2021 CVEs (page 129)
Page 129 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-36048 | High | 7.8 | 2021-09-01 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by an Improper Input Validation vulnerability potentially resulting in arbitrary code execution in the… |
CVE-2021-36047 | High | 7.8 | 2021-09-01 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by an Improper Input Validation vulnerability potentially resulting in arbitrary code execution in the… |
CVE-2021-36046 | High | 7.8 | 2021-09-01 | XMP Toolkit version 2020.1 (and earlier) is affected by a memory corruption vulnerability, potentially resulting in arbitrary code execution in the context of… |
CVE-2021-36045 | Low | 3.3 | 2021-09-01 | XMP Toolkit SDK versions 2020.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory. An attacke… |
CVE-2021-36044 | High | 7.5 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An un… |
CVE-2021-36043 | High | 8.0 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmail… |
CVE-2021-36042 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the… |
CVE-2021-36041 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An at… |
CVE-2021-36040 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An at… |
CVE-2021-36039 | Medium | 6.5 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via th… |
CVE-2021-36038 | Medium | 6.5 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the… |
CVE-2021-36037 | Medium | 6.5 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability… |
CVE-2021-36035 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An at… |
CVE-2021-36034 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An at… |
CVE-2021-36033 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Mod… |
CVE-2021-36032 | High | 8.3 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An au… |
CVE-2021-36031 | High | 7.2 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a Path Traversal vulnerability via the `theme[pre… |
CVE-2021-36030 | High | 7.5 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability during… |
CVE-2021-36029 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability… |
CVE-2021-36028 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a conf… |
CVE-2021-36027 | Medium | 6.5 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability that… |
CVE-2021-36026 | Medium | 6.5 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in th… |
CVE-2021-36025 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while… |
CVE-2021-36024 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Us… |
CVE-2021-36022 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Upd… |
CVE-2021-36020 | High | 8.2 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' fiel… |
CVE-2021-36012 | Medium | 6.5 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql… |
CVE-2021-36002 | Medium | 5.0 | 2021-09-01 | Adobe Captivate version 11.5.5 (and earlier) is affected by an Creation of Temporary File In Directory With Incorrect Permissions vulnerability that could resu… |
CVE-2021-35218 | High | 8.9 | 2021-09-01 | Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the O… |
CVE-2021-35216 | High | 8.9 | 2021-09-01 | Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. An Authentica… |
CVE-2021-35215 | High | 8.9 | 2021-09-01 | Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulne… |
CVE-2021-23428 | High | 8.6 | 2021-09-01 | This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing sanitation of the u… |
CVE-2021-23427 | High | 8.6 | 2021-09-01 | This affects all versions of package elFinder.NetCore. The ExtractAsync function within the FileSystem is vulnerable to arbitrary extraction due to insufficien… |
CVE-2021-23426 | Medium | 5.6 | 2021-09-01 | This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function. |
CVE-2021-39170 | High | 8.0 | 2021-09-01 | Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of custom metadat… |
CVE-2021-39166 | High | 8.0 | 2021-09-01 | Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version p… |
CVE-2021-35508 | High | 8.8 | 2021-09-01 | NMSAccess32.exe in TeraRecon AQNetClient 4.4.13 allows attackers to execute a malicious binary with SYSTEM privileges via a low-privileged user account. To exp… |
CVE-2021-40352 | Medium | 6.5 | 2021-09-01 | OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of all users. |
CVE-2021-39379 | Critical | 9.8 | 2021-09-01 | A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands… |
CVE-2021-39378 | Critical | 9.8 | 2021-09-01 | A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands… |
CVE-2021-39377 | Critical | 9.8 | 2021-09-01 | A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands… |
CVE-2021-39373 | High | 7.8 | 2021-09-01 | Samsung Drive Manager 2.0.104 on Samsung H3 devices allows attackers to bypass intended access controls on disk management. WideCharToMultiByte, WideCharStr, a… |
CVE-2021-37151 | Medium | 5.3 | 2021-09-01 | CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy… |
CVE-2021-38703 | High | 8.8 | 2021-09-01 | Wireless devices running certain Arcadyan-derived firmware (such as KPN Experia WiFi 1.00.15) do not properly sanitise user input to the syslog configuration f… |
CVE-2021-35238 | Medium | 4.8 | 2021-09-01 | User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website. |
CVE-2021-39109 | High | 7.5 | 2021-09-01 | The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerabilit… |
CVE-2021-37415 | Critical | 9.8 | 2021-09-01 | Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. |
CVE-2021-33582 | High | 7.5 | 2021-09-01 | Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table inter… |
CVE-2021-40353 | Critical | 9.8 | 2021-09-01 | A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL co… |
CVE-2021-36235 | High | 7.8 | 2021-09-01 | An issue was discovered in Ivanti Workspace Control before 10.6.30.0. A locally authenticated user with low privileges can bypass File and Folder Security by l… |
CVE-2021-22003 | High | 7.5 | 2021-08-31 | VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 ma… |
CVE-2021-22002 | Critical | 9.8 | 2021-08-31 | VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom hos… |
CVE-2021-22029 | High | 7.5 | 2021-08-31 | VMware Workspace ONE UEM REST API contains a denial of service vulnerability. A malicious actor with access to /API/system/admins/session could cause an API de… |
