2021 CVEs (page 135)
Page 135 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-24553 | High | 7.2 | 2021-08-23 | The Timeline Calendar WordPress plugin through 1.2 does not sanitise, validate or escape the edit GET parameter before using it in a SQL statement when editing… |
CVE-2021-24552 | High | 7.2 | 2021-08-23 | The Simple Events Calendar WordPress plugin through 1.4.0 does not sanitise, validate or escape the event_id POST parameter before using it in a SQL statement… |
CVE-2021-24551 | Critical | 9.8 | 2021-08-23 | The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jal_edit_comments GET parameter before using it in a SQL statement, le… |
CVE-2021-24550 | High | 7.2 | 2021-08-23 | The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise, validate or escape the url GET parameter before using it in a SQL statement when retr… |
CVE-2021-24549 | Medium | 4.9 | 2021-08-23 | The AceIDE WordPress plugin through 2.6.2 does not sanitise or validate the user input which is appended to system paths before using it in various actions, su… |
CVE-2021-24547 | Medium | 5.4 | 2021-08-23 | The KN Fix Your Title WordPress plugin through 1.0.1 was vulnerable to Authenticated Stored XSS in the separator field. |
CVE-2021-24533 | Medium | 4.8 | 2021-08-23 | The Maintenance WordPress plugin before 4.03 does not sanitise or escape some of its settings, allowing high privilege users such as admin to se Cross-Site Scr… |
CVE-2021-24531 | Medium | 5.4 | 2021-08-23 | The Charitable – Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site scripting vulnerability which was found in th… |
CVE-2021-24529 | Medium | 5.4 | 2021-08-23 | The Grid Gallery – Photo Image Grid Gallery WordPress plugin before 1.2.5 does not properly sanitize the title field for image galleries when adding them via t… |
CVE-2021-24524 | Medium | 4.8 | 2021-08-23 | The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing… |
CVE-2021-24506 | High | 8.8 | 2021-08-23 | The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button sh… |
CVE-2021-24497 | High | 7.2 | 2021-08-23 | The Giveaway WordPress plugin through 1.2.2 is vulnerable to an SQL Injection issue which allows an administrative user to execute arbitrary SQL commands via t… |
CVE-2021-24486 | Medium | 5.4 | 2021-08-23 | The Simple Social Media Share Buttons – Social Sharing for Everyone WordPress plugin before 3.2.3 did not escape the align and like_button_size parameters of i… |
CVE-2021-35940 | High | 7.1 | 2021-08-23 | An out-of-bounds array read in the apr_time_exp*() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix for this issue wa… |
CVE-2021-39291 | High | 8.8 | 2021-08-23 | Certain NetModule devices allow credentials via GET parameters to CLI-PHP. These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected… |
CVE-2021-39290 | Critical | 9.8 | 2021-08-23 | Certain NetModule devices allow Limited Session Fixation via PHPSESSID. These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected: NB8… |
CVE-2021-39289 | High | 7.5 | 2021-08-23 | Certain NetModule devices have Insecure Password Handling (cleartext or reversible encryption), These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5… |
CVE-2021-39245 | High | 7.5 | 2021-08-23 | Hardcoded .htaccess Credentials for getlogs.cgi exist on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices. This affects Nexto NX3003 1.8.11.0, Nexto NX3004… |
CVE-2021-39244 | High | 8.8 | 2021-08-23 | Authenticated Semi-Blind Command Injection (via Parameter Injection) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via the getlogs.cgi tcpdump… |
CVE-2021-39243 | Medium | 6.5 | 2021-08-23 | Cross-Site Request Forgery (CSRF) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via any CGI endpoint. This affects Nexto NX3003 1.8.11.0, Nexto… |
CVE-2021-38598 | Critical | 9.1 | 2021-08-23 | OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on… |
CVE-2021-37750 | Medium | 6.5 | 2021-08-23 | The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a… |
CVE-2021-39371 | High | 7.5 | 2021-08-23 | An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the e… |
CVE-2021-39368 | Medium | 6.1 | 2021-08-23 | Canon Oce Print Exec Workgroup 1.3.2 allows XSS via the lang parameter. |
CVE-2021-39367 | Medium | 5.3 | 2021-08-23 | Canon Oce Print Exec Workgroup 1.3.2 allows Host header injection. |
CVE-2021-39365 | Medium | 5.9 | 2021-08-22 | In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to… |
CVE-2021-39362 | Medium | 6.1 | 2021-08-22 | An XSS issue was discovered in ReCaptcha Solver 5.7. A response from Anti-Captcha.com, RuCaptcha.com, 2captcha.com, DEATHbyCAPTCHA.com, ImageTyperz.com, or Bes… |
CVE-2021-39361 | Medium | 5.9 | 2021-08-22 | In GNOME evolution-rss through 0.3.96, network-soup.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vul… |
CVE-2021-39360 | Medium | 5.9 | 2021-08-22 | In GNOME libzapojit through 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnera… |
CVE-2021-39359 | Medium | 5.9 | 2021-08-22 | In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnera… |
