2021 CVEs (page 130)
Page 130 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-34559 | Medium | 5.4 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings. |
CVE-2021-33555 | High | 7.5 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrar… |
CVE-2021-38145 | Critical | 9.8 | 2021-08-31 | An issue was discovered in Form Tools through 3.0.20. SQL Injection can occur via the export_group_id field when a low-privileged user (client) tries to export… |
CVE-2021-38144 | Medium | 5.4 | 2021-08-31 | An issue was discovered in Form Tools through 3.0.20. A low-privileged user can trigger Reflected XSS when a viewing a form via the submission_id parameter, e… |
CVE-2021-38143 | Medium | 6.1 | 2021-08-31 | An issue was discovered in Form Tools through 3.0.20. When an administrator creates a customer account, it is possible for the customer to log in and proceed w… |
CVE-2021-40330 | High | 7.5 | 2021-08-31 | git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol reques… |
CVE-2021-36981 | High | 8.8 | 2021-08-31 | In the server in SerNet verinice before 1.22.2, insecure Java deserialization allows remote authenticated attackers to execute arbitrary code. |
CVE-2021-36356 | Critical | 9.8 | 2021-08-31 | KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable… |
CVE-2021-27558 | Medium | 6.1 | 2021-08-31 | A cross site scripting (XSS) issue in EasyCorp ZenTao 12.5.3 allows remote attackers to execute arbitrary web script via various areas such as data-link-creato… |
CVE-2021-27557 | Medium | 4.3 | 2021-08-31 | A cross-site request forgery (CSRF) vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job. |
CVE-2021-27556 | High | 7.2 | 2021-08-31 | The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers (who have admin access) to execute arbitrary code by setting the type parameter to System. |
CVE-2021-39178 | High | 7.5 | 2021-08-31 | Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scripting vulnerability. In order for an instance to be affect… |
CVE-2021-39177 | High | 7.4 | 2021-08-30 | Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to… |
CVE-2021-39175 | High | 8.1 | 2021-08-30 | HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript into the speaker-no… |
CVE-2021-36692 | Medium | 6.5 | 2021-08-30 | libjxl v0.3.7 is affected by a Divide By Zero in issue in lib/extras/codec_apng.cc jxl::DecodeImageAPNG(). When encoding a malicous APNG file using cjxl, an at… |
CVE-2021-32832 | Medium | 4.3 | 2021-08-30 | Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. In Rocket.Chat before versions 3.11.3, 3.12.2, and 3.13 an is… |
CVE-2021-32831 | High | 7.5 | 2021-08-30 | Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET… |
CVE-2021-39133 | High | 7.2 | 2021-08-30 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin… |
CVE-2021-39132 | High | 8.8 | 2021-08-30 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user… |
CVE-2021-36691 | High | 7.5 | 2021-08-30 | libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image.cc jxl::PlaneBase::PlaneBase(). When encoding a malicous GIF file using cjxl, an attacke… |
CVE-2021-35062 | High | 8.1 | 2021-08-30 | A Shell Metacharacter Injection vulnerability in result.php in DRK Odenwaldkreis Testerfassung March-2021 allow an attacker with a valid token of a COVID-19 te… |
CVE-2021-34434 | Medium | 5.3 | 2021-08-30 | In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make subscriptions on a topic is revoked wh… |
CVE-2021-38343 | Medium | 4.7 | 2021-08-30 | The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSo… |
CVE-2021-38342 | High | 8.1 | 2021-08-30 | The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_post` actions, which a… |
CVE-2021-37421 | Critical | 9.8 | 2021-08-30 | Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass. |
CVE-2021-37417 | Critical | 9.8 | 2021-08-30 | Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation. |
CVE-2021-37416 | Medium | 6.1 | 2021-08-30 | Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page. |
CVE-2021-36370 | High | 7.5 | 2021-08-30 | An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displa… |
CVE-2021-35061 | Medium | 6.1 | 2021-08-30 | Multiple cross-site scripting (XSS) vulnerabilities in DRK Odenwaldkreis Testerfassung March-2021 allow remote attackers to inject arbitrary web script or HTML… |
CVE-2021-34668 | Medium | 6.4 | 2021-08-30 | The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the ~/inc/overrides/lite/rest/Folder.p… |
CVE-2021-34646 | Critical | 9.8 | 2021-08-30 | Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verificatio… |
CVE-2021-34066 | Critical | 9.8 | 2021-08-30 | An issue was discovered in EdgeGallery/developer before v1.0. There is a "Deserialization of yaml file" vulnerability that can allow attackers to execute syste… |
CVE-2021-33055 | Critical | 9.8 | 2021-08-30 | Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions. |
