2021 CVEs (page 136)
Page 136 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-29280 | Medium | 6.4 | 2021-08-19 | In TP-Link Wireless N Router WR840N an ARP poisoning attack can cause buffer overflow |
CVE-2021-24038 | High | 7.8 | 2021-08-19 | Due to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle to an unprivileged process, leading to… |
CVE-2021-28002 | Medium | 5.4 | 2021-08-19 | A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which allows remote attackers to execute arbit… |
CVE-2021-28001 | Medium | 5.4 | 2021-08-19 | A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remote attackers to execute arbitrary code… |
CVE-2021-28000 | Medium | 4.8 | 2021-08-19 | A persistent cross-site scripting vulnerability was discovered in Local Services Search Engine Management System Project 1.0 which allows remote attackers to e… |
CVE-2021-27999 | Medium | 4.9 | 2021-08-19 | A SQL injection vulnerability was discovered in the editid parameter in Local Services Search Engine Management System Project 1.0. This vulnerability gives ad… |
CVE-2021-27822 | Medium | 4.8 | 2021-08-19 | A persistent cross site scripting (XSS) vulnerability in the Add Categories module of Vehicle Parking Management System 1.0 allows attackers to execute arbitra… |
CVE-2021-39274 | Critical | 9.8 | 2021-08-19 | In XeroSecurity Sn1per 9.0 (free version), insecure directory permissions (0777) are set during installation, allowing an unprivileged user to modify the main… |
CVE-2021-39273 | High | 8.8 | 2021-08-19 | In XeroSecurity Sn1per 9.0 (free version), insecure permissions (0777) are set upon application execution, allowing an unprivileged user to modify the applicat… |
CVE-2021-36762 | High | 7.5 | 2021-08-19 | An issue was discovered in HCC Embedded InterNiche NicheStack through 4.3. The tfshnd():tftpsrv.c TFTP packet processing function doesn't ensure that a filenam… |
CVE-2021-31401 | High | 7.5 | 2021-08-19 | An issue was discovered in tcp_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1. The TCP header processing code doesn't sanitize the value of the IP total len… |
CVE-2021-27565 | High | 7.5 | 2021-08-19 | The web server in InterNiche NicheStack through 4.0.1 allows remote attackers to cause a denial of service (infinite loop and networking outage) via an unexpec… |
CVE-2021-31400 | High | 7.5 | 2021-08-19 | An issue was discovered in tcp_pulloutofband() in tcp_in.c in HCC embedded InterNiche 4.0.1. The TCP out-of-band urgent-data processing function invokes a pani… |
CVE-2021-31228 | High | 7.5 | 2021-08-19 | An issue was discovered in HCC embedded InterNiche 4.0.1. This vulnerability allows the attacker to predict a DNS query's source port in order to send forged D… |
CVE-2021-31227 | High | 7.5 | 2021-08-19 | An issue was discovered in HCC embedded InterNiche 4.0.1. A potential heap buffer overflow exists in the code that parses the HTTP POST request, due to an inco… |
CVE-2021-31226 | Critical | 9.8 | 2021-08-19 | An issue was discovered in HCC embedded InterNiche 4.0.1. A potential heap buffer overflow exists in the code that parses the HTTP POST request, due to lack of… |
CVE-2021-32602 | Medium | 5.8 | 2021-08-19 | An improper neutralization of input during web page generation vulnerability (CWE-79) in FortiPortal GUI 6.0.4 and below, 5.3.6 and below, 5.2.6 and below, 5.1… |
CVE-2021-32588 | Critical | 9.8 | 2021-08-18 | A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions 5.1.x and 5.0.x may… |
CVE-2021-34749 | Medium | 5.8 | 2021-08-18 | A vulnerability in Server Name Identification (SNI) request filtering of Cisco Web Security Appliance (WSA), Cisco Firepower Threat Defense (FTD), and the Snor… |
CVE-2021-34745 | High | 7.8 | 2021-08-18 | A vulnerability in the AppDynamics .NET Agent for Windows could allow an attacker to leverage an authenticated, local user account to gain SYSTEM privileges. T… |
CVE-2021-34734 | Medium | 6.5 | 2021-08-18 | A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for the Cisco Video Surveillance 7000 Series IP Cameras firmware could allow an unau… |
CVE-2021-34730 | Critical | 9.8 | 2021-08-18 | A vulnerability in the Universal Plug-and-Play (UPnP) service of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated… |
CVE-2021-34716 | Medium | 6.7 | 2021-08-18 | A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authent… |
CVE-2021-34715 | Medium | 4.7 | 2021-08-18 | A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authentica… |
CVE-2021-1561 | Medium | 5.4 | 2021-08-18 | A vulnerability in the spam quarantine feature of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), could allow an authen… |
CVE-2021-39270 | High | 7.5 | 2021-08-18 | In Ping Identity RSA SecurID Integration Kit before 3.2, user impersonation can occur. |
CVE-2021-25218 | High | 7.5 | 2021-08-18 | In BIND 9.16.19, 9.17.16. Also, version 9.16.19-S1 of BIND Supported Preview Edition When a vulnerable version of named receives a query under the circumstance… |
CVE-2021-39286 | Medium | 6.1 | 2021-08-18 | Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped. |
