2021 CVEs (page 128)
Page 128 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-34436 | Critical | 9.8 | 2021-09-02 | In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extens… |
CVE-2021-39322 | Medium | 6.1 | 2021-09-02 | The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file. On certain configurations including Ap… |
CVE-2021-38314 | Medium | 5.3 | 2021-09-02 | The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `incl… |
CVE-2021-38312 | High | 7.1 | 2021-09-02 | The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered unde… |
CVE-2021-36019 | Low | 3.3 | 2021-09-02 | Adobe After Effects version 18.2.1 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated a… |
CVE-2021-36018 | Low | 3.3 | 2021-09-02 | Adobe After Effects version 18.2.1 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated a… |
CVE-2021-36017 | High | 7.8 | 2021-09-02 | Adobe After Effects version 18.2.1 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated att… |
CVE-2021-35996 | High | 7.8 | 2021-09-02 | Adobe After Effects version 18.2.1 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated att… |
CVE-2021-35995 | Low | 3.3 | 2021-09-02 | Adobe After Effects version 18.2.1 (and earlier) is affected by an Improper input validation vulnerability when parsing a specially crafted file. An unauthenti… |
CVE-2021-35994 | High | 7.8 | 2021-09-02 | Adobe After Effects version 18.2.1 (and earlier) is affected by an out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated… |
CVE-2021-35993 | High | 7.8 | 2021-09-02 | Adobe After Effects version 18.2.1 (and earlier) is affected by an out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated… |
CVE-2021-28565 | Medium | 4.3 | 2021-09-02 | Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by an Out-of-bound… |
CVE-2021-28564 | High | 8.8 | 2021-09-02 | Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by an Out-of-bound… |
CVE-2021-28561 | High | 8.8 | 2021-09-02 | Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a memory corrup… |
CVE-2021-28560 | High | 8.8 | 2021-09-02 | Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Heap-based Bu… |
CVE-2021-28559 | Medium | 5.3 | 2021-09-02 | Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by an Information… |
CVE-2021-28558 | High | 8.8 | 2021-09-02 | Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by an Heap-based b… |
CVE-2021-28557 | Medium | 4.3 | 2021-09-02 | Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by an Out-of-bound… |
CVE-2021-28555 | Medium | 6.5 | 2021-09-02 | Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by an Out-of-bound… |
CVE-2021-28553 | High | 8.8 | 2021-09-02 | Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by an Use After Fr… |
CVE-2021-28550 | High | 8.8 | 2021-09-02 | Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Fre… |
CVE-2021-27578 | Medium | 6.1 | 2021-09-02 | Cross Site Scripting vulnerability in markdown interpreter of Apache Zeppelin allows an attacker to inject malicious scripts. This issue affects Apache Zeppeli… |
CVE-2021-22793 | High | 7.2 | 2021-09-02 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exist in AccuSine PCS+ / PFV+ (Versions prior to V1.6.7) and AccuSine PCSn… |
CVE-2021-22792 | High | 7.5 | 2021-09-02 | A CWE-476: NULL Pointer Dereference vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller a… |
CVE-2021-22791 | Medium | 6.5 | 2021-09-02 | A CWE-787: Out-of-bounds Write vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller applic… |
CVE-2021-22790 | Medium | 6.5 | 2021-09-02 | A CWE-125: Out-of-bounds Read vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller applica… |
CVE-2021-22789 | Medium | 6.5 | 2021-09-02 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability that could cause a Denial of Service on the Modicon PLC contro… |
CVE-2021-22775 | High | 7.8 | 2021-09-02 | A CWE-427: Uncontrolled Search Path Element vulnerability exists in GP-Pro EX,V4.09.250 and prior, that could cause local code execution with elevated privileg… |
CVE-2021-22704 | Critical | 9.1 | 2021-09-02 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions p… |
CVE-2021-22525 | Medium | 5.5 | 2021-09-02 | This release addresses a potential information leakage vulnerability in NetIQ Access Manager versions prior to 5.0.1 |
CVE-2021-39187 | High | 7.5 | 2021-09-02 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a… |
CVE-2021-21086 | High | 7.8 | 2021-09-02 | Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an Out-of-bound… |
CVE-2021-33938 | High | 7.5 | 2021-09-02 | Buffer overflow vulnerability in function prune_to_recommended in src/policy.c in libsolv before 0.7.17 allows attackers to cause a Denial of Service. |
CVE-2021-33930 | High | 7.5 | 2021-09-02 | Buffer overflow vulnerability in function pool_installable_whatprovides in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service. |
CVE-2021-33929 | High | 7.5 | 2021-09-02 | Buffer overflow vulnerability in function pool_disabled_solvable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service. |