CVE-2021-39358 | Medium | 5.9 | 2021-08-22 | In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vuln… |
CVE-2021-38171 | Critical | 9.8 | 2021-08-21 | adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a necessary step because the second argume… |
CVE-2021-21828 | Critical | 9.8 | 2021-08-20 | A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs Xmill 0.7. In the default case of DecodeT… |
CVE-2021-21827 | Critical | 9.8 | 2021-08-20 | A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs Xmill 0.7. Within `DecodeTreeBlock` which… |
CVE-2021-21826 | Critical | 9.8 | 2021-08-20 | A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs Xmill 0.7. Within `DecodeTreeBlock` which… |
CVE-2021-36016 | Low | 3.3 | 2021-08-20 | Adobe Media Encoder version 15.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated att… |
CVE-2021-36015 | High | 7.8 | 2021-08-20 | Adobe Media Encoder version 15.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attac… |
CVE-2021-36014 | Low | 3.3 | 2021-08-20 | Adobe Media Encoder version 15.2 (and earlier) is affected by an uninitialized pointer vulnerability when parsing a specially crafted file. An unauthenticated… |
CVE-2021-36011 | High | 8.3 | 2021-08-20 | Adobe Illustrator version 25.2.3 (and earlier) is affected by a potential Command injection vulnerability when chained with a development and debugging tool fo… |
CVE-2021-36010 | Low | 3.3 | 2021-08-20 | Adobe Illustrator version 25.2.3 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of memory. An attacker could le… |
CVE-2021-36009 | High | 7.8 | 2021-08-20 | Adobe Illustrator version 25.2.3 (and earlier) is affected by an memory corruption vulnerability when parsing a specially crafted file. An unauthenticated atta… |
CVE-2021-36008 | Low | 3.3 | 2021-08-20 | Adobe Illustrator version 25.2.3 (and earlier) is affected by an Use-after-free vulnerability when parsing a specially crafted file. An unauthenticated attacke… |
CVE-2021-36007 | Low | 3.3 | 2021-08-20 | Adobe Prelude version 10.0 (and earlier) are affected by an uninitialized variable vulnerability when parsing a specially crafted file. An unauthenticated atta… |
CVE-2021-36006 | Low | 3.3 | 2021-08-20 | Adobe Photoshop versions 21.2.9 (and earlier) and 22.4.2 (and earlier) are affected by an Improper input validation vulnerability when parsing a specially craf… |
CVE-2021-36005 | High | 7.8 | 2021-08-20 | Adobe Photoshop versions 21.2.9 (and earlier) and 22.4.2 (and earlier) is affected by a stack overflow vulnerability due to insecure handling of a crafted PSD… |
CVE-2021-36001 | Low | 3.3 | 2021-08-20 | Adobe Character Animator version 4.2 (and earlier) is affected by an out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated… |
CVE-2021-36000 | High | 7.8 | 2021-08-20 | Adobe Character Animator version 4.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated a… |
CVE-2021-35999 | High | 7.8 | 2021-08-20 | Adobe Prelude version 10.0 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker co… |
CVE-2021-35997 | High | 7.8 | 2021-08-20 | Adobe Premiere Pro version 15.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attack… |
CVE-2021-35992 | Low | 3.3 | 2021-08-20 | Adobe Bridge version 11.0.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker… |
CVE-2021-35991 | Low | 3.3 | 2021-08-20 | Adobe Bridge version 11.0.2 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability when parsing a specially crafted file. An unauthentic… |
CVE-2021-35990 | High | 7.8 | 2021-08-20 | Adobe Bridge version 11.0.2 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacke… |
CVE-2021-35989 | High | 7.8 | 2021-08-20 | Adobe Bridge version 11.0.2 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacke… |
CVE-2021-35988 | Low | 3.3 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Out-of-bounds Read vu… |
CVE-2021-35987 | Low | 3.3 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an out-of-bounds Read vu… |
CVE-2021-35986 | Low | 3.3 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Type Confusion vulner… |
CVE-2021-35985 | Medium | 5.5 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Null pointer dereferen… |
CVE-2021-35984 | Medium | 5.5 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Null pointer dereferen… |
CVE-2021-35983 | High | 7.8 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulner… |
CVE-2021-35981 | High | 7.8 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulner… |
CVE-2021-28643 | Low | 3.3 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Type Confusion vulnera… |
CVE-2021-28642 | High | 8.8 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Out-of-bounds write v… |
CVE-2021-28641 | High | 7.8 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulner… |
CVE-2021-28640 | High | 7.3 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulner… |
CVE-2021-28639 | High | 7.8 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulner… |
CVE-2021-28638 | High | 7.8 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Heap-based Buffer over… |