CVE-2021-37617 | High | 7.3 | 2021-08-18 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. The Nextcloud Desktop Client invokes its uninstaller script… |
CVE-2021-39283 | Medium | 5.5 | 2021-08-18 | liveMedia/FramedSource.cpp in Live555 through 1.08 allows an assertion failure and application exit via multiple SETUP and PLAY commands. |
CVE-2021-39282 | High | 7.5 | 2021-08-18 | Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files. |
CVE-2021-23425 | Medium | 5.3 | 2021-08-18 | All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing. |
CVE-2021-23424 | High | 7.5 | 2021-08-18 | This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time. |
CVE-2021-32728 | Medium | 6.5 | 2021-08-18 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature do… |
CVE-2021-38710 | Medium | 6.1 | 2021-08-18 | Static (Persistent) XSS Vulnerability exists in version 4.3.0 of Yclas when using the install/view/form.php script. An attacker can store XSS in the database t… |
CVE-2021-37714 | High | 7.5 | 2021-08-18 | jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If t… |
CVE-2021-37702 | High | 8.0 | 2021-08-18 | Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patc… |
CVE-2021-37358 | Critical | 9.8 | 2021-08-18 | SQL Injection in SEACMS v210530 (2021-05-30) allows remote attackers to execute arbitrary code via the component "admin_ajax.php?action=checkrepeat&v_name=". |
CVE-2021-21868 | High | 7.8 | 2021-08-18 | An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System… |
CVE-2021-21867 | High | 7.8 | 2021-08-18 | An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development Syst… |
CVE-2021-21862 | High | 8.8 | 2021-08-18 | Multiple exploitable integer truncation vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1… |
CVE-2021-21781 | Low | 3.3 | 2021-08-18 | An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. The latest version (5.11-rc4) seems to sti… |
CVE-2021-0628 | Medium | 6.7 | 2021-08-18 | In OMA DRM, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege with System execution priv… |
CVE-2021-0627 | Medium | 6.7 | 2021-08-18 | In OMA DRM, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with System execution privileges… |
CVE-2021-0626 | Medium | 6.7 | 2021-08-18 | In ged, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2021-0420 | Medium | 5.5 | 2021-08-18 | In memory management driver, there is a possible system crash due to a missing bounds check. This could lead to local denial of service with no additional exec… |
CVE-2021-0419 | Medium | 5.5 | 2021-08-18 | In memory management driver, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional e… |
CVE-2021-0418 | Medium | 5.5 | 2021-08-18 | In memory management driver, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional e… |
CVE-2021-0417 | Medium | 5.5 | 2021-08-18 | In memory management driver, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional e… |
CVE-2021-0416 | Medium | 5.5 | 2021-08-18 | In memory management driver, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional e… |
CVE-2021-0415 | Medium | 5.5 | 2021-08-18 | In memory management driver, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with… |
CVE-2021-0408 | Medium | 5.5 | 2021-08-18 | In asf extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional e… |
CVE-2021-0407 | Medium | 6.7 | 2021-08-18 | In clk driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution… |
CVE-2021-21858 | High | 8.8 | 2021-08-18 | Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A… |
CVE-2021-21857 | High | 8.8 | 2021-08-18 | Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A… |
CVE-2021-21856 | High | 8.8 | 2021-08-18 | Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A… |
CVE-2021-21855 | High | 8.8 | 2021-08-18 | Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A… |
CVE-2021-21854 | High | 8.8 | 2021-08-18 | Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A… |
CVE-2021-21853 | High | 8.8 | 2021-08-18 | Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A… |
CVE-2021-21852 | High | 8.8 | 2021-08-18 | Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A… |
CVE-2021-21851 | High | 8.8 | 2021-08-18 | Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A… |
CVE-2021-21847 | High | 8.8 | 2021-08-18 | Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A… |
CVE-2021-21846 | High | 8.8 | 2021-08-18 | Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A… |
CVE-2021-21845 | High | 8.8 | 2021-08-18 | Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A… |
CVE-2021-21844 | High | 8.8 | 2021-08-18 | Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A… |
CVE-2021-21843 | High | 8.8 | 2021-08-18 | Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A… |
CVE-2021-21839 | High | 8.8 | 2021-08-18 | Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A… |
CVE-2021-21838 | High | 8.8 | 2021-08-18 | Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A… |
CVE-2021-21837 | High | 8.8 | 2021-08-18 | Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A… |