CVE-2021-29630 | High | 8.1 | 2021-08-30 | In FreeBSD 13.0-STABLE before n246938-0729ba2f49c9, 12.2-STABLE before r370383, 11.4-STABLE before r370381, 13.0-RELEASE before p4, 12.2-RELEASE before p10, an… |
CVE-2021-22021 | Medium | 5.4 | 2021-08-30 | VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation. An attacker with user… |
CVE-2021-3628 | Medium | 4.6 | 2021-08-30 | OpenKM Community Edition in its 6.3.10 version is vulnerable to authenticated Cross-site scripting (XSS). A remote attacker could exploit this vulnerability by… |
CVE-2021-38393 | Critical | 9.8 | 2021-08-30 | A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The app… |
CVE-2021-38391 | Critical | 9.8 | 2021-08-30 | A Blind SQL injection vulnerability exists in the /DataHandler/AM/AM_Handler.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The applica… |
CVE-2021-38390 | Critical | 9.8 | 2021-08-30 | A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The app… |
CVE-2021-33019 | High | 7.8 | 2021-08-30 | A stack-based buffer overflow vulnerability in Delta Electronics DOPSoft Version 4.00.11 and prior may be exploited by processing a specially crafted project f… |
CVE-2021-33007 | High | 7.8 | 2021-08-30 | A heap-based buffer overflow in Delta Electronics TPEditor: v1.98.06 and prior may be exploited by processing a specially crafted project file. Successful expl… |
CVE-2021-33003 | Medium | 5.5 | 2021-08-30 | Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a weak hashing algorithm. |
CVE-2021-32991 | Medium | 4.3 | 2021-08-30 | Delta Electronics DIAEnergie Version 1.7.5 and prior is vulnerable to cross-site request forgery, which may allow an attacker to cause a user to carry out an a… |
CVE-2021-32983 | Critical | 9.8 | 2021-08-30 | A Blind SQL injection vulnerability exists in the /DataHandler/Handler_CFG.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The applicati… |
CVE-2021-32967 | Critical | 9.8 | 2021-08-30 | Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to add a new administrative user without being authenticated or authorized, which ma… |
CVE-2021-32955 | Critical | 9.8 | 2021-08-30 | Delta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may allow an attacker to remotely execute code. |
CVE-2021-29631 | High | 7.8 | 2021-08-30 | In FreeBSD 13.0-STABLE before n246941-20f96f215562, 12.2-STABLE before r370400, 11.4-STABLE before r370399, 13.0-RELEASE before p4, 12.2-RELEASE before p10, an… |
CVE-2021-27663 | High | 8.2 | 2021-08-30 | A vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 allows a remote attacker to access to the system without adequate authoriz… |
CVE-2021-27020 | High | 8.8 | 2021-08-30 | Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export. |
CVE-2021-27019 | Medium | 4.3 | 2021-08-30 | PuppetDB logging included potentially sensitive system information. |
CVE-2021-27018 | High | 7.5 | 2021-08-30 | The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed by an internal certificate authority to… |
CVE-2021-22027 | High | 7.5 | 2021-08-30 | The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network… |
CVE-2021-22026 | High | 7.5 | 2021-08-30 | The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network… |
CVE-2021-22025 | High | 7.5 | 2021-08-30 | The vRealize Operations Manager API (8.x prior to 8.5) contains a broken access control vulnerability leading to unauthenticated API access. An unauthenticated… |
CVE-2021-22024 | High | 7.5 | 2021-08-30 | The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability. An unauthenticated malicious actor with network acces… |
CVE-2021-22023 | High | 7.2 | 2021-08-30 | The vRealize Operations Manager API (8.x prior to 8.5) has insecure object reference vulnerability. A malicious actor with administrative access to vRealize Op… |
CVE-2021-22022 | Medium | 4.9 | 2021-08-30 | The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary file read vulnerability. A malicious actor with administrative access to vRealize… |
CVE-2021-21741 | Critical | 9.8 | 2021-08-30 | There is a command execution vulnerability in a ZTE conference management system. As some services are enabled by default, the attacker could exploit this vuln… |
CVE-2021-29743 | Medium | 5.4 | 2021-08-30 | IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2021-29728 | Medium | 4.9 | 2021-08-30 | IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its ow… |
CVE-2021-29723 | High | 7.5 | 2021-08-30 | IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2021-29722 | High | 7.5 | 2021-08-30 | IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2021-27913 | Low | 3.5 | 2021-08-30 | The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker ca… |
CVE-2021-27912 | High | 7.1 | 2021-08-30 | Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken… |
CVE-2021-27911 | High | 8.3 | 2021-08-30 | Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's de… |
