2021 CVEs (page 119)
Page 119 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-34573 | Medium | 6.2 | 2021-09-16 | In Enbra EWM in Version 1.7.29 together with several tested wireless M-Bus Sensors the events backflow and "no flow" are not reconized or misinterpreted. This… |
CVE-2021-34572 | Medium | 6.5 | 2021-09-16 | Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensor are replaced by t… |
CVE-2021-34571 | Medium | 6.5 | 2021-09-16 | Multiple Wireless M-Bus devices by Enbra use Hard-coded Credentials in Security mode 5 without an option to change the encryption key. An adversary can learn a… |
CVE-2021-40067 | Medium | 6.8 | 2021-09-16 | The access controls on the Mobility read-write API improperly validate user access permissions; this API is disabled by default. If the API is manually enabled… |
CVE-2021-40066 | Medium | 5.3 | 2021-09-16 | The access controls on the Mobility read-only API improperly validate user access permissions. Attackers with both network access to the API and valid credenti… |
CVE-2021-39128 | High | 7.2 | 2021-09-16 | Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to exe… |
CVE-2021-40881 | Critical | 9.8 | 2021-09-15 | An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code. |
CVE-2021-40639 | High | 7.5 | 2021-09-15 | Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js. |
CVE-2021-33045 | Critical | 9.8 | 2021-09-15 | The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by… |
CVE-2021-33044 | Critical | 9.8 | 2021-09-15 | The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by… |
CVE-2021-40862 | High | 8.8 | 2021-09-15 | HashiCorp Terraform Enterprise up to v202108-1 contained an API endpoint that erroneously disclosed a sensitive URL to authenticated parties, which could be us… |
CVE-2021-37913 | Critical | 9.8 | 2021-09-15 | The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers… |
CVE-2021-37912 | Critical | 9.8 | 2021-09-15 | The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting page. Remote attacke… |
CVE-2021-37909 | Critical | 9.8 | 2021-09-15 | WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus… |
CVE-2021-33705 | High | 8.1 | 2021-09-15 | The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forgery (SSRF) vulnerabil… |
CVE-2021-33704 | High | 8.8 | 2021-09-15 | The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be restricted to speci… |
CVE-2021-33701 | Critical | 9.1 | 2021-09-15 | DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCOR… |
CVE-2021-33700 | High | 7.8 | 2021-09-15 | SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the victim without knowi… |
CVE-2021-33698 | High | 8.8 | 2021-09-15 | SAP Business One, version - 10.0, allows an attacker with business authorization to upload any files (including script files) without the proper file format va… |
CVE-2021-33697 | Medium | 6.1 | 2021-09-15 | Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated attacker to redirect u… |
CVE-2021-33696 | Medium | 5.4 | 2021-09-15 | SAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode user controlled inputs and therefore an… |
CVE-2021-33695 | Critical | 9.1 | 2021-09-15 | Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validation of the certificate. |
CVE-2021-33694 | Medium | 4.8 | 2021-09-15 | SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Administrator rights, to include malicious c… |
CVE-2021-33693 | Medium | 6.8 | 2021-09-15 | SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject malicious codes that could potentially lead… |
CVE-2021-33692 | High | 7.5 | 2021-09-15 | SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup. This backup file can be tricked to inject special elements such as '..' and '/' s… |
CVE-2021-33691 | Medium | 6.1 | 2021-09-15 | NWDI Notification Service versions - 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabili… |
CVE-2021-33690 | Critical | 9.9 | 2021-09-15 | Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.2… |
CVE-2021-40966 | Medium | 5.4 | 2021-09-15 | A Stored XSS exists in TinyFileManager All version up to and including 2.4.6 in /tinyfilemanager.php when the server is given a file that contains HTML and jav… |
CVE-2021-40965 | High | 8.8 | 2021-09-15 | A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload files and run… |