CVE-2021-21825 | Critical | 9.8 | 2021-08-18 | A heap-based buffer overflow vulnerability exists in the XML Decompression PlainTextUncompressor::UncompressItem functionality of AT&T Labs’ Xmill 0.7. A speci… |
CVE-2021-31820 | High | 7.5 | 2021-08-18 | In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the U… |
CVE-2021-37608 | Critical | 9.8 | 2021-08-18 | Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz allows an attacker to execute remote commands. This issue affects Apache OFBiz ve… |
CVE-2021-33580 | High | 7.5 | 2021-08-18 | User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The atta… |
CVE-2021-20792 | Medium | 6.1 | 2021-08-18 | Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vecto… |
CVE-2021-20775 | Medium | 4.3 | 2021-08-18 | Improper input validation vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the data of Comment and S… |
CVE-2021-20774 | Medium | 5.4 | 2021-08-18 | Cross-site scripting vulnerability in some functions of E-mail of Cybozu Garoon 4.0.0 to 5.5.0 allows a remote authenticated attacker to inject an arbitrary sc… |
CVE-2021-20773 | Medium | 4.3 | 2021-08-18 | There is a vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.5.0, which may allow a remote authenticated attacker to delete the route information Workflow… |
CVE-2021-20772 | Medium | 4.3 | 2021-08-18 | Information disclosure vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the title of Bulletin withou… |
CVE-2021-20771 | Medium | 6.1 | 2021-08-18 | Cross-site scripting vulnerability in some functions of E-Mail of Cybozu Garoon 4.0.0 to 5.5.0 allows a remote attacker to inject an arbitrary script via unspe… |
CVE-2021-20770 | Medium | 5.4 | 2021-08-18 | Cross-site scripting vulnerability in Message of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspecif… |
CVE-2021-20769 | Medium | 5.4 | 2021-08-18 | Cross-site scripting vulnerability in Bulletin of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspeci… |
CVE-2021-20768 | Medium | 4.3 | 2021-08-18 | Operational restrictions bypass vulnerability in Scheduler and MultiReport of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to delete the… |
CVE-2021-20767 | Medium | 5.4 | 2021-08-18 | Cross-site scripting vulnerability in Full Text Search of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via… |
CVE-2021-20766 | Medium | 6.1 | 2021-08-18 | Cross-site scripting vulnerability in Message of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to inject an arbitrary script via unspecified vectors. |
CVE-2021-20765 | Medium | 6.1 | 2021-08-18 | Cross-site scripting vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to inject an arbitrary script via unspecified vectors. |
CVE-2021-20764 | Medium | 5.3 | 2021-08-18 | Improper input validation vulnerability in Attaching Files of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to alter the data of Attaching Files. |
CVE-2021-20763 | Medium | 4.3 | 2021-08-18 | Operational restrictions bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the data of Portal wit… |
CVE-2021-20762 | Medium | 4.3 | 2021-08-18 | Improper input validation vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated to alter the data of E-mail without the appropr… |
CVE-2021-20761 | Low | 2.7 | 2021-08-18 | Improper input validation vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker with an administrative privilege to alter the data o… |
CVE-2021-20760 | Medium | 4.3 | 2021-08-18 | Improper input validation vulnerability in User Profile of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data of User Profil… |
CVE-2021-20759 | Medium | 4.3 | 2021-08-18 | Operational restrictions bypass vulnerability in Bulletin of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to alter the data of Portal wi… |
CVE-2021-20758 | High | 8.0 | 2021-08-18 | Cross-site request forgery (CSRF) vulnerability in Message of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to hijack the authentication… |
CVE-2021-20757 | Medium | 4.3 | 2021-08-18 | Operational restrictions bypass vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data of Portal with… |
CVE-2021-20756 | Medium | 4.3 | 2021-08-18 | Viewing restrictions bypass vulnerability in Address of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the data of Address witho… |
CVE-2021-20755 | Medium | 4.3 | 2021-08-18 | Viewing restrictions bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the data of Portal without… |
CVE-2021-20754 | Medium | 4.3 | 2021-08-18 | Improper input validation vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data of Workflow withou… |
CVE-2021-20753 | Medium | 5.4 | 2021-08-18 | Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspec… |
CVE-2021-39268 | Medium | 6.1 | 2021-08-18 | Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via malicious… |
CVE-2021-39267 | Medium | 6.1 | 2021-08-18 | Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via a Content-… |
CVE-2021-39250 | Medium | 5.4 | 2021-08-17 | Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploaded file can be place… |