2021 CVEs (page 121)
Page 121 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-37200 | High | 7.7 | 2021-09-14 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). An attacker with access to the webserver of an affected system could download arbit… |
CVE-2021-37193 | Medium | 4.3 | 2021-09-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An unauthenticated attacker in the same network of the affected… |
CVE-2021-37192 | Medium | 4.3 | 2021-09-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software has an information disclosure vulnerabilit… |
CVE-2021-37191 | Medium | 4.3 | 2021-09-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An unauthenticated attacker in the same network of the affected… |
CVE-2021-37190 | Medium | 4.3 | 2021-09-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software has an information disclosure vulnerabilit… |
CVE-2021-37186 | Medium | 5.4 | 2021-09-14 | A vulnerability has been identified in LOGO! CMR2020 (All versions < V2.2), LOGO! CMR2040 (All versions < V2.2), SIMATIC RTU3010C (All versions < V4.0.9), SIMA… |
CVE-2021-37184 | Critical | 9.8 | 2021-09-14 | A vulnerability has been identified in Industrial Edge Management (All versions < V1.3). An unauthenticated attacker could change the the password of any user… |
CVE-2021-37183 | Medium | 6.5 | 2021-09-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software allows sending send-to-sleep notifications… |
CVE-2021-37181 | Critical | 10.0 | 2021-09-14 | A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions), Cerberus DMS V5.0… |
CVE-2021-37177 | Medium | 6.5 | 2021-09-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The status provided by the syslog clients managed by the affecte… |
CVE-2021-37176 | Low | 3.3 | 2021-09-14 | A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). The femap.exe application lacks proper v… |
CVE-2021-37175 | Medium | 5.3 | 2021-09-14 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All… |
CVE-2021-37174 | High | 8.8 | 2021-09-14 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All… |
CVE-2021-37173 | High | 8.8 | 2021-09-14 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All… |
CVE-2021-33737 | High | 7.5 | 2021-09-14 | A vulnerability has been identified in SIMATIC CP 343-1 (incl. SIPLUS variants) (All versions), SIMATIC CP 343-1 Advanced (incl. SIPLUS variants) (All versions… |
CVE-2021-33720 | High | 7.5 | 2021-09-14 | A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 relays with CPU variants CP100 (All version… |
CVE-2021-33719 | Critical | 9.8 | 2021-09-14 | A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 relays with CPU variants CP100 (All version… |
CVE-2021-33716 | Medium | 6.5 | 2021-09-14 | A vulnerability has been identified in SIMATIC CP 1543-1 (incl. SIPLUS variants) (All versions < V3.0), SIMATIC CP 1545-1 (All versions < V1.1). An attacker wi… |
CVE-2021-31891 | Critical | 10.0 | 2021-09-14 | A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier)… |
CVE-2021-27391 | Critical | 9.8 | 2021-09-14 | A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE… |
CVE-2021-25665 | High | 7.8 | 2021-09-14 | A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < V2021.2.1). The starview+.exe application lacks proper validation of user-sup… |
CVE-2021-39125 | Medium | 5.3 | 2021-09-14 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to discover the usernames of users via an enumeration vulnerability… |
CVE-2021-39124 | Medium | 4.3 | 2021-09-14 | The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote attackers who are able… |
CVE-2021-39123 | High | 7.5 | 2021-09-14 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to impact the application's availability via a Denial of Serv… |
CVE-2021-39118 | Medium | 5.3 | 2021-09-14 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full names of users via an enumeration vulnerab… |
CVE-2021-41072 | High | 8.1 | 2021-09-14 | squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that ha… |
CVE-2021-41054 | High | 7.5 | 2021-09-13 | tftpd_file.c in atftp through 0.7.4 has a buffer overflow because buffer-size handling does not properly consider the combination of data, OACK, and other opti… |
CVE-2021-41033 | High | 8.1 | 2021-09-13 | In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be vulnerable to man-in-the-middle attack if using… |
CVE-2021-33365 | Medium | 5.5 | 2021-09-13 | Memory leak in the gf_isom_get_root_od function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file. |
CVE-2021-33363 | Medium | 5.5 | 2021-09-13 | Memory leak in the infe_box_read function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file. |
CVE-2021-33361 | Medium | 5.5 | 2021-09-13 | Memory leak in the afra_box_read function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file. |