CVE-2021-40964 | Medium | 6.5 | 2021-09-15 | A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload a file (with Admin credentials o… |
CVE-2021-39215 | High | 7.5 | 2021-09-15 | Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to valida… |
CVE-2021-39205 | Medium | 6.8 | 2021-09-15 | Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting proper… |
CVE-2021-29773 | Medium | 5.4 | 2021-09-15 | IBM Security Guardium 10.6 and 11.3 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure di… |
CVE-2021-29750 | High | 7.5 | 2021-09-15 | IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Forc… |
CVE-2021-28901 | Medium | 5.4 | 2021-09-15 | Multiple cross-site scripting (XSS) vulnerabilities exist in SITA Software Azur CMS 1.2.3.1 and earlier, which allows remote attackers to inject arbitrary web… |
CVE-2021-20433 | Medium | 6.5 | 2021-09-15 | IBM Security Guardium 11.3 could allow a an authenticated user to obtain sensitive information that could be used in further attacks against the system. IBM X-… |
CVE-2021-40238 | Medium | 6.1 | 2021-09-15 | A Cross Site Scriptiong (XSS) vulnerability exists in the admin panel in Webuzo < 2.9.0 via an HTTP request to a non-existent page, which is activated by admin… |
CVE-2021-40156 | High | 7.8 | 2021-09-15 | A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to write beyond allocated boundaries when parsing the DWG files. Thi… |
CVE-2021-40155 | High | 7.8 | 2021-09-15 | A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boundaries when parsing the DWG files. This… |
CVE-2021-3795 | High | 7.5 | 2021-09-15 | semver-regex is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-39392 | Critical | 9.8 | 2021-09-15 | The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for a… |
CVE-2021-39213 | Medium | 6.8 | 2021-09-15 | GLPI is a free Asset and IT management software package. Starting in version 9.1 and prior to version 9.5.6, GLPI with API Rest enabled is vulnerable to API by… |
CVE-2021-39211 | Medium | 5.3 | 2021-09-15 | GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint discloses GLPI and server i… |
CVE-2021-39210 | Medium | 6.5 | 2021-09-15 | GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a user uses the "remem… |
CVE-2021-37412 | Medium | 6.1 | 2021-09-15 | The TechRadar app 1.1 for Confluence Server allows XSS via the Title field of a Radar. |
CVE-2021-27046 | High | 7.8 | 2021-09-15 | A Memory Corruption vulnerability for PDF files in Autodesk Navisworks 2019, 2020, 2021, 2022 may lead to code execution through maliciously crafted DLL files. |
CVE-2021-27045 | High | 7.8 | 2021-09-15 | A maliciously crafted PDF file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boundaries when parsing the PDF file. This… |
CVE-2021-39209 | High | 8.8 | 2021-09-15 | GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site Request Forgery (CSR… |
CVE-2021-40157 | High | 7.8 | 2021-09-15 | A user may be tricked into opening a malicious FBX file which may exploit an Untrusted Pointer Dereference vulnerability in FBX’s Review version 1.5.0 and prio… |
CVE-2021-27044 | High | 7.8 | 2021-09-15 | A Out-Of-Bounds Read/Write Vulnerability in Autodesk FBX Review version 1.4.0 may lead to remote code execution through maliciously crafted DLL files or inform… |
CVE-2021-39189 | Medium | 5.3 | 2021-09-15 | Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password fun… |
CVE-2021-38156 | Medium | 5.4 | 2021-09-15 | In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard. |
CVE-2021-21798 | High | 7.8 | 2021-09-15 | An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause… |
CVE-2021-40845 | High | 8.8 | 2021-09-15 | The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/inde… |
CVE-2021-3801 | Medium | 6.5 | 2021-09-15 | prism is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-3797 | Critical | 9.8 | 2021-09-15 | hestiacp is vulnerable to Use of Wrong Operator in String Comparison |
CVE-2021-3796 | High | 7.3 | 2021-09-15 | vim is vulnerable to Use After Free |
CVE-2021-3794 | High | 7.5 | 2021-09-15 | vuelidate is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-39307 | Medium | 6.1 | 2021-09-15 | PDFTron's WebViewer UI 8.0 or below renders dangerous URLs as hyperlinks in supported documents, including JavaScript URLs, allowing the execution of arbitrary… |
