2021 CVEs (page 123)
Page 123 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-28494 | Critical | 9.6 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, authentication is bypassed by unpri… |
CVE-2021-28493 | High | 8.4 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, a user may be able to execute comma… |
CVE-2021-26608 | High | 8.8 | 2021-09-09 | An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issue is due to missing… |
CVE-2021-40223 | Medium | 5.4 | 2021-09-09 | Rittal CMC PU III Web management (version V3.11.00_2) fails to sanitize user input on several parameters of the configuration (User Configuration dialog, Task… |
CVE-2021-40222 | High | 7.2 | 2021-09-09 | Rittal CMC PU III Web management Version affected: V3.11.00_2. Version fixed: V3.17.10 is affected by a remote code execution vulnerablity. It is possible to i… |
CVE-2021-39459 | High | 7.2 | 2021-09-09 | Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user to execute code on the hosting syst… |
CVE-2021-39458 | Medium | 6.5 | 2021-09-09 | Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vai… |
CVE-2021-38408 | Critical | 9.8 | 2021-09-09 | A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the length of user-supplied… |
CVE-2021-36871 | Medium | 5.5 | 2021-09-09 | Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps Pro premium plugin (versions <= 8.1.11). Vulnerable pa… |
CVE-2021-36870 | Medium | 5.5 | 2021-09-09 | Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps plugin (versions <= 8.1.12). Vulnerable parameters: &d… |
CVE-2021-26603 | High | 8.6 | 2021-09-09 | A heap overflow issue was found in ARK library of bandisoft Co., Ltd when the Ark_DigPathA function parsed a file path. This vulnerability is due to missing su… |
CVE-2021-20118 | Medium | 6.7 | 2021-09-09 | Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run s… |
CVE-2021-20117 | Medium | 6.7 | 2021-09-09 | Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run s… |
CVE-2021-37579 | Critical | 9.8 | 2021-09-09 | The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there… |
CVE-2021-36161 | Critical | 9.8 | 2021-09-09 | Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with spec… |
CVE-2021-30295 | High | 8.4 | 2021-09-09 | Possible heap overflow due to improper validation of local variable while storing current task information locally in Snapdragon Auto, Snapdragon Compute, Snap… |
CVE-2021-30294 | High | 8.4 | 2021-09-09 | Potential null pointer dereference in KGSL GPU auxiliary command due to improper validation of user input in Snapdragon Auto, Snapdragon Connectivity, Snapdrag… |
CVE-2021-30290 | High | 8.4 | 2021-09-09 | Possible null pointer dereference due to race condition between timeline fence signal and time line fence destroy in Snapdragon Auto, Snapdragon Connectivity… |
CVE-2021-1974 | High | 7.5 | 2021-09-09 | Possible buffer over read due to lack of alignment between map or unmap length of IPA SMMU and WLAN SMMU in Snapdragon Auto, Snapdragon Compute, Snapdragon Con… |
CVE-2021-1971 | High | 7.5 | 2021-09-09 | Possible assertion due to lack of physical layer state validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electron… |
CVE-2021-1963 | Medium | 6.7 | 2021-09-09 | Possible use-after-free due to lack of validation for the rule count in filter table in IPA driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectiv… |
CVE-2021-1962 | Medium | 6.7 | 2021-09-09 | Buffer Overflow while processing IOCTL for getting peripheral endpoint information there is no proper validation for input maximum endpoint pair and its size i… |
CVE-2021-1961 | Medium | 6.7 | 2021-09-09 | Possible buffer overflow due to lack of offset length check while updating the buffer value in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sn… |
CVE-2021-1960 | Medium | 6.5 | 2021-09-09 | Improper handling of ASB-C broadcast packets with crafted opcode in LMP can lead to uncontrolled resource consumption in Snapdragon Auto, Snapdragon Compute, S… |
CVE-2021-1958 | Medium | 6.7 | 2021-09-09 | A race condition in fastrpc kernel driver for dynamic process creation can lead to use after free scenario in Snapdragon Auto, Snapdragon Connectivity, Snapdra… |
