2021 CVEs (page 131)
Page 131 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-32759 | High | 7.2 | 2021-08-27 | OpenMage magento-lts is an alternative to the Magento CE official releases. Due to missing sanitation in data flow in versions prior to 19.4.15 and 20.0.13, it… |
CVE-2021-3264 | High | 7.2 | 2021-08-27 | SQL Injection vulnerability in cxuucms 3.1 ivia the pid parameter in public/admin.php. |
CVE-2021-28700 | Medium | 4.9 | 2021-08-27 | xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen. Unfortunate… |
CVE-2021-28699 | Medium | 5.5 | 2021-08-27 | inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. That is, when operating in this… |
CVE-2021-28698 | Medium | 5.5 | 2021-08-27 | long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a domain may create to ma… |
CVE-2021-28697 | High | 7.8 | 2021-08-27 | grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The majority of such pag… |
CVE-2021-28696 | Medium | 6.8 | 2021-08-27 | IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE… |
CVE-2021-28695 | Medium | 6.8 | 2021-08-27 | IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE… |
CVE-2021-28694 | Medium | 6.8 | 2021-08-27 | IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE… |
CVE-2021-28233 | High | 8.8 | 2021-08-27 | Heap-based Buffer Overflow vulnerability exists in ok-file-formats 1 via the ok_jpg_generate_huffman_table function in ok_jpg.c. |
CVE-2021-32758 | High | 7.2 | 2021-08-27 | OpenMage Magento LTS is an alternative to the Magento CE official releases. Prior to versions 19.4.15 and 20.0.11, layout XML enabled admin users to execute ar… |
CVE-2021-23434 | Medium | 5.6 | 2021-08-27 | This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the… |
CVE-2021-36531 | High | 8.8 | 2021-08-27 | ngiflib 0.4 has a heap overflow in GetByte() at ngiflib.c:70 in NGIFLIB_NO_FILE mode, GetByte() reads memory buffer without checking the boundary. |
CVE-2021-36530 | High | 8.8 | 2021-08-27 | ngiflib 0.4 has a heap overflow in GetByteStr() at ngiflib.c:108 in NGIFLIB_NO_FILE mode, GetByteStr() copy memory buffer without checking the boundary. |
CVE-2021-29744 | Medium | 5.4 | 2021-08-27 | IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2021-40153 | High | 8.1 | 2021-08-27 | squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file durin… |
CVE-2021-39169 | High | 8.0 | 2021-08-27 | Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display… |
CVE-2021-35342 | High | 7.5 | 2021-08-27 | The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x before 2.6.1) allows us… |
CVE-2021-40142 | High | 7.5 | 2021-08-27 | In OPC Foundation Local Discovery Server (LDS) before 1.04.402.463, remote attackers can cause a denial of service (DoS) by sending carefully crafted messages… |
CVE-2021-39168 | Critical | 10.0 | 2021-08-27 | OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to… |
CVE-2021-39167 | Critical | 10.0 | 2021-08-27 | OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to… |
CVE-2021-39165 | High | 8.1 | 2021-08-26 | Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Atta… |
CVE-2021-39161 | Medium | 4.4 | 2021-08-26 | Discourse is an open source platform for community discussion. In affected versions category names can be used for Cross-site scripting(XSS) attacks. This is m… |
CVE-2021-37715 | Medium | 4.8 | 2021-08-26 | A remote cross-site scripting (XSS) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.13.0. Aruba has released upgrade… |
CVE-2021-29862 | Medium | 5.5 | 2021-08-26 | IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force I… |
CVE-2021-29801 | High | 7.8 | 2021-08-26 | IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the kernel to gain root privileges. IBM X-Force ID: 203977. |
CVE-2021-29772 | Critical | 9.8 | 2021-08-26 | IBM API Connect 5.0.0.0 through 5.0.8.11 could allow a user to potentially inject code due to unsanitized user input. IBM X-Force ID: 202774. |
CVE-2021-29727 | Medium | 5.5 | 2021-08-26 | IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 201106. |
CVE-2021-29715 | Critical | 9.1 | 2021-08-26 | IBM API Connect 5.0.0.0 through 5.0.8.11 could alllow a remote user to obtain sensitive information or conduct denial of serivce attacks due to open ports. IBM… |
CVE-2021-32648 | High | 8.2 | 2021-08-26 | octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password… |
CVE-2021-29487 | High | 7.4 | 2021-08-26 | octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit this vulnerability… |