CVE-2021-30137 | High | 7.7 | 2021-09-15 | Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possib… |
CVE-2021-27662 | High | 8.6 | 2021-09-15 | The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets. This issue affects Johnson… |
CVE-2021-41061 | Medium | 5.5 | 2021-09-15 | In RIOT-OS 2021.01, nonce reuse in 802.15.4 encryption in the ieee820154_security component allows attackers to break encryption by triggering reboots. |
CVE-2021-40448 | Medium | 6.3 | 2021-09-15 | Microsoft Accessibility Insights for Android Information Disclosure Vulnerability |
CVE-2021-40447 | High | 7.8 | 2021-09-15 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2021-40444 | High | 8.8 | 2021-09-15 | Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks th… |
CVE-2021-40440 | Medium | 5.4 | 2021-09-15 | Microsoft Dynamics Business Central Cross-site Scripting Vulnerability |
CVE-2021-3785 | Medium | 5.4 | 2021-09-15 | yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3783 | Medium | 6.1 | 2021-09-15 | yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3780 | Medium | 6.1 | 2021-09-15 | peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-38671 | High | 7.8 | 2021-09-15 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2021-38669 | Medium | 6.4 | 2021-09-15 | Microsoft Edge (Chromium-based) Tampering Vulnerability |
CVE-2021-38667 | High | 7.8 | 2021-09-15 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2021-38661 | High | 7.8 | 2021-09-15 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2021-38660 | High | 7.8 | 2021-09-15 | Microsoft Office Graphics Remote Code Execution Vulnerability |
CVE-2021-38659 | High | 7.8 | 2021-09-15 | Microsoft Office Graphics Remote Code Execution Vulnerability |
CVE-2021-38658 | High | 7.8 | 2021-09-15 | Microsoft Office Graphics Remote Code Execution Vulnerability |
CVE-2021-38657 | Medium | 6.1 | 2021-09-15 | Microsoft Office Graphics Component Information Disclosure Vulnerability |
CVE-2021-38656 | High | 7.8 | 2021-09-15 | Microsoft Word Remote Code Execution Vulnerability |
CVE-2021-38655 | High | 7.8 | 2021-09-15 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2021-38654 | High | 7.8 | 2021-09-15 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2021-38653 | High | 7.8 | 2021-09-15 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2021-38652 | High | 7.6 | 2021-09-15 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2021-38651 | High | 7.6 | 2021-09-15 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2021-38650 | High | 7.6 | 2021-09-15 | Microsoft Office Spoofing Vulnerability |
CVE-2021-38649 | High | 7.0 | 2021-09-15 | Open Management Infrastructure Elevation of Privilege Vulnerability |
CVE-2021-38648 | High | 7.8 | 2021-09-15 | Open Management Infrastructure Elevation of Privilege Vulnerability |
CVE-2021-38647 | Critical | 9.8 | 2021-09-15 | Open Management Infrastructure (OMI) Remote Code Execution Vulnerability |
CVE-2021-38646 | High | 7.8 | 2021-09-15 | Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability |
CVE-2021-38645 | High | 7.8 | 2021-09-15 | Open Management Infrastructure Elevation of Privilege Vulnerability |
CVE-2021-38644 | High | 7.8 | 2021-09-15 | Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability |
CVE-2021-38639 | High | 7.8 | 2021-09-15 | Win32k Elevation of Privilege Vulnerability |
CVE-2021-38638 | High | 7.8 | 2021-09-15 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
CVE-2021-38637 | Medium | 5.5 | 2021-09-15 | Windows Storage Information Disclosure Vulnerability |
CVE-2021-38636 | Medium | 5.5 | 2021-09-15 | Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability |
CVE-2021-38635 | Medium | 5.5 | 2021-09-15 | Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability |
CVE-2021-38634 | High | 7.1 | 2021-09-15 | Microsoft Windows Update Client Elevation of Privilege Vulnerability |
CVE-2021-38633 | High | 7.8 | 2021-09-15 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2021-38632 | Medium | 5.7 | 2021-09-15 | Windows BitLocker Security Feature Bypass Vulnerability |
CVE-2021-38630 | High | 7.8 | 2021-09-15 | Windows Event Tracing Elevation of Privilege Vulnerability |
CVE-2021-38629 | Medium | 6.5 | 2021-09-15 | Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability |