2021 CVEs (page 134)
Page 134 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-28632 | High | 7.8 | 2021-08-24 | Acrobat Reader DC versions versions 2021.001.20155 (and earlier), 2020.001.30025 (and earlier) and 2017.011.30196 (and earlier) are affected by an Use After Fr… |
CVE-2021-28631 | High | 7.8 | 2021-08-24 | Acrobat Reader DC versions versions 2021.001.20155 (and earlier), 2020.001.30025 (and earlier) and 2017.011.30196 (and earlier) are affected by an Use After Fr… |
CVE-2021-28628 | Medium | 6.3 | 2021-08-24 | Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a Cross-Site Scripting (XSS) vulnerability that could b… |
CVE-2021-28627 | Medium | 5.4 | 2021-08-24 | Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a Server-side Request Forgery. An authenticated attacke… |
CVE-2021-28626 | Low | 3.7 | 2021-08-24 | Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by an Improper Authorization vulnerability allowing users… |
CVE-2021-28625 | Medium | 6.3 | 2021-08-24 | Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a Cross-Site Scripting (XSS) vulnerability that could b… |
CVE-2021-28616 | Medium | 6.1 | 2021-08-24 | Adobe After Effects version 18.2 (and earlier) is affected by an Our-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated att… |
CVE-2021-28615 | Medium | 5.5 | 2021-08-24 | Adobe After Effects version 18.2 (and earlier) is affected by an Our-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated att… |
CVE-2021-28611 | Medium | 6.1 | 2021-08-24 | Adobe After Effects version 18.2 (and earlier) is affected by an Our-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated att… |
CVE-2021-28610 | High | 7.8 | 2021-08-24 | Adobe After Effects version 18.2 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability when parsing a specially crafted file. An unauthentica… |
CVE-2021-28609 | Medium | 5.5 | 2021-08-24 | Adobe After Effects version 18.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated att… |
CVE-2021-28608 | High | 7.8 | 2021-08-24 | Adobe After Effects version 18.2 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability when parsing a specially crafted file. An unauthentica… |
CVE-2021-28607 | High | 7.8 | 2021-08-24 | Adobe After Effects version 18.2 (and earlier) is affected by a heap corruption vulnerability when parsing a specially crafted file. An unauthenticated attacke… |
CVE-2021-28606 | High | 7.8 | 2021-08-24 | Adobe After Effects version 18.2 (and earlier) is affected by a Stack-based Buffer Overflow vulnerability when parsing a specially crafted file. An unauthentic… |
CVE-2021-28605 | High | 7.8 | 2021-08-24 | Adobe After Effects version 18.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attac… |
CVE-2021-28604 | High | 7.8 | 2021-08-24 | Adobe After Effects version 18.2 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability when parsing a specially crafted file. An unauthentica… |
CVE-2021-28603 | High | 7.8 | 2021-08-24 | Adobe After Effects version 18.2 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability when parsing a specially crafted file. An unauthentica… |
CVE-2021-28602 | High | 7.8 | 2021-08-24 | Adobe After Effects version 18.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attac… |
CVE-2021-28601 | Low | 3.3 | 2021-08-24 | Adobe After Effects version 18.2 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticate… |
CVE-2021-28600 | Medium | 5.5 | 2021-08-24 | Adobe After Effects version 18.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated att… |
CVE-2021-28554 | High | 7.8 | 2021-08-24 | Acrobat Reader DC versions versions 2021.001.20155 (and earlier), 2020.001.30025 (and earlier) and 2017.011.30196 (and earlier) are affected by an Out-of-bound… |
CVE-2021-28552 | High | 7.8 | 2021-08-24 | Acrobat Reader DC versions versions 2021.001.20155 (and earlier), 2020.001.30025 (and earlier) and 2017.011.30196 (and earlier) are affected by an Use After Fr… |
CVE-2021-28551 | High | 7.8 | 2021-08-24 | Acrobat Reader DC versions versions 2021.001.20155 (and earlier), 2020.001.30025 (and earlier) and 2017.011.30196 (and earlier) are affected by an Out-of-bound… |
CVE-2021-39137 | Medium | 6.5 | 2021-08-24 | go-ethereum is the official Go implementation of the Ethereum protocol. In affected versions a consensus-vulnerability in go-ethereum (Geth) could cause a chai… |
CVE-2021-3712 | High | 7.4 | 2021-08-24 | ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buf… |
CVE-2021-3711 | Critical | 9.8 | 2021-08-24 | In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function… |
CVE-2021-26040 | Critical | 9.1 | 2021-08-24 | An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's permissions before executing a file deletion command. |
CVE-2021-38714 | High | 8.8 | 2021-08-24 | In Plib through 1.85, there is an integer overflow vulnerability that could result in arbitrary code execution. The vulnerability is found in ssgLoadTGA() func… |