CVE-2021-33928 | High | 7.5 | 2021-09-02 | Buffer overflow vulnerability in function pool_installable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service. |
CVE-2021-3758 | Medium | 6.5 | 2021-09-02 | bookstack is vulnerable to Server-Side Request Forgery (SSRF) |
CVE-2021-3757 | Critical | 9.8 | 2021-09-02 | immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-34765 | Medium | 4.3 | 2021-09-02 | A vulnerability in the web UI for Cisco Nexus Insights could allow an authenticated, remote attacker to view and download files related to the web application… |
CVE-2021-34759 | Medium | 4.8 | 2021-09-02 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker with admin… |
CVE-2021-34746 | Critical | 9.8 | 2021-09-02 | A vulnerability in the TACACS+ authentication, authorization and accounting (AAA) feature of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow a… |
CVE-2021-34733 | Medium | 5.5 | 2021-09-02 | A vulnerability in the CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, local attacker to a… |
CVE-2021-34732 | Medium | 6.1 | 2021-09-02 | A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to conduct a cr… |
CVE-2021-31798 | Medium | 4.4 | 2021-09-02 | The effective key space used to encrypt the cache in CyberArk Credential Provider prior to 12.1 has low entropy, and under certain conditions a local malicious… |
CVE-2021-31796 | High | 7.5 | 2021-09-02 | An inadequate encryption vulnerability discovered in CyberArk Credential Provider before 12.1 may lead to Information Disclosure. An attacker may realistically… |
CVE-2021-31797 | Medium | 5.1 | 2021-09-02 | The user identification mechanism used by CyberArk Credential Provider prior to 12.1 is susceptible to a local host race condition, leading to password disclos… |
CVE-2021-39119 | Medium | 5.3 | 2021-09-01 | Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue even after their Ji… |
CVE-2021-39115 | High | 7.2 | 2021-09-01 | Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Jav… |
CVE-2021-40387 | High | 8.8 | 2021-09-01 | An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is authenticated remote code execution. |
CVE-2021-40385 | High | 8.8 | 2021-09-01 | An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is a privilege escalation from read-only user to admi… |
CVE-2021-39186 | Medium | 4.3 | 2021-09-01 | GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, the username column of the Glo… |
CVE-2021-39185 | Critical | 9.1 | 2021-09-01 | Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 thr… |
CVE-2021-39181 | High | 8.8 | 2021-09-01 | OpenOlat is a web-based learning management system (LMS). Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file (e.g. a course) any cl… |
CVE-2021-30355 | High | 8.6 | 2021-09-01 | Amazon Kindle e-reader prior to and including version 5.13.4 improperly manages privileges, allowing the framework user to elevate privileges to root. |
CVE-2021-23438 | Medium | 5.6 | 2021-09-01 | This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperti… |
CVE-2021-40382 | High | 7.5 | 2021-09-01 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. mjpegStreamer.cgi allows video screenshot access. |
CVE-2021-40381 | High | 7.5 | 2021-09-01 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. index_MJpeg.cgi allows video access. |
CVE-2021-40380 | High | 7.5 | 2021-09-01 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. cameralist.cgi and setcamera.cgi disclose credentials. |
CVE-2021-40379 | High | 7.5 | 2021-09-01 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. rstp://.../medias2 does not require authorization. |
CVE-2021-40378 | High | 8.1 | 2021-09-01 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. /cgi-bin/support/killps.cgi deletes all data from the device. |
CVE-2021-34435 | High | 8.8 | 2021-09-01 | In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it i… |
CVE-2021-30354 | High | 8.6 | 2021-09-01 | Amazon Kindle e-reader prior to and including version 5.13.4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function CJBig2Image::e… |
CVE-2021-23436 | Medium | 5.6 | 2021-09-01 | This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path… |
CVE-2021-29853 | Medium | 4.3 | 2021-09-01 | IBM Planning Analytics 2.0 could expose information that could be used to to create attacks by not validating the return values from some methods or functions… |
CVE-2021-29852 | Medium | 5.4 | 2021-09-01 | IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2021-29851 | Medium | 4.3 | 2021-09-01 | IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. IBM X-Force ID: 205527. |
CVE-2021-40350 | Critical | 9.8 | 2021-09-01 | webctrl.cgi.elf on Christie Digital DWU850-GS V06.46 devices allows attackers to perform any desired action via a crafted query containing an unspecified Cooki… |
CVE-2021-39847 | High | 7.8 | 2021-09-01 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by a stack-based buffer overflow vulnerability potentially resulting in arbitrary code execution in th… |
CVE-2021-39817 | High | 7.8 | 2021-09-01 | Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious Bridge file, potentially resul… |
