2021 CVEs (page 122)
Page 122 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-40373 | Critical | 9.8 | 2021-09-10 | playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_config, and then executing that code via t… |
CVE-2021-38360 | High | 8.3 | 2021-09-10 | The wp-publications WordPress plugin is vulnerable to restrictive local file inclusion via the Q_FILE parameter found in the ~/bibtexbrowser.php file which all… |
CVE-2021-38359 | Medium | 6.1 | 2021-09-10 | The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the message parameter f… |
CVE-2021-38358 | Medium | 6.1 | 2021-09-10 | The MoolaMojo WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the ~/views/button-generator.html.php file wh… |
CVE-2021-38357 | Medium | 6.1 | 2021-09-10 | The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the ~/sms-ovh-sent.php file which allows attac… |
CVE-2021-38355 | Medium | 6.1 | 2021-09-10 | The Bug Library WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the successimportcount parameter found in the ~/bug-library.php file which… |
CVE-2021-38354 | Medium | 6.1 | 2021-09-10 | The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gm_error parameter found in the ~/includes/admin/mailing-l… |
CVE-2021-38353 | Medium | 6.1 | 2021-09-10 | The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the ~/index.php file which… |
CVE-2021-38352 | Medium | 6.1 | 2021-09-10 | The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedify_msg parameter found in the ~/includes/bas… |
CVE-2021-38351 | Medium | 6.1 | 2021-09-10 | The OSD Subscribe WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the osd_subscribe_message parameter found in the ~/options/osd_subscribe… |
CVE-2021-38350 | Medium | 6.1 | 2021-09-10 | The spideranalyse WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the date parameter found in the ~/analyse/index.php file which allows at… |
CVE-2021-38349 | Medium | 6.1 | 2021-09-10 | The Integration of Moneybird for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error_description parameter found in the… |
CVE-2021-38348 | Medium | 6.1 | 2021-09-10 | The Advance Search WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the wpas_id parameter found in the ~/inc/admin/views/html-advance-searc… |
CVE-2021-38347 | Medium | 6.1 | 2021-09-10 | The Custom Website Data WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter found in the ~/views/edit.php file which allows a… |
CVE-2021-38341 | Medium | 6.1 | 2021-09-10 | The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in… |
CVE-2021-38340 | Medium | 6.1 | 2021-09-10 | The Wordpress Simple Shop WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the update_row parameter found in the ~/includes/add_product.php… |
CVE-2021-38339 | Medium | 6.1 | 2021-09-10 | The Simple Matted Thumbnails WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/simple-mat… |
CVE-2021-38338 | Medium | 6.1 | 2021-09-10 | The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `f` and `t` parameter found in the ~/titan-framework/iframe-goo… |
CVE-2021-38337 | Medium | 6.1 | 2021-09-10 | The RSVPMaker Excel WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/phpexcel/PHPExcel/S… |
CVE-2021-38336 | Medium | 6.1 | 2021-09-10 | The Edit Comments XT WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/edit-comments-xt.p… |
CVE-2021-38335 | Medium | 6.1 | 2021-09-10 | The Wise Agent Capture Forms WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/WiseAgentC… |
CVE-2021-38334 | Medium | 6.1 | 2021-09-10 | The WP Design Maps & Places WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the filename parameter found in the ~/wpdmp-admin.php file whi… |
CVE-2021-38333 | Medium | 6.1 | 2021-09-10 | The WP Scrippets WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/wp-scrippets.php file… |
CVE-2021-38332 | Medium | 6.1 | 2021-09-10 | The On Page SEO + Whatsapp Chat Button Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in… |
CVE-2021-38331 | Medium | 6.1 | 2021-09-10 | The WP-T-Wap WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the posted parameter found in the ~/wap/writer.php file which allows attacker… |
CVE-2021-38330 | Medium | 6.1 | 2021-09-10 | The Yet Another bol.com Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/yabp.php… |
CVE-2021-38329 | Medium | 6.1 | 2021-09-10 | The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/dj-email-publish.ph… |
CVE-2021-38328 | Medium | 6.1 | 2021-09-10 | The Notices WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/notices.php file which allo… |
CVE-2021-38327 | Medium | 6.1 | 2021-09-10 | The YouTube Video Inserter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/adminUI/sett… |
CVE-2021-38326 | Medium | 6.1 | 2021-09-10 | The Post Title Counter WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the notice parameter found in the ~/post-title-counter.php file whi… |
CVE-2021-35976 | Medium | 6.1 | 2021-09-10 | The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-6… |
CVE-2021-33011 | Medium | 4.3 | 2021-09-10 | All versions of the afffected TOYOPUC-PC10 Series,TOYOPUC-Plus Series,TOYOPUC-PC3J/PC2J Series, TOYOPUC-Nano Series products may not be able to properly proces… |