CVE-2021-1957 | Medium | 6.5 | 2021-09-09 | Improper Access Control when ACL link encryption is failed and ACL link is not disconnected during reconnection with paired device in Snapdragon Auto, Snapdrag… |
CVE-2021-1956 | Medium | 6.5 | 2021-09-09 | Improper handling of ASB-U packet with L2CAP channel ID by slave host can lead to interference with piconet in Snapdragon Auto, Snapdragon Compute, Snapdragon… |
CVE-2021-1952 | High | 7.8 | 2021-09-09 | Possible buffer over read occurs due to lack of length check of request buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Cons… |
CVE-2021-1948 | High | 7.5 | 2021-09-09 | Possible out of bound read due to lack of length check of data while parsing the beacon or probe response in Snapdragon Auto, Snapdragon Compute, Snapdragon Co… |
CVE-2021-1946 | Critical | 9.8 | 2021-09-09 | Null Pointer Dereference may occur due to improper validation while processing crafted SDP body in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2021-1941 | High | 7.5 | 2021-09-09 | Possible buffer over read issue due to improper length check on WPA IE string sent by peer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sna… |
CVE-2021-1935 | High | 7.1 | 2021-09-09 | Possible null pointer dereference due to lack of validation check for passed pointer during key import in Snapdragon Auto, Snapdragon Compute, Snapdragon Conne… |
CVE-2021-1934 | High | 8.4 | 2021-09-09 | Possible memory corruption due to improper check when application loader object is explicitly destructed while application is unloading in Snapdragon Auto, Sna… |
CVE-2021-1933 | Critical | 9.8 | 2021-09-09 | UE assertion is possible due to improper validation of invite message with SDP body in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon… |
CVE-2021-1909 | High | 7.3 | 2021-09-09 | Buffer overflow occurs in trusted applications due to lack of length check of parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapd… |
CVE-2021-34786 | Medium | 6.5 | 2021-09-09 | Multiple vulnerabilities in Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to delete arbitrary user accounts or… |
CVE-2021-34785 | Medium | 6.5 | 2021-09-09 | Multiple vulnerabilities in Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to delete arbitrary user accounts or… |
CVE-2021-34771 | Medium | 5.5 | 2021-09-09 | A vulnerability in the Cisco IOS XR Software CLI could allow an authenticated, local attacker to view more information than their privileges allow. This vulner… |
CVE-2021-34737 | Medium | 5.8 | 2021-09-09 | A vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to trigger a crash of th… |
CVE-2021-34728 | High | 7.8 | 2021-09-09 | Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker with a low-privileged account to elevate privileges o… |
CVE-2021-34722 | Medium | 6.7 | 2021-09-09 | Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to gain access to the underlying root shell of an aff… |
CVE-2021-34721 | Medium | 6.7 | 2021-09-09 | Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to gain access to the underlying root shell of an aff… |
CVE-2021-34720 | High | 8.6 | 2021-09-09 | A vulnerability in the IP Service Level Agreements (IP SLA) responder and Two-Way Active Measurement Protocol (TWAMP) features of Cisco IOS XR Software could a… |
CVE-2021-34719 | High | 7.8 | 2021-09-09 | Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker with a low-privileged account to elevate privileges o… |
CVE-2021-34718 | High | 8.1 | 2021-09-09 | A vulnerability in the SSH Server process of Cisco IOS XR Software could allow an authenticated, remote attacker to overwrite and read arbitrary files on the l… |
CVE-2021-34713 | High | 7.4 | 2021-09-09 | A vulnerability in the Layer 2 punt code of Cisco IOS XR Software running on Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated… |
CVE-2021-34709 | Medium | 6.0 | 2021-09-09 | Multiple vulnerabilities in image verification checks of Cisco Network Convergence System (NCS) 540 Series Routers, only when running Cisco IOS XR NCS540L soft… |
