2021 CVEs (page 126)
Page 126 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-28580 | High | 8.8 | 2021-09-08 | Medium by Adobe version 2.4.5.331 (and earlier) is affected by a buffer overflow vulnerability when parsing a crafted file. An unauthenticated attacker could l… |
CVE-2021-36695 | Medium | 5.4 | 2021-09-08 | Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in the download file feature on… |
CVE-2021-1972 | Critical | 9.8 | 2021-09-08 | Possible buffer overflow due to improper validation of device types during P2P search in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdrag… |
CVE-2021-1930 | Medium | 5.5 | 2021-09-08 | Possible out of bounds read due to incorrect validation of incoming buffer length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon C… |
CVE-2021-1929 | Medium | 6.2 | 2021-09-08 | Lack of strict validation of bootmode can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer I… |
CVE-2021-1928 | Medium | 4.6 | 2021-09-08 | Buffer over read could occur due to incorrect check of buffer size while flashing emmc devices in Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon… |
CVE-2021-1923 | High | 7.8 | 2021-09-08 | Incorrect pointer argument passed to trusted application TA could result in un-intended memory operations in Snapdragon Auto, Snapdragon Compute, Snapdragon Co… |
CVE-2021-1920 | Critical | 9.8 | 2021-09-08 | Integer underflow can occur due to improper handling of incoming RTCP packets in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consu… |
CVE-2021-1919 | Critical | 9.8 | 2021-09-08 | Integer underflow can occur when the RTCP length is lesser than than the actual blocks present in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2021-1916 | Critical | 9.8 | 2021-09-08 | Possible buffer underflow due to lack of check for negative indices values when processing user provided input in Snapdragon Auto, Snapdragon Compute, Snapdrag… |
CVE-2021-1914 | High | 7.5 | 2021-09-08 | Loop with unreachable exit condition may occur due to improper handling of unsupported input in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, S… |
CVE-2021-1904 | Medium | 6.2 | 2021-09-08 | Child process can leak information from parent process due to numeric pids are getting compared and these pid can be reused in Snapdragon Auto, Snapdragon Comp… |
CVE-2021-40377 | Medium | 5.4 | 2021-09-08 | SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus allowing one to inject HTML and/or JavaSc… |
CVE-2021-36182 | High | 8.8 | 2021-09-08 | A Improper neutralization of special elements used in a command ('Command Injection') in Fortinet FortiWeb version 6.3.13 and below allows attacker to execute… |
CVE-2021-36179 | High | 8.0 | 2021-09-08 | A stack-based buffer overflow in Fortinet FortiWeb version 6.3.14 and below, 6.2.4 and below allows attacker to execute unauthorized code or commands via craft… |
CVE-2021-23404 | High | 7.6 | 2021-09-08 | This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated… |
CVE-2021-39122 | Medium | 5.3 | 2021-09-08 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability i… |
CVE-2021-39121 | Medium | 4.3 | 2021-09-08 | Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an Informati… |
CVE-2021-39116 | Medium | 5.5 | 2021-09-08 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulner… |
CVE-2021-37145 | High | 7.2 | 2021-09-07 | A command-injection vulnerability in an authenticated Telnet connection in Poly (formerly Polycom) CX5500 and CX5100 1.3.5 leads an attacker to Privilege Escal… |
CVE-2021-32802 | Critical | 9.3 | 2021-09-07 | Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image type… |
CVE-2021-32801 | Medium | 5.5 | 2021-09-07 | Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive k… |
CVE-2021-32800 | High | 8.1 | 2021-09-07 | Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus… |
CVE-2021-39501 | Medium | 6.1 | 2021-09-07 | EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function. |
CVE-2021-39500 | High | 7.5 | 2021-09-07 | Eyoucms 1.5.4 is vulnerable to Directory Traversal. Due to a lack of input data sanitizaton in param tpldir, filename, type, nid an attacker can inject "../" t… |
CVE-2021-37629 | Medium | 5.3 | 2021-09-07 | Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint… |
CVE-2021-37628 | High | 7.5 | 2021-09-07 | Nextcloud Richdocuments is an open source collaborative office suite. In affected versions the File Drop features ("Upload Only" public link shares in Nextclou… |
CVE-2021-32766 | Medium | 5.3 | 2021-09-07 | Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application retur… |
CVE-2021-40143 | High | 8.2 | 2021-09-07 | Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose se… |
CVE-2021-39503 | High | 7.2 | 2021-09-07 | PHPMyWind 5.6 is vulnerable to Remote Code Execution. Becase input is filtered without "<, >, ?, =, `,...." In WriteConfig() function, an attacker can inject p… |
