2021 CVEs (page 120)
Page 120 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-38628 | High | 7.8 | 2021-09-15 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
CVE-2021-38626 | High | 7.8 | 2021-09-15 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2021-38625 | High | 7.8 | 2021-09-15 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2021-38624 | Medium | 6.5 | 2021-09-15 | Windows Key Storage Provider Security Feature Bypass Vulnerability |
CVE-2021-36975 | High | 7.8 | 2021-09-15 | Win32k Elevation of Privilege Vulnerability |
CVE-2021-36974 | High | 7.8 | 2021-09-15 | Windows SMB Elevation of Privilege Vulnerability |
CVE-2021-36973 | High | 7.8 | 2021-09-15 | Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability |
CVE-2021-36972 | Medium | 5.5 | 2021-09-15 | Windows SMB Information Disclosure Vulnerability |
CVE-2021-36969 | Medium | 5.5 | 2021-09-15 | Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability |
CVE-2021-36968 | High | 7.8 | 2021-09-15 | Windows DNS Elevation of Privilege Vulnerability |
CVE-2021-36967 | High | 8.0 | 2021-09-15 | Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability |
CVE-2021-36966 | High | 7.8 | 2021-09-15 | Windows Subsystem for Linux Elevation of Privilege Vulnerability |
CVE-2021-36965 | High | 8.8 | 2021-09-15 | Windows WLAN AutoConfig Service Remote Code Execution Vulnerability |
CVE-2021-36964 | High | 7.8 | 2021-09-15 | Windows Event Tracing Elevation of Privilege Vulnerability |
CVE-2021-36963 | High | 7.8 | 2021-09-15 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2021-36962 | Medium | 5.5 | 2021-09-15 | Windows Installer Information Disclosure Vulnerability |
CVE-2021-36961 | Medium | 5.5 | 2021-09-15 | Windows Installer Denial of Service Vulnerability |
CVE-2021-36960 | High | 7.5 | 2021-09-15 | Windows SMB Information Disclosure Vulnerability |
CVE-2021-36959 | Medium | 5.5 | 2021-09-15 | Windows Authenticode Spoofing Vulnerability |
CVE-2021-36956 | Medium | 4.4 | 2021-09-15 | Azure Sphere Information Disclosure Vulnerability |
CVE-2021-36955 | High | 7.8 | 2021-09-15 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2021-36954 | High | 8.8 | 2021-09-15 | Windows Bind Filter Driver Elevation of Privilege Vulnerability |
CVE-2021-36952 | High | 7.8 | 2021-09-15 | Visual Studio Remote Code Execution Vulnerability |
CVE-2021-26437 | Medium | 5.5 | 2021-09-15 | Visual Studio Code Spoofing Vulnerability |
CVE-2021-26435 | High | 8.1 | 2021-09-15 | Windows Scripting Engine Memory Corruption Vulnerability |
CVE-2021-26434 | High | 7.8 | 2021-09-15 | Visual Studio Elevation of Privilege Vulnerability |
CVE-2021-22149 | High | 8.8 | 2021-09-15 | Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using… |
CVE-2021-22148 | High | 8.8 | 2021-09-15 | Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to the same engines as their creator. This… |
CVE-2021-22147 | Medium | 6.5 | 2021-09-15 | Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to… |
CVE-2021-3778 | High | 7.8 | 2021-09-15 | vim is vulnerable to Heap-based Buffer Overflow |
CVE-2021-3777 | High | 7.5 | 2021-09-15 | nodejs-tmpl is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-3751 | Critical | 9.8 | 2021-09-15 | libmobi is vulnerable to Out-of-bounds Write |
CVE-2021-3706 | High | 7.5 | 2021-09-15 | adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag |
CVE-2021-23029 | High | 8.8 | 2021-09-14 | On version 16.0.x before 16.0.1.2, insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side Request Forgery (S… |
CVE-2021-23027 | Medium | 6.1 | 2021-09-14 | On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, and 14.1.x before 14.1.4.3, a DOM based cross-site scripting (XSS) vulnerability exists in an undisc… |
CVE-2021-23026 | High | 8.8 | 2021-09-14 | BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x and all vers… |
CVE-2021-23030 | High | 7.5 | 2021-09-14 | On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions… |
CVE-2021-23028 | High | 7.5 | 2021-09-14 | On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs… |
CVE-2021-23025 | High | 8.8 | 2021-09-14 | On version 15.1.x before 15.1.0.5, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all versions of 12.1.x and 11.6.x, an authenticated remote command execu… |
CVE-2021-23036 | High | 7.5 | 2021-09-14 | On version 16.0.x before 16.0.1.2, when a BIG-IP ASM and DataSafe profile are configured on a virtual server, undisclosed requests can cause the Traffic Manage… |
CVE-2021-23031 | Critical | 9.9 | 2021-09-14 | On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, an aut… |