CVE-2021-34708 | Medium | 6.0 | 2021-09-09 | Multiple vulnerabilities in image verification checks of Cisco Network Convergence System (NCS) 540 Series Routers, only when running Cisco IOS XR NCS540L soft… |
CVE-2021-32836 | High | 7.5 | 2021-09-09 | ZStack is open source IaaS(infrastructure as a service) software. In ZStack before versions 3.10.12 and 4.1.6 there is a pre-auth unsafe deserialization vulner… |
CVE-2021-32835 | Critical | 9.9 | 2021-09-09 | Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a sandbox escape vulnerability may lea… |
CVE-2021-32834 | High | 8.2 | 2021-09-09 | Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a user able to create Policy Sets can… |
CVE-2021-32833 | High | 8.6 | 2021-09-09 | Emby Server is a personal media server with apps on many devices. In Emby Server on Windows there is a set of arbitrary file read vulnerabilities. This vulnera… |
CVE-2021-40818 | Critical | 9.8 | 2021-09-08 | scheme/webauthn.c in Glewlwyd SSO server through 2.5.3 has a buffer overflow during FIDO2 signature validation in webauthn registration. |
CVE-2021-40814 | Critical | 9.8 | 2021-09-08 | The Customer Photo Gallery addon before 2.9.4 for PrestaShop is vulnerable to SQL injection. |
CVE-2021-40812 | Medium | 6.5 | 2021-09-08 | The GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read because of the lack of certain gdGetBuf and gdPutBuf return value checks. |
CVE-2021-36440 | Critical | 9.8 | 2021-09-08 | Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateControlle… |
CVE-2021-30605 | High | 7.8 | 2021-09-08 | Inappropriate implementation in the ChromeOS Readiness Tool installer on Windows prior to 1.0.2.0 loosens DCOM access rights on two objects allowing an attacke… |
CVE-2021-40797 | Medium | 6.5 | 2021-09-08 | An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involvi… |
CVE-2021-40537 | Low | 2.7 | 2021-09-08 | Server Side Request Forgery (SSRF) vulnerability exists in owncloud/user_ldap < 0.15.4 in the settings of the user_ldap app. Administration role is necessary f… |
CVE-2021-38388 | High | 8.8 | 2021-09-08 | Central Dogma allows privilege escalation with mirroring to the internal dogma repository that has a file managing the authorization of the project. |
CVE-2021-36216 | High | 7.8 | 2021-09-08 | LINE for Windows 6.2.1.2289 and before allows arbitrary code execution via malicious DLL injection. |
CVE-2021-36215 | Medium | 5.3 | 2021-09-08 | LINE client for iOS 10.21.3 and before allows address bar spoofing due to inappropriate address handling. |
CVE-2021-32805 | High | 7.2 | 2021-09-08 | Flask-AppBuilder is an application development framework, built on top of Flask. In affected versions if using Flask-AppBuilder OAuth, an attacker can share a… |
CVE-2021-31274 | Medium | 5.4 | 2021-09-08 | In LibreNMS < 21.3.0, a stored XSS vulnerability was identified in the API Access page due to insufficient sanitization of the $api->description variable. As a… |
CVE-2021-40346 | High | 7.5 | 2021-09-08 | An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker… |
CVE-2021-3055 | Medium | 6.5 | 2021-09-08 | An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administra… |
CVE-2021-3054 | High | 7.2 | 2021-09-08 | A time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with… |
CVE-2021-3053 | High | 7.5 | 2021-09-08 | An improper handling of exceptional conditions vulnerability exists in the Palo Alto Networks PAN-OS dataplane that enables an unauthenticated network-based at… |
CVE-2021-3052 | High | 8.0 | 2021-09-08 | A reflected cross-site scripting (XSS) vulnerability in the Palo Alto Network PAN-OS web interface enables an authenticated network-based attacker to mislead a… |
CVE-2021-3051 | High | 8.1 | 2021-09-08 | An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR SAML authentication that enables an unauthenticated network-based atta… |
CVE-2021-3049 | Low | 2.6 | 2021-09-08 | An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with investigation read p… |
CVE-2021-33982 | High | 7.5 | 2021-09-08 | An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spo… |