CVE-2021-40085 | Medium | 6.5 | 2021-08-31 | An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a c… |
CVE-2021-39180 | High | 8.1 | 2021-08-31 | OpenOLAT is a web-based learning management system (LMS). A path traversal vulnerability exists in versions prior to 15.3.18, 15.5.3, and 16.0.0. Using a speci… |
CVE-2021-39176 | High | 7.5 | 2021-08-31 | detect-character-encoding is a package for detecting character encoding using ICU. In detect-character-encoding v0.3.0 and earlier, allocated memory is not rel… |
CVE-2021-37794 | Medium | 5.4 | 2021-08-31 | A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file… |
CVE-2021-36234 | Medium | 5.5 | 2021-08-31 | Use of a hard-coded cryptographic key in MIK.starlight 7.9.5.24363 allows local users to decrypt credentials via unspecified vectors. |
CVE-2021-36233 | Medium | 6.5 | 2021-08-31 | The function AdminGetFirstFileContentByFilePath in MIK.starlight 7.9.5.24363 allows (by design) an authenticated attacker to read arbitrary files from the file… |
CVE-2021-36232 | High | 8.8 | 2021-08-31 | Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to escalate privileges. |
CVE-2021-36231 | High | 8.8 | 2021-08-31 | Deserialization of untrusted data in multiple functions in MIK.starlight 7.9.5.24363 allows authenticated remote attackers to execute operating system commands… |
CVE-2021-27668 | Medium | 5.3 | 2021-08-31 | HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3. |
CVE-2021-3634 | Medium | 6.5 | 2021-08-31 | A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them… |
CVE-2021-39164 | Low | 3.1 | 2021-08-31 | Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list… |
CVE-2021-39135 | High | 8.2 | 2021-08-31 | `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guar… |
CVE-2021-39134 | High | 8.2 | 2021-08-31 | `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to gu… |
CVE-2021-37713 | High | 8.2 | 2021-08-31 | The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerabil… |
CVE-2021-37712 | High | 8.2 | 2021-08-31 | The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerabil… |
CVE-2021-37701 | High | 8.2 | 2021-08-31 | The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerabili… |
CVE-2021-35212 | High | 8.9 | 2021-08-31 | An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team. A blind Boolean SQL injection which could le… |
CVE-2021-22944 | High | 8.0 | 2021-08-31 | A vulnerability found in UniFi Protect application V1.18.1 and earlier allows a malicious actor with a view-only role and network access to gain the same privi… |
CVE-2021-22943 | Critical | 9.6 | 2021-08-31 | A vulnerability found in UniFi Protect application V1.18.1 and earlier permits a malicious actor who has already gained access to a network to subsequently con… |
CVE-2021-22929 | Medium | 6.1 | 2021-08-31 | An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2… |
CVE-2021-22684 | High | 7.5 | 2021-08-31 | Tizen RT RTOS version 3.0.GBB is vulnerable to integer wrap-around in functions_calloc and mm_zalloc. This improper memory assignment can lead to arbitrary mem… |
CVE-2021-21811 | Critical | 9.8 | 2021-08-31 | A memory corruption vulnerability exists in the XML-parsing CreateLabelOrAttrib functionality of AT&T Labs’ Xmill 0.7. A specially crafted XML file can lead to… |
CVE-2021-39163 | Low | 3.1 | 2021-08-31 | Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the name, avatar, to… |
CVE-2021-35240 | Medium | 6.5 | 2021-08-31 | A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'. |
CVE-2021-35239 | High | 7.5 | 2021-08-31 | A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink. |
CVE-2021-35223 | High | 8.5 | 2021-08-31 | The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that ca… |
CVE-2021-35213 | High | 8.9 | 2021-08-31 | An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allows a guest user to… |
CVE-2021-29907 | High | 8.8 | 2021-08-31 | IBM OpenPages with Watson 8.1 and 8.2 could allow an authenticated user to upload a file that could execute arbitrary code on the system. IBM X-Force ID: 20763… |
CVE-2021-21681 | Medium | 5.5 | 2021-08-31 | Jenkins Nomad Plugin 0.7.4 and earlier stores Docker passwords unencrypted in the global config.xml file on the Jenkins controller where they can be viewed by… |
CVE-2021-21680 | High | 7.1 | 2021-08-31 | Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks. |
CVE-2021-21679 | High | 8.8 | 2021-08-31 | Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. |
CVE-2021-21678 | High | 8.8 | 2021-08-31 | Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. |
CVE-2021-21677 | High | 8.8 | 2021-08-31 | Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializes from disk, resulti… |
CVE-2021-35222 | High | 8.0 | 2021-08-31 | This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page. |
CVE-2021-35221 | Medium | 6.3 | 2021-08-31 | Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts Settings page. |
CVE-2021-39316 | High | 7.5 | 2021-08-31 | The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dz… |
CVE-2021-35220 | High | 8.1 | 2021-08-31 | Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page. |
CVE-2021-35219 | Medium | 6.0 | 2021-08-31 | ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page. |
CVE-2021-3749 | High | 7.5 | 2021-08-31 | axios is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-34581 | High | 7.5 | 2021-08-31 | Missing Release of Resource after Effective Lifetime vulnerability in OpenSSL implementation of WAGO 750-831/xxx-xxx, 750-880/xxx-xxx, 750-881, 750-889 in vers… |
CVE-2021-34578 | Critical | 9.8 | 2021-08-31 | This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed request… |
CVE-2021-34565 | Critical | 9.8 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials. |
CVE-2021-34564 | Medium | 5.5 | 2021-08-31 | Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPERL+FUCHS WirelessHAR… |
CVE-2021-34563 | Low | 3.3 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client… |
CVE-2021-34562 | Medium | 5.4 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response. |
CVE-2021-34561 | High | 7.5 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Atta… |
CVE-2021-34560 | Medium | 5.5 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacke… |