2021 CVEs (page 116)
Page 116 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-34769 | High | 8.6 | 2021-09-23 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 900… |
CVE-2021-34768 | High | 8.6 | 2021-09-23 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 900… |
CVE-2021-34767 | High | 7.4 | 2021-09-23 | A vulnerability in IPv6 traffic processing of Cisco IOS XE Wireless Controller Software for Cisco Catalyst 9000 Family Wireless Controllers could allow an unau… |
CVE-2021-34740 | High | 7.4 | 2021-09-23 | A vulnerability in the WLAN Control Protocol (WCP) implementation for Cisco Aironet Access Point (AP) software could allow an unauthenticated, adjacent attacke… |
CVE-2021-34729 | Medium | 6.7 | 2021-09-23 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software and Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands… |
CVE-2021-34727 | Critical | 9.8 | 2021-09-23 | A vulnerability in the vDaemon process in Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affecte… |
CVE-2021-34726 | Medium | 6.7 | 2021-09-23 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root-level pr… |
CVE-2021-34725 | Medium | 6.7 | 2021-09-23 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root-l… |
CVE-2021-34724 | Medium | 6.0 | 2021-09-23 | A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to elevate privileges and execute arbitrary code on the un… |
CVE-2021-34723 | Medium | 6.7 | 2021-09-23 | A vulnerability in a specific CLI command that is run on Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files… |
CVE-2021-34714 | High | 7.4 | 2021-09-23 | A vulnerability in the Unidirectional Link Detection (UDLD) feature of Cisco FXOS Software, Cisco IOS Software, Cisco IOS XE Software, Cisco IOS XR Software, a… |
CVE-2021-34712 | Medium | 5.4 | 2021-09-23 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct cypher query la… |
CVE-2021-34705 | Medium | 5.3 | 2021-09-23 | A vulnerability in the Voice Telephony Service Provider (VTSP) service of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote a… |
CVE-2021-34703 | Medium | 6.8 | 2021-09-23 | A vulnerability in the Link Layer Discovery Protocol (LLDP) message parser of Cisco IOS Software and Cisco IOS XE Software could allow an attacker to trigger a… |
CVE-2021-34699 | High | 7.7 | 2021-09-23 | A vulnerability in the TrustSec CLI parser of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to… |
CVE-2021-34697 | Medium | 5.8 | 2021-09-23 | A vulnerability in the Protection Against Distributed Denial of Service Attacks feature of Cisco IOS XE Software could allow an unauthenticated, remote attacke… |
CVE-2021-34696 | Medium | 5.8 | 2021-09-23 | A vulnerability in the access control list (ACL) programming of Cisco ASR 900 and ASR 920 Series Aggregation Services Routers could allow an unauthenticated, r… |
CVE-2021-1625 | Medium | 5.8 | 2021-09-23 | A vulnerability in the Zone-Based Policy Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent the Zone-Based Po… |
CVE-2021-1624 | High | 8.6 | 2021-09-23 | A vulnerability in the Rate Limiting Network Address Translation (NAT) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to caus… |
CVE-2021-1623 | High | 7.7 | 2021-09-23 | A vulnerability in the Simple Network Management Protocol (SNMP) punt handling function of Cisco cBR-8 Converged Broadband Routers could allow an authenticated… |
CVE-2021-1622 | High | 8.6 | 2021-09-23 | A vulnerability in the Common Open Policy Service (COPS) of Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated, r… |
CVE-2021-1621 | High | 7.4 | 2021-09-23 | A vulnerability in the Layer 2 punt code of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a queue wedge on an interface that… |
CVE-2021-1620 | High | 7.7 | 2021-09-23 | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) support for the AutoReconnect feature of Cisco IOS Software and Cisco IOS XE Software could allo… |
CVE-2021-1619 | Critical | 9.8 | 2021-09-23 | A vulnerability in the authentication, authorization, and accounting (AAA) function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to… |
CVE-2021-1616 | Medium | 4.7 | 2021-09-23 | A vulnerability in the H.323 application level gateway (ALG) used by the Network Address Translation (NAT) feature of Cisco IOS XE Software could allow an unau… |
CVE-2021-1615 | High | 8.6 | 2021-09-23 | A vulnerability in the packet processing functionality of Cisco Embedded Wireless Controller (EWC) Software for Catalyst Access Points (APs) could allow an una… |
CVE-2021-1612 | Medium | 5.5 | 2021-09-23 | A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to overwrite arbitrary files on the local system. This vul… |
CVE-2021-1611 | High | 8.6 | 2021-09-23 | A vulnerability in Ethernet over GRE (EoGRE) packet processing of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9800 Family Wireless Control… |
CVE-2021-1589 | Medium | 6.5 | 2021-09-23 | A vulnerability in the disaster recovery feature of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain unauthorized access to… |