CVE-2021-33981 | Medium | 4.3 | 2021-09-08 | An insecure, direct object vulnerability in hunting/fishing license retrieval function of the "Fish | Hunt FL" iOS app versions 3.8.0 and earlier allows a remo… |
CVE-2021-28571 | High | 8.3 | 2021-09-08 | Adobe After Effects version 18.1 (and earlier) is affected by a potential Command injection vulnerability when chained with a development and debugging tool fo… |
CVE-2021-28569 | Medium | 4.3 | 2021-09-08 | Adobe Media Encoder version 15.1 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated att… |
CVE-2021-28568 | Medium | 5.8 | 2021-09-08 | Adobe Genuine Services version 7.1 (and earlier) is affected by an Insecure file permission vulnerability during installation process. A local authenticated at… |
CVE-2021-28567 | Medium | 6.5 | 2021-09-08 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the custom… |
CVE-2021-28566 | Low | 3.7 | 2021-09-08 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploadin… |
CVE-2021-21105 | High | 8.8 | 2021-09-08 | Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacke… |
CVE-2021-21104 | High | 8.8 | 2021-09-08 | Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacke… |
CVE-2021-21103 | Medium | 4.3 | 2021-09-08 | Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacke… |
CVE-2021-35526 | Medium | 6.3 | 2021-09-08 | Backup file without encryption vulnerability is found in Hitachi ABB Power Grids System Data Manager – SDM600 allows attacker to gain access to sensitive infor… |
CVE-2021-21897 | High | 8.8 | 2021-09-08 | A code execution vulnerability exists in the DL_Dxf::handleLWPolylineData functionality of Ribbonsoft dxflib 3.17.0. A specially-crafted .dxf file can lead to… |
CVE-2021-30719 | High | 7.1 | 2021-09-08 | A local user may be able to cause unexpected system termination or read kernel memory. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Cata… |
CVE-2021-30718 | Medium | 4.3 | 2021-09-08 | This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4. A non-privileged user may be able to modify restricted settings. |
CVE-2021-30717 | High | 8.1 | 2021-09-08 | A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security… |
CVE-2021-30716 | Medium | 5.9 | 2021-09-08 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-… |
CVE-2021-30715 | High | 7.5 | 2021-09-08 | A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Security Update 2021-003 Catalina, macO… |
CVE-2021-30714 | Medium | 6.3 | 2021-09-08 | A race condition was addressed with improved state handling. This issue is fixed in iOS 14.6 and iPadOS 14.6. An application may be able to cause unexpected sy… |
CVE-2021-30713 | High | 7.8 | 2021-09-08 | A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy pr… |
CVE-2021-30712 | High | 7.8 | 2021-09-08 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-… |
CVE-2021-30710 | High | 7.1 | 2021-09-08 | A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 14.6, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS… |
CVE-2021-30709 | Medium | 5.5 | 2021-09-08 | This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave, i… |
CVE-2021-30708 | High | 7.8 | 2021-09-08 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Upda… |
CVE-2021-30707 | High | 8.8 | 2021-09-08 | This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4, tvOS 14.6, watchOS 7.5, iOS 14.6 and iPadOS 14.6. Processing a malici… |
CVE-2021-30706 | Medium | 5.5 | 2021-09-08 | Processing a maliciously crafted image may lead to disclosure of user information. This issue is fixed in macOS Big Sur 11.4, tvOS 14.6, watchOS 7.5, iOS 14.6… |
CVE-2021-30705 | Medium | 5.5 | 2021-09-08 | This issue was addressed with improved checks. This issue is fixed in tvOS 14.6, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6, Security Update 202… |
CVE-2021-30704 | High | 7.8 | 2021-09-08 | A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6, Securi… |
CVE-2021-30703 | High | 7.8 | 2021-09-08 | A double free issue was addressed with improved memory management. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Security Update 2021-004 Catalin… |
CVE-2021-30702 | Medium | 4.6 | 2021-09-08 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-… |