CVE-2021-36690 | High | 7.5 | 2021-08-24 | A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. N… |
CVE-2021-39376 | High | 8.8 | 2021-08-24 | Philips Healthcare Tasy Electronic Medical Record (EMR) 3.06 allows SQL injection via the CorCad_F2/executaConsultaEspecifico IE_CORPO_ASSIST or CD_USUARIO_CON… |
CVE-2021-39375 | High | 8.8 | 2021-08-24 | Philips Healthcare Tasy Electronic Medical Record (EMR) 3.06 allows SQL injection via the WAdvancedFilter/getDimensionItemsByCode FilterValue parameter. |
CVE-2021-38557 | High | 8.8 | 2021-08-24 | raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/r… |
CVE-2021-38556 | High | 8.8 | 2021-08-24 | includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection. |
CVE-2021-38306 | Critical | 9.8 | 2021-08-24 | Network Attached Storage on LG N1T1*** 10124 devices allows an unauthenticated attacker to gain root access via OS command injection in the en/ajp/plugins/acce… |
CVE-2021-37538 | Critical | 9.8 | 2021-08-24 | Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL c… |
CVE-2021-38613 | Critical | 9.8 | 2021-08-24 | The assets/index.php Image Upload feature of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to upload any code to the target system and achieve rem… |
CVE-2021-38612 | High | 7.5 | 2021-08-24 | In NASCENT RemKon Device Manager 4.0.0.0, a Directory Traversal vulnerability in a log-reading function in maintenance/readLog.php allows an attacker to read a… |
CVE-2021-38611 | Critical | 9.8 | 2021-08-24 | A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as… |
CVE-2021-36385 | Critical | 9.8 | 2021-08-24 | A SQL Injection vulnerability in Cerner Mobile Care 5.0.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via a Fullwidth Apostrophe… |
CVE-2021-33191 | Critical | 9.8 | 2021-08-24 | From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patchi… |
CVE-2021-23432 | Medium | 5.4 | 2021-08-24 | This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge() |
CVE-2021-23431 | Medium | 5.4 | 2021-08-24 | The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms. |
CVE-2021-23430 | High | 7.5 | 2021-08-24 | All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization. |
CVE-2021-23429 | Medium | 6.5 | 2021-08-24 | All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled with improper exceptio… |
CVE-2021-23406 | High | 8.1 | 2021-08-24 | This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this… |
CVE-2021-39602 | Medium | 6.5 | 2021-08-23 | A Buffer Overflow vulnerabilty exists in Miniftpd 1.0 in the do_mkd function in the ftpproto.c file, which could let a remote malicious user cause a Denial of… |
CVE-2021-39599 | Medium | 6.1 | 2021-08-23 | Multiple Cross Site Scripting (XSS) vulnerabilities exists in CXUUCMS 3.1 in the search and c parameters in (1) public/search.php and in the (2) c parameter in… |
CVE-2021-36013 | Low | 3.3 | 2021-08-23 | Adobe Media Encoder version 15.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated att… |
CVE-2021-28596 | High | 7.8 | 2021-08-23 | Adobe Framemaker version 2020.0.1 (and earlier) and 2019.0.8 (and earlier) are affected by an Out-of-bounds Write vulnerability when parsing a specially crafte… |
CVE-2021-39615 | Critical | 9.8 | 2021-08-23 | D-Link DSR-500N version 1.02 contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file.If an attacker succeeds in recovering the… |
CVE-2021-39614 | Critical | 9.8 | 2021-08-23 | D-Link DVX-2000MS contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file. As weak passwords have been used, the plaintext pas… |
CVE-2021-39613 | Critical | 9.8 | 2021-08-23 | D-Link DVG-3104MS version 1.0.2.0.3, 1.0.2.0.4, and 1.0.2.0.4E contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file. As wea… |
CVE-2021-39609 | Medium | 5.4 | 2021-08-23 | Cross Site Scripting (XSS) vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function. |
CVE-2021-39608 | High | 7.2 | 2021-08-23 | Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbitrary php… |
CVE-2021-39158 | High | 8.8 | 2021-08-23 | NVCaffe's python required dependencies list used to contain `gfortran`version prior to 0.17.4, entry which does not exist in the repository pypi.org. An attack… |
CVE-2021-22449 | High | 7.5 | 2021-08-23 | There is a logic vulnerability in Elf-G10HN 1.0.0.608. An unauthenticated attacker could perform specific operations to exploit this vulnerability. Due to insu… |
CVE-2021-22357 | High | 7.5 | 2021-08-23 | There is a denial of service vulnerability in Huawei products. A module cannot deal with specific messages due to validating inputs insufficiently. Attackers c… |
CVE-2021-22328 | High | 7.5 | 2021-08-23 | There is a denial of service vulnerability in some huawei products. In specific scenarios, due to the improper handling of the packets, an attacker may craft t… |