CVE-2021-1565 | High | 8.6 | 2021-09-23 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 900… |
CVE-2021-1546 | Medium | 5.5 | 2021-09-23 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information. This vulnerability is due to… |
CVE-2021-1419 | High | 7.8 | 2021-09-23 | A vulnerability in the SSH management feature of multiple Cisco Access Points (APs) platforms could allow a local, authenticated user to modify files on the af… |
CVE-2021-21992 | Medium | 6.5 | 2021-09-22 | The vCenter Server contains a denial-of-service vulnerability due to improper XML entity parsing. A malicious actor with non-administrative user access to the… |
CVE-2021-21991 | High | 7.8 | 2021-09-22 | The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens. A malicious actor with non-administrative user… |
CVE-2021-34648 | Medium | 6.4 | 2021-09-22 | The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php… |
CVE-2021-34647 | Medium | 6.5 | 2021-09-22 | The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Subm… |
CVE-2021-40684 | Critical | 9.1 | 2021-09-22 | Talend ESB Runtime in all versions from 5.1 to 7.3.1-R2021-09, 7.2.1-R2021-09, 7.1.1-R2021-09, has an unauthenticated Jolokia HTTP endpoint which allows remote… |
CVE-2021-37860 | Low | 3.7 | 2021-09-22 | Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product… |
CVE-2021-41011 | High | 7.5 | 2021-09-22 | LINE client for iOS before 11.15.0 might expose authentication information for a certain service to external entities under certain conditions. This is usually… |
CVE-2021-40875 | High | 7.5 | 2021-09-22 | Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on t… |
CVE-2021-37927 | Critical | 9.8 | 2021-09-22 | Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO. |
CVE-2021-37925 | Critical | 9.8 | 2021-09-22 | Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability. |
CVE-2021-31847 | High | 8.2 | 2021-09-22 | Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloadin… |
CVE-2021-31841 | High | 8.2 | 2021-09-22 | A DLL sideloading vulnerability in McAfee Agent for Windows prior to 5.7.4 could allow a local user to perform a DLL sideloading attack with an unsigned DLL wi… |
CVE-2021-31836 | Medium | 5.6 | 2021-09-22 | Improper privilege management vulnerability in maconfig for McAfee Agent for Windows prior to 5.7.4 allows a local user to gain access to sensitive information… |
CVE-2021-39404 | Medium | 4.8 | 2021-09-22 | MaianAffiliate v1.0 allows an authenticated administrative user to save an XSS to the database. |
CVE-2021-36260 | Critical | 9.8 | 2021-09-22 | A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability… |
CVE-2021-3583 | High | 7.1 | 2021-09-22 | A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user… |
CVE-2021-39339 | Medium | 5.8 | 2021-09-22 | The Telefication WordPress plugin is vulnerable to Open Proxy and Server-Side Request Forgery via the ~/bypass.php file due to a user-supplied URL request valu… |
CVE-2021-38153 | Medium | 5.9 | 2021-09-22 | Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such… |
CVE-2021-38112 | High | 8.8 | 2021-09-22 | In the Amazon AWS WorkSpaces client 3.0.10 through 3.1.8 on Windows, argument injection in the workspaces:// URI handler can lead to remote code execution beca… |
CVE-2021-31819 | Critical | 9.8 | 2021-09-22 | In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other bas… |
CVE-2021-41382 | High | 7.5 | 2021-09-22 | Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface. |
CVE-2021-41087 | Medium | 5.6 | 2021-09-21 | in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing… |
CVE-2021-41086 | High | 8.7 | 2021-09-21 | jsuites is an open source collection of common required javascript web components. In affected versions users are subject to cross site scripting (XSS) attacks… |
CVE-2021-41084 | High | 8.7 | 2021-09-21 | http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted… |
CVE-2021-40847 | High | 8.1 | 2021-09-21 | The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a Mit… |
CVE-2021-40868 | Medium | 6.1 | 2021-09-21 | In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS. |
CVE-2021-39230 | High | 8.8 | 2021-09-21 | Butter is a system usability utility. Due to a kernel error the JPNS kernel is being discontinued. Affected users are recommend to update to the Trinity kernel… |
CVE-2021-23444 | Medium | 5.6 | 2021-09-21 | This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the pa… |
CVE-2021-23443 | Medium | 5.4 | 2021-09-21 | This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an arra… |
CVE-2021-29831 | High | 8.1 | 2021-09-21 | IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to an XML External Entity Injection (XXE) attack when processing XML… |
CVE-2021-29795 | Medium | 6.0 | 2021-09-21 | IBM PowerVM Hypervisor FW860, FW930, FW940, and FW950 could allow a local user to create a specially crafted sequence of hypervisor calls from a partition that… |
CVE-2021-41525 | Medium | 5.5 | 2021-09-21 | An issue related to modification of otherwise restricted files through a locally authenticated attacker exists in FlexNet inventory agent and inventory beacon… |