CVE-2021-32139 | Medium | 5.5 | 2021-09-13 | The gf_isom_vp_config_get function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box comm… |
CVE-2021-32138 | Medium | 5.5 | 2021-09-13 | The DumpTrackInfo function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command. |
CVE-2021-40824 | Medium | 5.9 | 2021-09-13 | A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 (aka Matrix SDK for Android) before 1.2.2 allows a… |
CVE-2021-40823 | Medium | 5.9 | 2021-09-13 | A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in… |
CVE-2021-38833 | Critical | 9.8 | 2021-09-13 | SQL injection vulnerability in PHPGurukul Apartment Visitors Management System (AVMS) v. 1.0 allows attackers to execute arbitrary SQL statements and to gain R… |
CVE-2021-33366 | Medium | 5.5 | 2021-09-13 | Memory leak in the gf_isom_oinf_read_entry function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file. |
CVE-2021-33364 | Medium | 5.5 | 2021-09-13 | Memory leak in the def_parent_box_new function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file. |
CVE-2021-33362 | High | 7.8 | 2021-09-13 | Stack buffer overflow in the hevc_parse_vps_extension function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code… |
CVE-2021-3666 | Critical | 9.8 | 2021-09-13 | body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-39212 | Medium | 4.4 | 2021-09-13 | ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribute in both open and… |
CVE-2021-33554 | High | 7.2 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute ar… |
CVE-2021-33553 | High | 7.2 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute ar… |
CVE-2021-33552 | High | 7.2 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute ar… |
CVE-2021-33551 | High | 7.2 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute ar… |
CVE-2021-33550 | High | 7.2 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute ar… |
CVE-2021-33549 | High | 7.2 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the action parameter, whic… |
CVE-2021-33548 | High | 7.2 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute ar… |
CVE-2021-33547 | High | 7.2 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the profile parameter whic… |
CVE-2021-33546 | High | 7.2 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the name parameter, which… |
CVE-2021-33545 | High | 7.2 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the counter parameter whic… |
CVE-2021-33544 | High | 7.2 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute ar… |
CVE-2021-33543 | Critical | 9.8 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authenticati… |
CVE-2021-24728 | High | 8.8 | 2021-09-13 | The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby param… |
CVE-2021-24727 | High | 8.8 | 2021-09-13 | The StopBadBots WordPress plugin before 6.60 did not validate or escape the order and orderby GET parameter in some of its admin dashboard pages, leading to Au… |
CVE-2021-24726 | High | 8.8 | 2021-09-13 | The WP Simple Booking Calendar WordPress plugin before 2.0.6 did not escape, validate or sanitise the orderby parameter in its Search Calendars action, before… |
CVE-2021-24725 | Medium | 4.3 | 2021-09-13 | The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', which could allow attac… |
CVE-2021-24724 | Medium | 5.4 | 2021-09-13 | The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users su… |
CVE-2021-24623 | Medium | 4.8 | 2021-09-13 | The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the databa… |
CVE-2021-24621 | Medium | 4.8 | 2021-09-13 | The WP Courses LMS WordPress plugin before 2.0.44 does not sanitise its Video Embed Code, allowing malicious code to be injected in it by high privilege users… |
CVE-2021-24620 | High | 8.8 | 2021-09-13 | The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital pro… |
CVE-2021-24619 | Medium | 4.8 | 2021-09-13 | The Per page add to head WordPress plugin through 1.4.4 does not properly sanitise one of its setting, allowing malicious HTML to be inserted by high privilege… |
CVE-2021-24614 | Medium | 4.8 | 2021-09-13 | The Book appointment online WordPress plugin before 1.39 does not sanitise or escape Service Prices before outputting it in the List, which could allow high pr… |
CVE-2021-24605 | Medium | 5.4 | 2021-09-13 | The create_post_page AJAX action of the Custom Post View Generator WordPress plugin through 0.4.6 (available to authenticated user) does not sanitise or escape… |
CVE-2021-24586 | Medium | 4.3 | 2021-09-13 | The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admi… |
CVE-2021-24560 | Medium | 6.1 | 2021-09-13 | The Software License Manager WordPress plugin before 4.4.8 does not sanitise or escape the edit_record parameter before outputting it back in the page in the a… |