CVE-2021-3645 | Critical | 9.8 | 2021-09-10 | merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-34346 | Critical | 9.8 | 2021-09-10 | A stack buffer overflow vulnerability has been reported to affect QNAP device running NVR Storage Expansion. If exploited, this vulnerability allows attackers… |
CVE-2021-34345 | Critical | 9.8 | 2021-09-10 | A stack buffer overflow vulnerability has been reported to affect QNAP device running NVR Storage Expansion. If exploited, this vulnerability allows attackers… |
CVE-2021-34344 | Critical | 9.8 | 2021-09-10 | A stack buffer overflow vulnerability has been reported to affect QNAP device running QUSBCam2. If exploited, this vulnerability allows attackers to execute ar… |
CVE-2021-34343 | Medium | 6.0 | 2021-09-10 | A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerability allows attack… |
CVE-2021-28816 | High | 7.6 | 2021-09-10 | A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerability allows attack… |
CVE-2021-28813 | Critical | 9.6 | 2021-09-10 | A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If explo… |
CVE-2021-40839 | High | 7.5 | 2021-09-10 | The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU a… |
CVE-2021-39206 | High | 8.6 | 2021-09-09 | Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 an… |
CVE-2021-39204 | High | 7.5 | 2021-09-09 | Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive compl… |
CVE-2021-39203 | Medium | 6.8 | 2021-09-09 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated us… |
CVE-2021-39202 | High | 7.6 | 2021-09-09 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets edit… |
CVE-2021-39201 | High | 7.6 | 2021-09-09 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authen… |
CVE-2021-39200 | Medium | 5.3 | 2021-09-09 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of t… |
CVE-2021-39162 | High | 8.6 | 2021-09-09 | Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are rec… |
CVE-2021-32724 | Critical | 9.9 | 2021-09-09 | check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the [check-spelling action](https://github.c… |
CVE-2021-38325 | Medium | 6.1 | 2021-09-09 | The User Activation Email WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the ~/user-activation-email.php f… |
CVE-2021-38324 | High | 8.2 | 2021-09-09 | The SP Rental Manager WordPress plugin is vulnerable to SQL Injection via the orderby parameter found in the ~/user/shortcodes.php file which allows attackers… |
CVE-2021-38323 | Medium | 6.1 | 2021-09-09 | The RentPress WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selections parameter found in the ~/src/rentPress/AjaxRequests.php file… |
CVE-2021-38322 | Medium | 6.1 | 2021-09-09 | The Twitter Friends Widget WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the pmc_TF_user and pmc_TF_password parameter found in the ~/tw… |
CVE-2021-38321 | Medium | 6.1 | 2021-09-09 | The Custom Menu Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selected_menu parameter found in the ~/custom-menus.php file wh… |
CVE-2021-38320 | Medium | 6.1 | 2021-09-09 | The simpleSAMLphp Authentication WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/simple… |
CVE-2021-38319 | Medium | 6.1 | 2021-09-09 | The More From Google WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/morefromgoogle.php… |
CVE-2021-38318 | Medium | 6.1 | 2021-09-09 | The 3D Cover Carousel WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the ~/cover-carousel.php file which allows attac… |
CVE-2021-38317 | Medium | 6.1 | 2021-09-09 | The Konnichiwa! Membership WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the plan_id parameter in the ~/views/subscriptions.html.php fil… |
CVE-2021-38316 | Medium | 6.1 | 2021-09-09 | The WP Academic People List WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category_name parameter in the ~/admin-panel.php file whic… |
CVE-2021-28914 | Medium | 6.5 | 2021-09-09 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow the user to set a weak password because the strength is shown in configuration tool, but finally not… |
CVE-2021-25466 | Medium | 6.5 | 2021-09-09 | Improper scheme check vulnerability in Samsung Internet prior to version 15.0.2.47 allows attackers to perform Man-in-the-middle attack and obtain Samsung Acco… |
CVE-2021-25465 | Low | 3.3 | 2021-09-09 | An improper scheme check vulnerability in Samsung Themes prior to version 5.2.01 allows attackers to perform Man-in-the-middle attack. |
CVE-2021-25464 | Low | 3.3 | 2021-09-09 | An improper file management vulnerability in SamsungCapture prior to version 4.8.02 allows sensitive information leak. |
CVE-2021-25463 | Medium | 4.0 | 2021-09-09 | Improper access control vulnerability in PENUP prior to version 3.8.00.18 allows arbitrary webpage loading in webview. |
CVE-2021-25462 | Low | 3.3 | 2021-09-09 | NULL pointer dereference vulnerability in NPU driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory corruption. |
CVE-2021-25461 | Medium | 4.0 | 2021-09-09 | An improper length check in APAService prior to SMR Sep-2021 Release 1 results in stack based Buffer Overflow. |
CVE-2021-25460 | Medium | 4.0 | 2021-09-09 | An improper access control vulnerability in sspExit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to terminate BlockchainTZService. |