CVE-2021-41531 | High | 7.5 | 2021-09-21 | NLnet Labs Routinator prior to 0.10.0 produces invalid RTR payload if an RPKI CA uses too large values in the max-length parameter in a ROA. This will lead to… |
CVE-2021-37741 | High | 8.8 | 2021-09-21 | ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities. |
CVE-2021-37424 | Critical | 9.8 | 2021-09-21 | ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover. |
CVE-2021-37420 | Medium | 6.5 | 2021-09-21 | Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing. |
CVE-2021-37419 | High | 7.5 | 2021-09-21 | Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF. |
CVE-2021-28960 | Critical | 9.8 | 2021-09-21 | Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand oper… |
CVE-2021-0869 | Critical | 9.8 | 2021-09-21 | In GetTimeStampAndPkt of DumpstateDevice.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code executio… |
CVE-2021-31917 | Critical | 9.8 | 2021-09-21 | A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all… |
CVE-2021-26333 | Medium | 5.5 | 2021-09-21 | An information disclosure vulnerability exists in AMD Platform Security Processor (PSP) chipset driver. The discretionary access control list (DACL) may allow… |
CVE-2021-20829 | Medium | 6.1 | 2021-09-21 | Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary… |
CVE-2021-20037 | High | 7.8 | 2021-09-21 | SonicWall Global VPN Client 4.10.5 installer (32-bit and 64-bit) incorrect default file permission vulnerability leads to privilege escalation which potentiall… |
CVE-2021-41083 | High | 8.0 | 2021-09-20 | Dada Mail is a web-based e-mail list management system. In affected versions a bad actor could give someone a carefully crafted web page via email, SMS, etc, t… |
CVE-2021-39229 | High | 7.5 | 2021-09-20 | Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. In affected versio… |
CVE-2021-41082 | High | 7.5 | 2021-09-20 | Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed t… |
CVE-2021-34650 | Medium | 5.4 | 2021-09-20 | The eID Easy WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error parameter found in the ~/admin.php file which allows attackers to i… |
CVE-2021-39325 | Medium | 6.1 | 2021-09-20 | The OptinMonster WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input validation in the load_previews function found in t… |
CVE-2021-32838 | High | 7.5 | 2021-09-20 | Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expressio… |
CVE-2021-38899 | Medium | 4.4 | 2021-09-20 | IBM Cloud Pak for Data 2.5 could allow a local user with special privileges to obtain highly sensitive information. IBM X-Force ID: 209575. |
CVE-2021-32839 | High | 7.5 | 2021-09-20 | sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vul… |
CVE-2021-29856 | Medium | 6.5 | 2021-09-20 | IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 could allow an authenticated usre to cause a denial of service through the WebGUI Map Creation page. IBM X-Force ID: 20568… |
CVE-2021-29821 | Medium | 5.4 | 2021-09-20 | IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr… |
CVE-2021-29820 | Medium | 5.4 | 2021-09-20 | IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr… |
CVE-2021-29819 | Medium | 5.4 | 2021-09-20 | IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr… |
CVE-2021-29818 | Medium | 5.4 | 2021-09-20 | IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr… |
CVE-2021-29817 | Medium | 5.4 | 2021-09-20 | IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr… |
CVE-2021-29811 | Medium | 4.9 | 2021-09-20 | IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 stores user credentials in plain clear text which can be read by an authenticated admi… |
CVE-2021-29809 | Medium | 5.4 | 2021-09-20 | IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed… |
CVE-2021-29808 | Medium | 5.4 | 2021-09-20 | IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed… |
CVE-2021-29807 | Medium | 5.4 | 2021-09-20 | IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed… |
CVE-2021-29806 | Medium | 5.4 | 2021-09-20 | IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed… |
CVE-2021-25741 | High | 8.8 | 2021-09-20 | A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside o… |
CVE-2021-25740 | Low | 3.1 | 2021-09-20 | A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a conf… |
CVE-2021-39598 | Medium | 5.5 | 2021-09-20 | An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function callcode() located in code.c. It allows an attacker to… |
CVE-2021-39597 | Medium | 5.5 | 2021-09-20 | An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function code_dump2() located in code.c. It allows an attacker t… |
CVE-2021-39596 | Medium | 5.5 | 2021-09-20 | An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function code_parse() located in code.c. It allows an attacker t… |
CVE-2021-39595 | High | 7.8 | 2021-09-20 | An issue was discovered in swftools through 20200710. A stack-buffer-overflow exists in the function rfx_alloc() located in mem.c. It allows an attacker to cau… |