CVE-2021-22253 | Medium | 4.9 | 2021-08-23 | Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protecte… |
CVE-2021-22252 | Medium | 6.5 | 2021-08-23 | A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should on… |
CVE-2021-22251 | Medium | 4.3 | 2021-08-23 | Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain th… |
CVE-2021-22249 | Medium | 4.3 | 2021-08-23 | A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group |
CVE-2021-22248 | Medium | 5.3 | 2021-08-23 | Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized users to view some pipeline information fo… |
CVE-2021-39152 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data fro… |
CVE-2021-39150 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data fro… |
CVE-2021-39140 | Medium | 6.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CP… |
CVE-2021-39154 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39153 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39151 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39149 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39148 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39147 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39146 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39145 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39144 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient righ… |
CVE-2021-39141 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39139 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-29802 | High | 7.5 | 2021-08-23 | IBM Security SOAR performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the cons… |
CVE-2021-29704 | High | 7.5 | 2021-08-23 | IBM Security SOAR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. |
CVE-2021-3731 | Medium | 5.9 | 2021-08-23 | LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targette… |
CVE-2021-3730 | Medium | 6.5 | 2021-08-23 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3729 | Medium | 4.3 | 2021-08-23 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3728 | Medium | 6.5 | 2021-08-23 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3694 | High | 8.2 | 2021-08-23 | LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be a… |
CVE-2021-3693 | High | 8.8 | 2021-08-23 | LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user, this flaw can… |
CVE-2021-35465 | Low | 3.4 | 2021-08-23 | Certain Arm products before 2021-08-23 do not properly consider the effect of exceptions on a VLLDM instruction. A Non-secure handler may have read or write ac… |
CVE-2021-33598 | Medium | 4.6 | 2021-08-23 | A Denial-of-Service (DoS) vulnerability was discovered in all versions of F-Secure Atlant whereby the SAVAPI component used in certain F-Secure products can cr… |
CVE-2021-24658 | Medium | 4.8 | 2021-08-23 | The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users to use XSS payloads… |
CVE-2021-24602 | High | 8.8 | 2021-08-23 | The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile… |
CVE-2021-24574 | Medium | 4.8 | 2021-08-23 | The Simple Banner WordPress plugin before 2.10.4 does not sanitise and escape one of its settings, allowing high privilege users such as admin to use Cross-Sit… |
CVE-2021-24571 | Medium | 5.4 | 2021-08-23 | The HD Quiz WordPress plugin before 1.8.4 does not escape some of its Answers before outputting them in attribute when generating the Quiz, which could lead to… |
CVE-2021-24565 | High | 8.8 | 2021-08-23 | The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in… |
CVE-2021-24564 | Medium | 5.4 | 2021-08-23 | The WPFront Scroll Top WordPress plugin before 2.0.6.07225 does not sanitise or escape its Image ALT setting before outputting it attributes, leading to an Aut… |
CVE-2021-24562 | High | 7.5 | 2021-08-23 | The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing… |
CVE-2021-24561 | Medium | 5.4 | 2021-08-23 | The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" page, leading to an Authent… |
CVE-2021-24558 | Medium | 5.4 | 2021-08-23 | The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parame… |
CVE-2021-24557 | High | 7.2 | 2021-08-23 | The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, ther… |
CVE-2021-24556 | Medium | 6.1 | 2021-08-23 | The kento_email_subscriber_ajax AJAX action of the Email Subscriber WordPress plugin through 1.1, does not properly sanitise, validate and escape the submitted… |
CVE-2021-24555 | High | 8.8 | 2021-08-23 | The daac_delete_booking_callback function, hooked to the daac_delete_booking AJAX action, takes the id POST parameter which is passed into the SQL statement wi… |
CVE-2021-24554 | High | 7.2 | 2021-08-23 | The Paytm – Donation Plugin WordPress plugin through 1.3.2 does not sanitise, validate or escape the id GET parameter before using it in a SQL statement when d… |