CVE-2021-39391 | Medium | 6.1 | 2021-09-14 | Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated by administrators vi… |
CVE-2021-35493 | Critical | 9.0 | 2021-09-14 | The WebFOCUS Reporting Server and WebFOCUS Client components of TIBCO Software Inc.'s TIBCO WebFOCUS Client, TIBCO WebFOCUS Installer, and TIBCO WebFOCUS Repor… |
CVE-2021-23039 | High | 7.5 | 2021-09-14 | On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.2.8, and all versions of 13.1.x and 12.1.x, when IPSec is configured on a BIG-IP sy… |
CVE-2021-23038 | Critical | 9.0 | 2021-09-14 | On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a stored cross-site scri… |
CVE-2021-23037 | Critical | 9.6 | 2021-09-14 | On all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed pa… |
CVE-2021-23035 | High | 7.5 | 2021-09-14 | On BIG-IP 14.1.x before 14.1.4.4, when an HTTP profile is configured on a virtual server, after a specific sequence of packets, chunked responses can cause the… |
CVE-2021-23034 | High | 7.5 | 2021-09-14 | On BIG-IP version 16.x before 16.1.0 and 15.1.x before 15.1.3.1, when a DNS profile using a DNS cache resolver is configured on a virtual server, undisclosed r… |
CVE-2021-23033 | High | 7.5 | 2021-09-14 | On BIG-IP Advanced WAF and BIG-IP ASM version 16.x before 16.1.0x, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of… |
CVE-2021-23032 | High | 7.5 | 2021-09-14 | On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a BIG-IP DNS system is configured wi… |
CVE-2021-23045 | High | 7.5 | 2021-09-14 | On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when an SCTP prof… |
CVE-2021-41077 | High | 7.5 | 2021-09-14 | The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is not specified by t… |
CVE-2021-23044 | High | 7.5 | 2021-09-14 | On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x, when the I… |
CVE-2021-23046 | Medium | 4.9 | 2021-09-14 | On all versions of Guided Configuration before 8.0.0, when a configuration that contains secure properties is created and deployed from Access Guided Configura… |
CVE-2021-23043 | Medium | 6.5 | 2021-09-14 | On BIG-IP, on all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a directory traversal vulnerability exists in an undisclosed page of… |
CVE-2021-23042 | High | 7.5 | 2021-09-14 | On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, and 12.1.x before 12.1.6, when an HTTP profile is c… |
CVE-2021-23040 | High | 8.8 | 2021-09-14 | On BIG-IP AFM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a SQL injection… |
CVE-2021-29841 | Medium | 5.4 | 2021-09-14 | IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2021-23047 | Medium | 5.3 | 2021-09-14 | On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, and all versions of 13.1.x, 12.1.x and 11.6.x, when BIG-IP APM performs Online C… |
CVE-2021-23041 | Medium | 6.1 | 2021-09-14 | On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a DOM based cross-s… |
CVE-2021-20582 | Medium | 5.3 | 2021-09-14 | IBM Security Secret Server up to 11.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have acce… |
CVE-2021-20569 | Medium | 5.3 | 2021-09-14 | IBM Security Secret Server up to 11.0 could allow an attacker to enumerate usernames due to improper input validation. IBM X-Force ID: 199243. |
CVE-2021-20508 | Medium | 4.3 | 2021-09-14 | IBM Security Secret Server up to 11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the… |
CVE-2021-23053 | Medium | 5.3 | 2021-09-14 | On version 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6, when the brute force protection feature of BIG-IP Advanced WAF or BIG-IP A… |
CVE-2021-23052 | Medium | 6.1 | 2021-09-14 | On version 14.1.x before 14.1.4.4 and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy… |
CVE-2021-23051 | High | 7.5 | 2021-09-14 | On BIG-IP versions 15.1.0.4 through 15.1.3, when the Data Plane Development Kit (DPDK)/Elastic Network Adapter (ENA) driver is used with BIG-IP on Amazon Web S… |
CVE-2021-23050 | High | 7.5 | 2021-09-14 | On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-… |
CVE-2021-23049 | High | 7.5 | 2021-09-14 | On BIG-IP version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3, when the iRules RESOLVER::summarize command is used on a virtual server, undisclosed request… |
CVE-2021-23048 | High | 7.5 | 2021-09-14 | On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x, when G… |
CVE-2021-38177 | High | 7.5 | 2021-09-14 | SAP CommonCryptoLib version 8.5.38 or lower is vulnerable to null pointer dereference vulnerability when an unauthenticated attacker sends crafted malicious da… |