CVE-2021-39499 | Medium | 6.1 | 2021-09-07 | A Cross-site scripting (XSS) vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the `title` p… |
CVE-2021-39497 | Critical | 9.8 | 2021-09-07 | eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the saveRemote() function. |
CVE-2021-39496 | Medium | 5.4 | 2021-09-07 | Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into `filename` param to trigger Reflected XSS. |
CVE-2021-39194 | Medium | 4.3 | 2021-09-07 | kaml is an open source implementation of the YAML format with support for kotlinx.serialization. In affected versions attackers that could provide arbitrary YA… |
CVE-2021-38707 | Medium | 5.4 | 2021-09-07 | Persistent cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account paramete… |
CVE-2021-38706 | High | 8.8 | 2021-09-07 | messages_load.php in ClinicCases 7.3.3 suffers from a blind SQL injection vulnerability, which allows low-privileged attackers to execute arbitrary SQL command… |
CVE-2021-38705 | High | 8.8 | 2021-09-07 | ClinicCases 7.3.3 is affected by Cross-Site Request Forgery (CSRF). A successful attack would consist of an authenticated user following a malicious link, resu… |
CVE-2021-38704 | Medium | 6.1 | 2021-09-07 | Multiple reflected cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary JavaScript by craftin… |
CVE-2021-37631 | Medium | 6.5 | 2021-09-07 | Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected vers… |
CVE-2021-37630 | Medium | 6.5 | 2021-09-07 | Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application allowed any user t… |
CVE-2021-35948 | Medium | 5.4 | 2021-09-07 | Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can for… |
CVE-2021-35946 | Critical | 9.8 | 2021-09-07 | A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own perm… |
CVE-2021-32782 | Medium | 5.8 | 2021-09-07 | Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a… |
CVE-2021-39199 | Critical | 10.0 | 2021-09-07 | remark-html is an open source nodejs library which compiles Markdown to HTML. In affected versions the documentation of remark-html has mentioned that it was s… |
CVE-2021-39196 | High | 7.7 | 2021-09-07 | pcapture is an open source dumpcap web service interface . In affected versions this vulnerability allows an authenticated but unprivileged user to use the RES… |
CVE-2021-39195 | High | 7.7 | 2021-09-07 | Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" a… |
CVE-2021-35949 | Medium | 5.3 | 2021-09-07 | The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about… |
CVE-2021-35947 | Medium | 5.3 | 2021-09-07 | The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share b… |
CVE-2021-39197 | Medium | 6.3 | 2021-09-07 | better_errors is an open source replacement for the standard Rails error page with more information rich error pages. It is also usable outside of Rails in any… |
CVE-2021-38142 | High | 8.8 | 2021-09-07 | Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network can achieve remote… |
CVE-2021-40539 | Critical | 9.8 | 2021-09-07 | Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. |
CVE-2021-38123 | Medium | 6.1 | 2021-09-07 | Open Redirect vulnerability in Micro Focus Network Automation, affecting Network Automation versions 10.4x, 10.5x, 2018.05, 2018.11, 2019.05, 2020.02, 2020.08… |
CVE-2021-39263 | High | 7.8 | 2021-09-07 | A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. |
CVE-2021-39262 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause an out-of-bounds access in ntfs_decompress in NTFS-3G < 2021.8.22. |
CVE-2021-39261 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause a heap-based buffer overflow in ntfs_compressed_pwrite in NTFS-3G < 2021.8.22. |
CVE-2021-39260 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause an out-of-bounds access in ntfs_inode_sync_standard_information in NTFS-3G < 2021.8.22. |
CVE-2021-39259 | High | 7.8 | 2021-09-07 | A crafted NTFS image can trigger an out-of-bounds access, caused by an unsanitized attribute length in ntfs_inode_lookup_by_name, in NTFS-3G < 2021.8.22. |
CVE-2021-39258 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22. |
CVE-2021-39257 | Medium | 5.5 | 2021-09-07 | A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs_attr_pwrite), causing stack consumption… |
CVE-2021-39256 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause a heap-based buffer overflow in ntfs_inode_lookup_by_name in NTFS-3G < 2021.8.22. |
CVE-2021-39255 | High | 7.8 | 2021-09-07 | A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in NTFS-3G < 2021.8.22. |
CVE-2021-39254 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs_attr_record_resize, in NTFS-3G < 20… |
CVE-2021-39253 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22. |