CVE-2021-24523 | Medium | 5.4 | 2021-09-13 | The Daily Prayer Time WordPress plugin before 2021.08.10 does not sanitise or escape some of its settings before outputting them in the page, leading to Authen… |
CVE-2021-24510 | Medium | 6.1 | 2021-09-13 | The MF Gig Calendar WordPress plugin before 1.2 does not sanitise and escape the id GET parameter before outputting back in the admin dashboard when editing an… |
CVE-2021-24508 | Medium | 6.1 | 2021-09-13 | The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (availa… |
CVE-2021-24493 | Critical | 9.8 | 2021-09-13 | The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any securit… |
CVE-2021-24491 | High | 8.8 | 2021-09-13 | The Fileviewer WordPress plugin through 2.2 does not have CSRF checks in place when performing actions such as upload and delete files. As a result, attackers… |
CVE-2021-24490 | Medium | 6.8 | 2021-09-13 | The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, allowing arbitrary fil… |
CVE-2021-24431 | Medium | 4.3 | 2021-09-13 | The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generat… |
CVE-2021-32135 | Medium | 5.5 | 2021-09-13 | The trak_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command. |
CVE-2021-32132 | Medium | 5.5 | 2021-09-13 | The abst_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command. |
CVE-2021-29643 | Medium | 5.4 | 2021-09-13 | PRTG Network Monitor before 21.3.69.1333 allows stored XSS via an unsanitized string imported from a User Object in a connected Active Directory instance. |
CVE-2021-32137 | Medium | 5.5 | 2021-09-13 | Heap buffer overflow in the URL_GetProtocolType function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a… |
CVE-2021-32134 | Medium | 5.5 | 2021-09-13 | The gf_odf_desc_copy function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command. |
CVE-2021-32136 | High | 7.8 | 2021-09-13 | Heap buffer overflow in the print_udta function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted f… |
CVE-2021-40214 | Medium | 5.4 | 2021-09-13 | Gibbon v22.0.00 suffers from a stored XSS vulnerability within the wall messages component. |
CVE-2021-22528 | High | 8.0 | 2021-09-13 | Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
CVE-2021-22527 | Medium | 6.0 | 2021-09-13 | Information leakage vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
CVE-2021-22526 | Medium | 4.9 | 2021-09-13 | Open Redirection vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
CVE-2021-22524 | Medium | 5.4 | 2021-09-13 | Injection attack caused the denial of service vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
CVE-2021-40870 | Critical | 9.8 | 2021-09-13 | An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unaut… |
CVE-2021-40867 | High | 7.8 | 2021-09-13 | Certain NETGEAR smart switches are affected by an authentication hijacking race-condition vulnerability by an unauthenticated attacker who uses the same source… |
CVE-2021-40866 | Critical | 9.8 | 2021-09-13 | Certain NETGEAR smart switches are affected by a remote admin password change by an unauthenticated attacker via the (disabled by default) /sqfs/bin/sccd daemo… |
CVE-2021-23435 | High | 7.6 | 2021-09-12 | This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of session[:return_to]. If the value us… |
CVE-2021-23440 | High | 7.3 | 2021-09-12 | This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided… |
CVE-2021-40146 | Critical | 9.8 | 2021-09-11 | A Remote Code Execution (RCE) vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions < 2.5. RCE vulnerabilitie… |
CVE-2021-38555 | Critical | 9.1 | 2021-09-11 | An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML externa… |
CVE-2021-39207 | High | 8.4 | 2021-09-10 | parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable… |
CVE-2021-24040 | Critical | 9.8 | 2021-09-10 | Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting… |
CVE-2021-40864 | Critical | 9.8 | 2021-09-10 | The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields. |
CVE-2021-40347 | Medium | 5.4 | 2021-09-10 | An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubs… |
CVE-2021-3145 | Medium | 6.7 | 2021-09-10 | In Ionic Identity Vault before 5, a local root attacker on an Android device can bypass biometric authentication. |
CVE-2021-3646 | Medium | 6.1 | 2021-09-10 | btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-37422 | Critical | 9.8 | 2021-09-10 | Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases. |
CVE-2021-37423 | Critical | 9.8 | 2021-09-10 | Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover. |
CVE-2021-37414 | High | 7.5 | 2021-09-10 | Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication. |