CVE-2021-38176 | High | 8.8 | 2021-09-14 | Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section t… |
CVE-2021-38175 | Medium | 6.5 | 2021-09-14 | SAP Analysis for Microsoft Office - version 2.8, allows an attacker with high privileges to read sensitive data over the network, and gather or change informat… |
CVE-2021-38174 | Medium | 6.5 | 2021-09-14 | When a user opens manipulated files received from untrusted sources in SAP 3D Visual Enterprise Viewer version - 9, the application crashes and becomes tempora… |
CVE-2021-38164 | Medium | 5.4 | 2021-09-14 | SAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617, 618, 700, 720, 730, SAPSCORE - 125, S4C… |
CVE-2021-38163 | Critical | 9.9 | 2021-09-14 | SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can uploa… |
CVE-2021-38162 | High | 8.9 | 2021-09-14 | SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7.49, 7.53, 7.77, 7… |
CVE-2021-38150 | Medium | 6.5 | 2021-09-14 | When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP Business Client ver… |
CVE-2021-37535 | Critical | 9.8 | 2021-09-14 | SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks fo… |
CVE-2021-37532 | Medium | 4.3 | 2021-09-14 | SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the contents of index in the… |
CVE-2021-37531 | High | 8.8 | 2021-09-14 | SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a non-administrative au… |
CVE-2021-36582 | Critical | 9.8 | 2021-09-14 | In Kooboo CMS 2.1.1.0, it is possible to upload a remote shell (e.g., aspx) to the server and then call upon it to receive a reverse shell from the victim serv… |
CVE-2021-36581 | Critical | 9.8 | 2021-09-14 | Kooboo CMS 2.1.1.0 is vulnerable to Insecure file upload. It is possible to upload any file extension to the server. The server does not verify the extension o… |
CVE-2021-33688 | Medium | 4.3 | 2021-09-14 | SAP Business One allows an attacker with business privileges to execute crafted database queries, exposing the back-end database. Due to framework restrictions… |
CVE-2021-33686 | Medium | 5.3 | 2021-09-14 | Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encrypted sensitive information, but does not… |
CVE-2021-33685 | Medium | 6.5 | 2021-09-14 | SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or directories that are outside of the restric… |
CVE-2021-33679 | Medium | 5.4 | 2021-09-14 | The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a ne… |
CVE-2021-33675 | Medium | 6.1 | 2021-09-14 | Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This allows an attacker to exploit a Reflected… |
CVE-2021-33674 | Medium | 6.1 | 2021-09-14 | Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This allows an attacker to exploit a Reflected… |
CVE-2021-33673 | Medium | 6.1 | 2021-09-14 | Under certain conditions, SAP Contact Center - version 700,does not sufficiently encode user-controlled inputs and persists in them. This allows an attacker to… |
CVE-2021-33672 | Critical | 9.6 | 2021-09-14 | Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in chat message. When the… |
CVE-2021-32202 | Medium | 6.1 | 2021-09-14 | In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation page. |
CVE-2021-21489 | Medium | 4.8 | 2021-09-14 | SAP NetWeaver Enterprise Portal versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user related data, resulting in Stored Cross-… |
CVE-2021-40357 | Medium | 4.9 | 2021-09-14 | A vulnerability has been identified in Teamcenter Active Workspace V4.3 (All versions < V4.3.10), Teamcenter Active Workspace V5.0 (All versions < V5.0.8), Tea… |
CVE-2021-40356 | High | 7.5 | 2021-09-14 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions… |
CVE-2021-40355 | High | 8.8 | 2021-09-14 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions… |
CVE-2021-40354 | High | 7.1 | 2021-09-14 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions… |
CVE-2021-37206 | High | 7.5 | 2021-09-14 | A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 relays with CPU variants CP100 (All version… |
CVE-2021-37203 | High | 7.1 | 2021-09-14 | A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8). The plmxmlAdapterIFC.dll contains a… |
CVE-2021-37202 | High | 7.8 | 2021-09-14 | A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8). The IFC adapter in affected applica… |
CVE-2021-37201 | High | 8.8 | 2021-09-14 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). The web interface of affected devices is vulnerable to a Cross-Site Request Forgery… |