CVE-2021-39252 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G < 2021.8.22. |
CVE-2021-39251 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G < 2021.8.22. |
CVE-2021-35267 | High | 7.8 | 2021-09-07 | NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror allowing for code execution or escalation… |
CVE-2021-35266 | High | 7.8 | 2021-09-07 | In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur resulting in memory… |
CVE-2021-33287 | High | 7.8 | 2021-09-07 | In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur and allow… |
CVE-2021-33286 | High | 7.8 | 2021-09-07 | In NTFS-3G versions < 2021.8.22, when a specially crafted unicode string is supplied in an NTFS image a heap buffer overflow can occur and allow for code execu… |
CVE-2021-35269 | High | 7.8 | 2021-09-07 | NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buffer overflow can oc… |
CVE-2021-35268 | High | 7.8 | 2021-09-07 | In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow can occur allowing… |
CVE-2021-33289 | High | 7.8 | 2021-09-07 | In NTFS-3G versions < 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap buffer overflow can occur and allow for code executio… |
CVE-2021-33285 | High | 7.8 | 2021-09-07 | In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur… |
CVE-2021-27022 | Medium | 4.9 | 2021-09-07 | A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should… |
CVE-2021-39285 | Medium | 6.1 | 2021-09-07 | A XSS vulnerability exists in Versa Director Release: 16.1R2 Build: S8. An attacker can use the administration web interface URL to create a XSS based attack. |
CVE-2021-37733 | Medium | 4.9 | 2021-09-07 | A remote path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0… |
CVE-2021-37731 | Medium | 6.2 | 2021-09-07 | A local path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0.4… |
CVE-2021-37729 | Medium | 6.5 | 2021-09-07 | A remote path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0… |
CVE-2021-37728 | Medium | 6.5 | 2021-09-07 | A remote path traversal vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.8.0.1, 8.7.1.4, 8.6.0.11, 8.5.0.13. Aruba has re… |
CVE-2021-37725 | High | 8.1 | 2021-09-07 | A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prio… |
CVE-2021-37724 | High | 7.2 | 2021-09-07 | A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.16… |
CVE-2021-37723 | High | 7.2 | 2021-09-07 | A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.16… |
CVE-2021-37722 | High | 7.2 | 2021-09-07 | A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8… |
CVE-2021-37721 | High | 7.2 | 2021-09-07 | A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8… |
CVE-2021-37720 | High | 7.2 | 2021-09-07 | A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8… |
CVE-2021-37719 | High | 7.2 | 2021-09-07 | A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8… |
CVE-2021-37718 | High | 7.2 | 2021-09-07 | A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8… |
CVE-2021-37717 | High | 7.2 | 2021-09-07 | A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8… |
CVE-2021-37716 | Critical | 9.8 | 2021-09-07 | A remote buffer overflow vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0… |
CVE-2021-33599 | Medium | 4.6 | 2021-09-07 | A vulnerability affecting F-Secure Antivirus engine was discovered whereby scanning WIM archive file can lead to denial-of-service (infinite loop and freezes A… |
CVE-2021-38698 | Medium | 6.5 | 2021-09-07 | HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. F… |
CVE-2021-38617 | High | 8.8 | 2021-09-07 | In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to create a super user account with a defined… |
CVE-2021-38616 | High | 7.6 | 2021-09-07 | In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/{user-guid}/ user edition endpoint could permit any logged-in user to increase their own per… |
CVE-2021-38615 | Medium | 6.3 | 2021-09-07 | In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/sso/config/ SSO configuration endpoint allows any logged-in user (guest, standard, or admin) to v… |
CVE-2021-37219 | High | 8.8 | 2021-09-07 | HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only func… |
CVE-2021-37218 | High | 8.8 | 2021-09-07 | HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality… |
CVE-2021-36717 | Medium | 5.4 | 2021-09-07 | Synerion TimeNet version 9.21 contains a directory traversal vulnerability where, on the "Name" parameter, the attacker can return to the root directory and op… |
CVE-2021-36696 | Medium | 5.4 | 2021-09-07 | Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in social media links on a user… |
CVE-2021-36163 | Critical | 9.8 | 2021-09-07 | In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directl… |
CVE-2021-36162 | High | 8.8 | 2021-09-07 | Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). These rules are loaded into the configurati… |