CVE-2021-36931 | Medium | 4.4 | 2021-08-26 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2021-36929 | Medium | 6.3 | 2021-08-26 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2021-36928 | Medium | 6.0 | 2021-08-26 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2021-30604 | High | 8.8 | 2021-08-26 | Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30603 | High | 7.5 | 2021-08-26 | Data race in WebAudio in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30602 | High | 8.8 | 2021-08-26 | Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to visit a malicious website to potentially exploit h… |
CVE-2021-30601 | High | 8.8 | 2021-08-26 | Use after free in Extensions API in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to install a malicious extension to potential… |
CVE-2021-30600 | High | 8.8 | 2021-08-26 | Use after free in Printing in Google Chrome prior to 92.0.4515.159 allowed a remote attacker who had compromised the renderer process to potentially exploit he… |
CVE-2021-30599 | High | 8.8 | 2021-08-26 | Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
CVE-2021-30598 | High | 8.8 | 2021-08-26 | Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
CVE-2021-30597 | Medium | 6.8 | 2021-08-26 | Use after free in Browser UI in Google Chrome on Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via physical ac… |
CVE-2021-30596 | Medium | 4.3 | 2021-08-26 | Incorrect security UI in Navigation in Google Chrome on Android prior to 92.0.4515.131 allowed a remote attacker to spoof the contents of the Omnibox (URL bar)… |
CVE-2021-30594 | Medium | 6.8 | 2021-08-26 | Use after free in Page Info UI in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via physical access to… |
CVE-2021-30593 | High | 8.1 | 2021-08-26 | Out of bounds read in Tab Strip in Google Chrome prior to 92.0.4515.131 allowed an attacker who convinced a user to install a malicious extension to perform an… |
CVE-2021-30592 | High | 8.8 | 2021-08-26 | Out of bounds write in Tab Groups in Google Chrome prior to 92.0.4515.131 allowed an attacker who convinced a user to install a malicious extension to perform… |
CVE-2021-30591 | High | 8.8 | 2021-08-26 | Use after free in File System API in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2021-30590 | High | 8.8 | 2021-08-26 | Heap buffer overflow in Bookmarks in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2021-40147 | Critical | 9.8 | 2021-08-26 | EmTec ZOC before 8.02.2 allows \e[201~ pastes, a different vulnerability than CVE-2021-32198. |
CVE-2021-32076 | Medium | 5.3 | 2021-08-26 | Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizar… |
CVE-2021-36352 | Medium | 5.4 | 2021-08-26 | Stored cross-site scripting (XSS) vulnerability in Care2x Hospital Information Management 2.7 Alpha. The vulnerability has found POST requests in /modules/regi… |
CVE-2021-3734 | High | 8.8 | 2021-08-26 | yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames |
CVE-2021-38559 | Medium | 6.1 | 2021-08-26 | DigitalDruid HotelDruid 3.0.2 has an XSS vulnerability in prenota.php affecting the fineperiodo1 parameter. |
CVE-2021-27944 | Critical | 9.8 | 2021-08-26 | Several high privileged APIs on the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs do not enforce access controls, allowing an unauthenticated threa… |
CVE-2021-20815 | Medium | 6.1 | 2021-08-26 | Cross-site scripting vulnerability in Edit Boilerplate screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 an… |
CVE-2021-20814 | Medium | 6.1 | 2021-08-26 | Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type… |
CVE-2021-20813 | Medium | 6.1 | 2021-08-26 | Cross-site scripting vulnerability in Edit screen of Content Data of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series) and Movable Type A… |
CVE-2021-20812 | Medium | 6.1 | 2021-08-26 | Cross-site scripting vulnerability in Setting screen of Server Sync of Movable Type (Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series… |
CVE-2021-20811 | Medium | 6.1 | 2021-08-26 | Cross-site scripting vulnerability in List of Assets screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and… |
CVE-2021-20810 | Medium | 6.1 | 2021-08-26 | Cross-site scripting vulnerability in Website Management screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0… |
CVE-2021-20809 | Medium | 6.1 | 2021-08-26 | Cross-site scripting vulnerability in Create screens of Entry, Page, and Content Type of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series… |
CVE-2021-20808 | Medium | 6.1 | 2021-08-26 | Cross-site scripting vulnerability in Search screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier… |
CVE-2021-20793 | High | 7.8 | 2021-08-26 | Untrusted search path vulnerability in the installer of Sony Audio USB Driver V1.10 and prior and the installer of HAP Music Transfer Ver.1.3.0 and prior allow… |