CVE-2021-28637 | High | 7.8 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an out-of-bounds read vu… |
CVE-2021-28636 | High | 7.3 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Uncontrolled Search P… |
CVE-2021-28635 | High | 7.8 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a use-after-free vulnera… |
CVE-2021-28634 | High | 8.2 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Improper Neutralizati… |
CVE-2021-28624 | High | 7.8 | 2021-08-20 | Adobe Bridge version 11.0.2 (and earlier) are affected by a Heap-based Buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerabi… |
CVE-2021-28595 | High | 7.8 | 2021-08-20 | Adobe Dimension version 3.4 (and earlier) is affected by an Uncontrolled Search Path Element element. An unauthenticated attacker could leverage this vulnerabi… |
CVE-2021-28593 | Low | 3.3 | 2021-08-20 | Adobe Illustrator version 25.2.3 (and earlier) is affected by a Use After Free vulnerability when parsing a specially crafted file. An unauthenticated attacker… |
CVE-2021-28592 | High | 7.8 | 2021-08-20 | Adobe Illustrator version 25.2.3 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated at… |
CVE-2021-28591 | High | 7.8 | 2021-08-20 | Adobe Illustrator version 25.2.3 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated at… |
CVE-2021-28590 | Low | 3.3 | 2021-08-20 | Adobe Media Encoder version 15.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated att… |
CVE-2021-28589 | Low | 3.3 | 2021-08-20 | Adobe Media Encoder version 15.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated att… |
CVE-2021-36748 | High | 7.5 | 2021-08-20 | A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote attacker to extract… |
CVE-2021-35529 | High | 7.7 | 2021-08-20 | Insufficiently Protected Credentials vulnerability in client environment of Hitachi ABB Power Grids Retail Operations and Counterparty Settlement Billing (CSB)… |
CVE-2021-22255 | High | 7.7 | 2021-08-20 | SSRF in URL file upload in Baserow <1.1.0 allows remote authenticated users to retrieve files from the internal server network exposed over HTTP by inserting a… |
CVE-2021-22254 | Low | 3.1 | 2021-08-20 | Under very specific conditions a user could be impersonated using Gitlab shell. This vulnerability affects GitLab CE/EE 13.1 and later through 14.1.2, 14.0.7 a… |
CVE-2021-22246 | High | 7.7 | 2021-08-20 | A vulnerability was discovered in GitLab versions before 14.0.2, 13.12.6, 13.11.6. GitLab Webhook feature could be abused to perform denial of service attacks. |
CVE-2021-22238 | Medium | 6.8 | 2021-08-20 | An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS by using the design feature in issues. |
CVE-2021-21823 | High | 7.5 | 2021-08-20 | An information disclosure vulnerability exists in the Friend finder functionality of GmbH Komoot version 10.26.9 up to 11.1.11. A specially crafted series of n… |
CVE-2021-34433 | High | 7.5 | 2021-08-20 | In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without veri… |
CVE-2021-34228 | Medium | 6.1 | 2021-08-20 | Cross-site scripting in parent_control.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScr… |
CVE-2021-34223 | Medium | 6.1 | 2021-08-20 | Cross-site scripting in urlfilter.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript b… |
CVE-2021-34220 | Medium | 6.1 | 2021-08-20 | Cross-site scripting in tr069config.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript… |
CVE-2021-34218 | Medium | 5.3 | 2021-08-20 | Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /add/ , /img/, /js/, and /mobile directori… |
CVE-2021-34215 | Medium | 6.1 | 2021-08-20 | Cross-site scripting in tcpipwan.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by… |
CVE-2021-34207 | Medium | 6.1 | 2021-08-20 | Cross-site scripting in ddns.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by mod… |
CVE-2021-37598 | Medium | 5.3 | 2021-08-19 | WP Cerber before 8.9.3 allows bypass of /wp-json access control via a trailing ? character. |
CVE-2021-37597 | Critical | 9.8 | 2021-08-19 | WP Cerber before 8.9.3 allows MFA bypass via wordpress_logged_in_[hash] manipulation. |
CVE-2021-28490 | High | 8.8 | 2021-08-19 | In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token. |
CVE-2021-39302 | Critical | 9.8 | 2021-08-19 | MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value. |
CVE-2021-39138 | Medium | 4.8 | 2021-08-19 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Developers can use the REST API to signup users and als… |
CVE-2021-37698 | High | 7.5 | 2021-08-19 | Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In v… |
CVE-2021-34645 | High | 8.8 | 2021-08-19 | The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_currency_settings function found in the ~/admin/i… |
CVE-2021-31868 | Medium | 4.3 | 2021-08-19 | Rapid7 Nexpose version 6.6.95 and earlier allows authenticated users of the Security Console to view and edit any ticket in the legacy ticketing feature, regar… |
CVE-2021-31338 | High | 7.8 | 2021-08-19 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.0 SP1). Affected devices allow to modify configuration settings over an… |