CVE-2021-27910 | High | 8.2 | 2021-08-30 | Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted i… |
CVE-2021-27909 | Medium | 6.3 | 2021-08-30 | For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL coul… |
CVE-2021-37911 | High | 8.8 | 2021-08-30 | The management interface of BenQ smart wireless conference projector does not properly control user's privilege. Attackers can access any system directory of t… |
CVE-2021-24667 | Medium | 5.4 | 2021-08-30 | A stored cross-site scripting vulnerability has been discovered in : Simply Gallery Blocks with Lightbox (Version – 2.2.0 & below). The vulnerability exists in… |
CVE-2021-24665 | Medium | 5.4 | 2021-08-30 | The WP Video Lightbox WordPress plugin before 1.9.3 does not escape the attributes of its shortcodes, allowing users with a role as low as contributor to perfo… |
CVE-2021-24593 | Medium | 5.4 | 2021-08-30 | The Business Hours Indicator WordPress plugin before 2.3.5 does not sanitise or escape its 'Now closed message" setting when outputting it in the backend and f… |
CVE-2021-24592 | Medium | 4.8 | 2021-08-30 | The Sitewide Notice WP WordPress plugin before 2.3 does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege use… |
CVE-2021-24581 | High | 8.8 | 2021-08-30 | The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Si… |
CVE-2021-24580 | High | 8.8 | 2021-08-30 | The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leadi… |
CVE-2021-24579 | High | 8.8 | 2021-08-30 | The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation… |
CVE-2021-24528 | Medium | 5.4 | 2021-08-30 | The FluentSMTP WordPress plugin before 2.0.1 does not sanitize parameters before storing the settings in the database, nor does the plugin escape the values be… |
CVE-2021-24438 | Medium | 6.1 | 2021-08-30 | The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stats view before outpu… |
CVE-2021-24437 | Medium | 6.1 | 2021-08-30 | The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it back in the response… |
CVE-2021-25958 | Medium | 6.5 | 2021-08-30 | In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info whic… |
CVE-2021-39117 | Medium | 4.8 | 2021-08-30 | The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript… |
CVE-2021-39113 | High | 7.5 | 2021-08-30 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after losing permissions, v… |
CVE-2021-39111 | Medium | 6.1 | 2021-08-30 | The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2 allows remot… |
CVE-2021-26084 | Critical | 9.8 | 2021-08-30 | In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbit… |
CVE-2021-39272 | Medium | 5.9 | 2021-08-30 | Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH. |
CVE-2021-39271 | High | 8.8 | 2021-08-30 | OrbiTeam BSCW Classic before 7.4.3 allows authenticated remote code execution (RCE) during archive extraction via attacker-supplied Python code in the class at… |
CVE-2021-38385 | High | 7.5 | 2021-08-30 | Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a rem… |
CVE-2021-36359 | High | 8.8 | 2021-08-30 | OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\platypus\paraparser.py (r… |
CVE-2021-37749 | Critical | 9.8 | 2021-08-30 | MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 (aka 16.6.2.66) allows blind SQL Injection via the Id (within sourceItems) parameter to the GetM… |
CVE-2021-40178 | Medium | 6.1 | 2021-08-29 | Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGO_PATH key value in the logon settings. |
CVE-2021-40177 | Critical | 9.8 | 2021-08-29 | Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite. |
CVE-2021-40176 | Medium | 6.1 | 2021-08-29 | Zoho ManageEngine Log360 before Build 5225 allows stored XSS. |
CVE-2021-40175 | Critical | 9.8 | 2021-08-29 | Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution. |
CVE-2021-40174 | High | 8.8 | 2021-08-29 | Zoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings. |
CVE-2021-40173 | High | 8.8 | 2021-08-29 | Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings. |
CVE-2021-40172 | High | 8.8 | 2021-08-29 | Zoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings. |
CVE-2021-38154 | High | 7.5 | 2021-08-29 | Certain Canon devices manufactured in 2012 through 2020 (such as imageRUNNER ADVANCE iR-ADV C5250), when Catwalk Server is enabled for HTTP access, allow remot… |
CVE-2021-39174 | High | 8.8 | 2021-08-28 | Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can leak the value of… |
CVE-2021-39173 | High | 8.8 | 2021-08-27 | Cachet is an open source status page system. Prior to version 2.5.1 authenticated users, regardless of their privileges (User or Admin), can trick Cachet and i… |
CVE-2021-39172 | High | 8.8 | 2021-08-27 | Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can exploit a new lin… |
CVE-2021-39171 | Medium | 5.3 | 2021-08-27 | Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can requ… |