CVE-2021-40145 | High | 7.5 | 2021-08-26 | gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a pro… |
CVE-2021-37334 | Critical | 9.8 | 2021-08-25 | Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbi… |
CVE-2021-37154 | Critical | 9.8 | 2021-08-25 | In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion. |
CVE-2021-37153 | Critical | 9.8 | 2021-08-25 | ForgeRock Access Management (AM) before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass issue. |
CVE-2021-28070 | Medium | 4.3 | 2021-08-25 | Cross Site Request Forgery (CSRF) vulnerability exist in PopojiCMS 2.0.1 in po-admin/route.php?mod=user&act=multidelete. |
CVE-2021-1592 | Medium | 4.3 | 2021-08-25 | A vulnerability in the way Cisco UCS Manager software handles SSH sessions could allow an authenticated, remote attacker to cause a denial of service (DoS) con… |
CVE-2021-1591 | Medium | 5.8 | 2021-08-25 | A vulnerability in the EtherChannel port subscription logic of Cisco Nexus 9500 Series Switches could allow an unauthenticated, remote attacker to bypass acces… |
CVE-2021-1590 | Medium | 5.3 | 2021-08-25 | A vulnerability in the implementation of the system login block-for command for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a… |
CVE-2021-1588 | High | 8.6 | 2021-08-25 | A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to… |
CVE-2021-1587 | High | 8.6 | 2021-08-25 | A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated… |
CVE-2021-1586 | High | 8.6 | 2021-08-25 | A vulnerability in the Multi-Pod or Multi-Site network configurations for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) m… |
CVE-2021-1584 | Medium | 6.0 | 2021-08-25 | A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, local attacker to ele… |
CVE-2021-1583 | Medium | 4.4 | 2021-08-25 | A vulnerability in the fabric infrastructure file system access control of Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI)… |
CVE-2021-1582 | Medium | 5.4 | 2021-08-25 | A vulnerability in the web UI of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow an authenticated, remote attacker to… |
CVE-2021-1581 | Medium | 6.5 | 2021-08-25 | Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote… |
CVE-2021-1580 | Medium | 6.5 | 2021-08-25 | Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote… |
CVE-2021-1579 | High | 8.1 | 2021-08-25 | A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (C… |
CVE-2021-1578 | High | 8.8 | 2021-08-25 | A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (C… |
CVE-2021-1577 | Critical | 9.1 | 2021-08-25 | A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (C… |
CVE-2021-3713 | High | 7.4 | 2021-08-25 | An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplie… |
CVE-2021-3605 | Medium | 5.5 | 2021-08-25 | There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked w… |
CVE-2021-39159 | Critical | 9.6 | 2021-08-25 | BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected ve… |
CVE-2021-33015 | High | 7.8 | 2021-08-25 | Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds write via… |
CVE-2021-32995 | High | 7.8 | 2021-08-25 | Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds write. An… |
CVE-2021-32975 | High | 7.8 | 2021-08-25 | Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds read. An… |
CVE-2021-31989 | Medium | 5.3 | 2021-08-25 | A user with permission to log on to the machine hosting the AXIS Device Manager client could under certain conditions extract a memory dump from the built-in W… |
CVE-2021-22256 | Medium | 5.4 | 2021-08-25 | Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status |
CVE-2021-22250 | Medium | 5.4 | 2021-08-25 | Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administrators created for… |
CVE-2021-22247 | Medium | 4.3 | 2021-08-25 | Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics |
CVE-2021-22245 | Low | 2.7 | 2021-08-25 | Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossible to view |
CVE-2021-22244 | Low | 3.1 | 2021-08-25 | Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability data |
CVE-2021-22243 | Medium | 5.0 | 2021-08-25 | Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain… |
CVE-2021-22242 | High | 8.7 | 2021-08-25 | Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerabili… |
CVE-2021-22237 | Medium | 6.6 | 2021-08-25 | Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. This vulnerability… |
CVE-2021-22236 | Medium | 5.5 | 2021-08-25 | Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present… |
CVE-2021-21869 | High | 7.8 | 2021-08-25 | An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5… |
CVE-2021-21850 | High | 8.8 | 2021-08-25 | An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A special… |