7.5 | 2021-09-23 | IBM Security Verify Bridge 1.0.5.0 could allow a user to obtain sensitive information due to improper certificate validation. IBM X-Force ID: 208155. |
CVE-2021-38863 | Medium | 5.5 | 2021-09-23 | IBM Security Verify Bridge 1.0.5.0 stores user credentials in plain clear text which can be read by a locally authenticated user. IBM X-Force ID: 208154. |
CVE-2021-36873 | Medium | 5.5 | 2021-09-23 | Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress iQ Block Country plugin (versions <= 1.2.11). Vulnerable parameter: &blockcountr… |
CVE-2021-36823 | Medium | 6.6 | 2021-09-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cusmin AGCA - Absolutely Glamorous Custom Admin (WordPres… |
CVE-2021-29800 | Medium | 5.4 | 2021-09-23 | IBM Tivoli Netcool/OMNIbus_GUI and IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to em… |
CVE-2021-26794 | Critical | 9.8 | 2021-09-23 | Privilege escalation in 'upload.php' in FrogCMS SentCMS v0.9.5 allows attacker to execute arbitrary code via crafted php file. |
CVE-2021-22276 | Medium | 6.1 | 2021-09-23 | The vulnerability allows a successful attacker to bypass the integrity check of FW uploaded to the free@home System Access Point. |
CVE-2021-20563 | Medium | 4.3 | 2021-09-23 | IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 could allow a remote authenciated user to obtain sensitive information. By sending a specially crafted reques… |
CVE-2021-20485 | Medium | 4.3 | 2021-09-23 | IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is retu… |
CVE-2021-20484 | Medium | 5.4 | 2021-09-23 | IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2021-20435 | Medium | 5.5 | 2021-09-23 | IBM Security Verify Bridge 1.0.5.0 does not properly validate a certificate which could allow a local attacker to obtain sensitive information that could aid i… |
CVE-2021-20434 | Medium | 4.4 | 2021-09-23 | IBM Security Verify Bridge 1.0.5.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 196346. |
CVE-2021-20377 | Low | 2.7 | 2021-09-23 | IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. Th… |
CVE-2021-41381 | High | 7.5 | 2021-09-23 | Payara Micro Community 5.2021.6 and below allows Directory Traversal. |
CVE-2021-3824 | Medium | 6.1 | 2021-09-23 | OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL. |
CVE-2021-36872 | Medium | 5.5 | 2021-09-23 | Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress Popular Posts plugin (versions <= 5.3.3). Vulnerable at &widget-wpp[2][post_type… |
CVE-2021-26750 | High | 7.8 | 2021-09-23 | DLL hijacking in Panda Agent <=1.16.11 in Panda Security, S.L.U. Panda Adaptive Defense 360 <= 8.0.17 allows attacker to escalate privileges via maliciously cr… |
CVE-2021-21913 | Critical | 9.8 | 2021-09-23 | An information disclosure vulnerability exists in the WiFi Smart Mesh functionality of D-LINK DIR-3040 1.13B03. A specially-crafted network request can lead to… |
CVE-2021-32999 | High | 7.5 | 2021-09-23 | Improper handling of exceptional conditions in SuiteLink server while processing command 0x01 |
CVE-2021-32987 | High | 7.5 | 2021-09-23 | Null pointer dereference in SuiteLink server while processing command 0x0b |
CVE-2021-32979 | High | 7.5 | 2021-09-23 | Null pointer dereference in SuiteLink server while processing commands 0x04/0x0a |
CVE-2021-32971 | High | 7.5 | 2021-09-23 | Null pointer dereference in SuiteLink server while processing command 0x07 |
CVE-2021-32963 | High | 7.5 | 2021-09-23 | Null pointer dereference in SuiteLink server while processing commands 0x03/0x10 |
CVE-2021-32959 | High | 8.1 | 2021-09-23 | Heap-based buffer overflow in SuiteLink server while processing commands 0x05/0x06 |
CVE-2021-22953 | Medium | 5.4 | 2021-09-23 | A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to UI inconvenience, and exhaustion of disk space.Credit for d… |
CVE-2021-22952 | High | 8.8 | 2021-09-23 | A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to subsequently contro… |
CVE-2021-22950 | Medium | 6.5 | 2021-09-23 | Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to be deleted.Credit for discovery: "Solar Se… |
CVE-2021-22949 | Medium | 5.4 | 2021-09-23 | A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to duplicate files which can lead to UI inconvenience, and exhaustion of disk space.Credit fo… |
CVE-2021-22948 | High | 7.1 | 2021-09-23 | Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure uniqid() PHP function. Under some circumstan… |
CVE-2021-22945 | Critical | 9.1 | 2021-09-23 | When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and bo… |
CVE-2021-22941 | Critical | 9.8 | 2021-09-23 | Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zo… |
CVE-2021-22020 | Medium | 5.5 | 2021-09-23 | The vCenter Server contains a denial-of-service vulnerability in the Analytics service. Successful exploitation of this issue may allow an attacker to create a… |
CVE-2021-22019 | High | 7.5 | 2021-09-23 | The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 5480 on vCenter Serv… |
CVE-2021-22018 | Medium | 6.5 | 2021-09-23 | The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in. A malicious actor with network access to p… |
CVE-2021-22017 | Medium | 5.3 | 2021-09-23 | Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port… |
CVE-2021-22016 | Medium | 6.1 | 2021-09-23 | The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. An attacker may exploit this issue to execute m… |
CVE-2021-22015 | High | 7.8 | 2021-09-23 | The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local us… |
CVE-2021-22014 | High | 7.2 | 2021-09-23 | The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure). An authenticated VAMI user wit… |
CVE-2021-22013 | High | 7.5 | 2021-09-23 | The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API. A malicious actor with netwo… |
CVE-2021-22012 | High | 7.5 | 2021-09-23 | The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor with network access t… |
CVE-2021-22011 | Medium | 5.3 | 2021-09-23 | vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library. A malicious actor with network access to port 443 on v… |
CVE-2021-22010 | High | 7.5 | 2021-09-23 | The vCenter Server contains a denial-of-service vulnerability in VPXD service. A malicious actor with network access to port 443 on vCenter Server may exploit… |
CVE-2021-22009 | High | 7.5 | 2021-09-23 | The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCen… |
CVE-2021-22008 | High | 7.5 | 2021-09-23 | The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter… |
CVE-2021-22007 | Medium | 5.5 | 2021-09-23 | The vCenter Server contains a local information disclosure vulnerability in the Analytics service. An authenticated user with non-administrative privilege may… |
CVE-2021-22006 | High | 7.5 | 2021-09-23 | The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI. A malicious actor with network access to port 443… |
CVE-2021-22005 | Critical | 9.8 | 2021-09-23 | The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Serve… |
CVE-2021-21993 | Medium | 6.5 | 2021-09-23 | The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server Content Library. An author… |
CVE-2021-33035 | High | 7.8 | 2021-09-23 | Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data… |
CVE-2021-34770 | Critical | 10.0 | 2021-09-23 | A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9000 Family… |