CVE-2021-39816 | High | 7.8 | 2021-09-01 | Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious Bridge file, potentially resul… |
CVE-2021-39320 | Medium | 6.1 | 2021-09-01 | The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations incl… |
CVE-2021-36079 | High | 7.8 | 2021-09-01 | Adobe Bridge version 11.1 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted .SGI file, which could result in a read past… |
CVE-2021-36078 | High | 7.8 | 2021-09-01 | Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious Bridge file, potentially resul… |
CVE-2021-36077 | Medium | 5.5 | 2021-09-01 | Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious SVG file, potentially resultin… |
CVE-2021-36076 | High | 7.8 | 2021-09-01 | Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious Bridge file, potentially resul… |
CVE-2021-36075 | High | 7.8 | 2021-09-01 | Adobe Bridge version 11.1 (and earlier) is affected by a Buffer Overflow vulnerability due to insecure handling of a malicious Bridge file, potentially resulti… |
CVE-2021-36074 | Low | 3.3 | 2021-09-01 | Adobe Bridge versions 11.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory. An attacker cou… |
CVE-2021-36073 | High | 7.8 | 2021-09-01 | Adobe Bridge version 11.1 (and earlier) is affected by a heap-based buffer overflow vulnerability when parsing a crafted .SGI file. An attacker could leverage… |
CVE-2021-36072 | High | 7.8 | 2021-09-01 | Adobe Bridge versions 11.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of t… |
CVE-2021-36071 | Low | 3.3 | 2021-09-01 | Adobe Bridge versions 11.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory. An attacker cou… |
CVE-2021-36070 | High | 7.8 | 2021-09-01 | Adobe Media Encoder version 15.1 (and earlier) is affected by an improper memory access vulnerability when parsing a crafted .SVG file. An attacker could lever… |
CVE-2021-36069 | High | 7.8 | 2021-09-01 | Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious Bridge file, potentially resul… |
CVE-2021-36068 | High | 7.8 | 2021-09-01 | Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious Bridge file, potentially resul… |
CVE-2021-36067 | High | 7.8 | 2021-09-01 | Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious Bridge file, potentially resul… |
CVE-2021-36066 | High | 7.8 | 2021-09-01 | Adobe Photoshop versions 21.2.10 (and earlier) and 22.4.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary cod… |
CVE-2021-36065 | High | 7.8 | 2021-09-01 | Adobe Photoshop versions 21.2.10 (and earlier) and 22.4.3 (and earlier) are affected by a heap-based buffer overflow vulnerability that could result in arbitra… |
CVE-2021-36064 | High | 7.8 | 2021-09-01 | XMP Toolkit version 2020.1 (and earlier) is affected by a Buffer Underflow vulnerability which could result in arbitrary code execution in the context of the c… |
CVE-2021-36063 | Medium | 5.4 | 2021-09-01 | Adobe Connect version 11.2.2 (and earlier) is affected by a Reflected Cross-site Scripting vulnerability that could be abused by an attacker to inject maliciou… |
CVE-2021-36062 | Medium | 5.4 | 2021-09-01 | Adobe Connect version 11.2.2 (and earlier) is affected by a Reflected Cross-site Scripting vulnerability that could be abused by an attacker to inject maliciou… |
CVE-2021-36061 | Medium | 5.4 | 2021-09-01 | Adobe Connect version 11.2.2 (and earlier) is affected by a secure design principles violation vulnerability via the 'pbMode' parameter. An unauthenticated att… |
CVE-2021-36059 | High | 7.8 | 2021-09-01 | Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious Bridge file, potentially resul… |
CVE-2021-36058 | Medium | 5.5 | 2021-09-01 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by an Integer Overflow vulnerability potentially resulting in application-level denial of service in t… |
CVE-2021-36057 | Low | 3.3 | 2021-09-01 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by a write-what-where condition vulnerability caused during the application's memory allocation proces… |
CVE-2021-36056 | Medium | 5.5 | 2021-09-01 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by a buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of… |
CVE-2021-36055 | High | 7.8 | 2021-09-01 | XMP Toolkit SDK versions 2020.1 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2021-36054 | Low | 3.3 | 2021-09-01 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by a buffer overflow vulnerability potentially resulting in local application denial of service in the… |
CVE-2021-36053 | Low | 3.3 | 2021-09-01 | XMP Toolkit SDK versions 2020.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory. An attacke… |
CVE-2021-36052 | High | 7.8 | 2021-09-01 | XMP Toolkit version 2020.1 (and earlier) is affected by a memory corruption vulnerability, potentially resulting in arbitrary code execution in the context of… |
CVE-2021-36050 | High | 7.8 | 2021-09-01 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by a buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of… |
CVE-2021-36049 | High | 7.8 | 2021-09-01 | Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious Bridge file, potentially resul… |