CVE-2021-25459 | Medium | 4.0 | 2021-09-09 | An improper access control vulnerability in sspInit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to start BlockchainTZService. |
CVE-2021-25458 | Low | 3.3 | 2021-09-09 | NULL pointer dereference vulnerability in ION driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory corruption. |
CVE-2021-25457 | Medium | 5.9 | 2021-09-09 | An improper input validation vulnerability in DSP driver prior to SMR Sep-2021 Release 1 allows local attackers to get a limited kernel memory information. |
CVE-2021-25456 | Medium | 5.5 | 2021-09-09 | OOB read vulnerability in libswmfextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute memcpy at arbitrary address via forged wmf fi… |
CVE-2021-25455 | Low | 3.3 | 2021-09-09 | OOB read vulnerability in libsaviextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to access arbitrary address through pointer via forged a… |
CVE-2021-25454 | Low | 3.1 | 2021-09-09 | OOB read vulnerability in libsaacextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute remote DoS via forged aac file. |
CVE-2021-25453 | Medium | 5.1 | 2021-09-09 | Some improper access control in Bluetooth APIs prior to SMR Sep-2021 Release 1 allows untrusted application to get Bluetooth information. |
CVE-2021-25452 | Medium | 5.5 | 2021-09-09 | An improper input validation vulnerability in loading graph file in DSP driver prior to SMR Sep-2021 Release 1 allows attackers to perform permanent denial of… |
CVE-2021-25451 | Low | 3.3 | 2021-09-09 | A PendingIntent hijacking in NetworkPolicyManagerService prior to SMR Sep-2021 Release 1 allows attackers to get IMSI data. |
CVE-2021-25450 | Medium | 4.5 | 2021-09-09 | Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Sep-2021 Release 1 allows attackers to write file as system uid via remote socket. |
CVE-2021-25449 | Medium | 6.5 | 2021-09-09 | An improper input validation vulnerability in libsapeextractor library prior to SMR Sep-2021 Release 1 allows attackers to execute arbitrary code in mediaextra… |
CVE-2021-39296 | Critical | 10.0 | 2021-09-09 | In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system. |
CVE-2021-28913 | Critical | 9.8 | 2021-09-09 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /webif/SecurityModule to validate the so called and hard coded un… |
CVE-2021-28912 | High | 7.2 | 2021-09-09 | BAB TECHNOLOGIE GmbH eibPort V3. Each device has its own unique hard coded and weak root SSH key passphrase known as 'eibPort string'. This is usable and the f… |
CVE-2021-28911 | Critical | 9.8 | 2021-09-09 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /tmp path which contains some sensitive data (e.g. device serial… |
CVE-2021-28910 | High | 7.5 | 2021-09-09 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability. It allow unauthenticated attackers to request to any internal and extern… |
CVE-2021-28909 | Critical | 9.8 | 2021-09-09 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login service at /webif/SecurityModule in a brut… |
CVE-2021-40284 | Medium | 6.5 | 2021-09-09 | D-Link DSL-3782 EU v1.01:EU v1.03 is affected by a buffer overflow which can cause a denial of service. This vulnerability exists in the web interface "/cgi-bi… |
CVE-2021-38727 | Critical | 9.8 | 2021-09-09 | FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items |
CVE-2021-32487 | High | 7.5 | 2021-09-09 | In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service with no additional execution privi… |
CVE-2021-32486 | High | 7.5 | 2021-09-09 | In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service with no additional execution privi… |
CVE-2021-32485 | High | 7.5 | 2021-09-09 | In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service with no additional execution privi… |
CVE-2021-32484 | High | 7.5 | 2021-09-09 | In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service with no additional execution privi… |
CVE-2021-38725 | Medium | 5.3 | 2021-09-09 | Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php |
CVE-2021-38723 | High | 8.8 | 2021-09-09 | FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items |
CVE-2021-38721 | Medium | 6.5 | 2021-09-09 | FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability |
CVE-2021-38540 | Critical | 9.8 | 2021-09-09 | The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/mod… |
CVE-2021-22239 | Medium | 5.0 | 2021-09-09 | An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later. |
CVE-2021-3761 | High | 7.5 | 2021-09-09 | Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can… |
CVE-2021-37101 | Medium | 6.8 | 2021-09-09 | There is an improper authorization vulnerability in AIS-BW50-00 9.0.6.2(H100SP10C00) and 9.0.6.2(H100SP15C00). Due to improper authorization mangement, an atta… |
CVE-2021-28499 | Medium | 6.3 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user account passwords set in clear text could leak to users… |
CVE-2021-28498 | High | 8.7 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user enable passwords set in clear text could result in unpri… |
CVE-2021-28497 | Medium | 4.4 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, the bash shell might be accessible… |
CVE-2021-28495 | High | 7.2 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, user authentication can be bypassed… |