2021 CVEs (page 137)
Page 137 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-39249 | Medium | 6.1 | 2021-08-17 | Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS because the filenames of uploaded files become predictable through… |
CVE-2021-39131 | High | 7.5 | 2021-08-17 | ced detects character encoding using Google’s compact_enc_det library. In ced v0.1.0, passing data types other than `Buffer` causes the Node.js process to cras… |
CVE-2021-0284 | High | 7.5 | 2021-08-17 | A buffer overflow vulnerability in the TCP/IP stack of Juniper Networks Junos OS allows an attacker to send specific sequences of packets to the device thereby… |
CVE-2021-28372 | High | 8.3 | 2021-08-17 | ThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek (TUTK) device given a valid 20-byte uniquely assigned identif… |
CVE-2021-39248 | Medium | 6.1 | 2021-08-17 | Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via crafted LaTeX content within a discussion. |
CVE-2021-39247 | Medium | 6.5 | 2021-08-17 | Zint Barcode Generator before 2.10.0 has a one-byte buffer over-read, related to is_last_single_ascii in code1.c, and rs_encode_uint in reedsol.c. |
CVE-2021-38702 | Medium | 6.1 | 2021-08-17 | Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 allow tweb/ft.php?u=[XSS] attacks. |
CVE-2021-29990 | High | 8.8 | 2021-08-17 | Mozilla developers and community members reported memory safety bugs present in Firefox 90. Some of these bugs showed evidence of memory corruption and we pres… |
CVE-2021-29989 | High | 8.8 | 2021-08-17 | Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these bugs showed evidence of memory corruption and we pres… |
CVE-2021-29988 | High | 8.8 | 2021-08-17 | Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a potentially exploita… |
CVE-2021-29987 | Medium | 6.5 | 2021-08-17 | After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still… |
CVE-2021-29986 | High | 8.1 | 2021-08-17 | A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash. *Note: This issue only affected Linux operati… |
CVE-2021-29985 | High | 8.8 | 2021-08-17 | A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbir… |
CVE-2021-29984 | High | 8.8 | 2021-08-17 | Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection. This led to me… |
CVE-2021-29983 | Medium | 6.5 | 2021-08-17 | Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit. *Note: This issue only affe… |
CVE-2021-29982 | Medium | 6.5 | 2021-08-17 | Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a single bit of memory. Th… |
CVE-2021-29981 | High | 8.8 | 2021-08-17 | An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code that would lead to a po… |
CVE-2021-29980 | High | 8.8 | 2021-08-17 | Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash. This vulnerabil… |
CVE-2021-21832 | Critical | 9.8 | 2021-08-17 | A memory corruption vulnerability exists in the ISO Parsing functionality of Disc Soft Ltd Deamon Tools Pro 8.3.0.0767. A specially crafted malformed file can… |
CVE-2021-21810 | Critical | 9.8 | 2021-08-17 | A memory corruption vulnerability exists in the XML-parsing ParseAttribs functionality of AT&T Labs’ Xmill 0.7. A specially crafted XML file can lead to a heap… |
CVE-2021-39242 | High | 7.5 | 2021-08-17 | An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host… |
CVE-2021-39241 | Medium | 5.3 | 2021-08-17 | An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space follo… |
CVE-2021-39240 | High | 7.5 | 2021-08-17 | An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI ha… |
CVE-2021-29313 | Medium | 6.1 | 2021-08-17 | Cross Site Scripting (XSS) vulnerability exists in SeaCMS 12.6 via the (1) v_company and (2) v_tvs parameters in /admin_video.php, |
CVE-2021-25263 | High | 7.8 | 2021-08-17 | Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged, attacker to execute arbitary code with the SYST… |
CVE-2021-22156 | Critical | 9.0 | 2021-08-17 | An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software Development Platform (SDP)… |
CVE-2021-0646 | High | 7.8 | 2021-08-17 | In sqlite3_str_vappendf of sqlite3.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privileg… |
CVE-2021-0645 | High | 7.8 | 2021-08-17 | In shouldBlockFromTree of ExternalStorageProvider.java, there is a possible permissions bypass. This could lead to local escalation of privilege, allowing an a… |
CVE-2021-0642 | Medium | 5.5 | 2021-08-17 | In onResume of VoicemailSettingsFragment.java, there is a possible way to retrieve a trackable identifier without permissions due to a missing permission check… |
CVE-2021-0641 | Medium | 5.5 | 2021-08-17 | In getAvailableSubscriptionInfoList of SubscriptionController.java, there is a possible disclosure of unique identifiers due to a missing permission check. Thi… |
CVE-2021-0640 | High | 7.8 | 2021-08-17 | In noteAtomLogged of StatsdStats.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege w… |
CVE-2021-0639 | Medium | 5.5 | 2021-08-17 | In multiple functions of libl3oemcrypto.cpp, there is a possible weakness in the existing obfuscation mechanism due to the way sensitive data is handled. This… |
CVE-2021-0593 | High | 7.8 | 2021-08-17 | In sendDevicePickedIntent of DevicePickerFragment.java, there is a possible way to invoke a privileged broadcast receiver due to a confused deputy. This could… |
CVE-2021-0591 | High | 7.3 | 2021-08-17 | In sendReplyIntentToReceiver of BluetoothPermissionActivity.java, there is a possible way to invoke privileged broadcast receivers due to a confused deputy. Th… |
CVE-2021-0584 | Medium | 5.5 | 2021-08-17 | In verifyBufferObject of Parcel.cpp, there is a possible out of bounds read due to an improper input validation. This could lead to local information disclosur… |
CVE-2021-0582 | Medium | 6.5 | 2021-08-17 | In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a proximal attacker w… |
CVE-2021-0581 | Medium | 6.5 | 2021-08-17 | In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a proximal attacker w… |
CVE-2021-0580 | Medium | 6.5 | 2021-08-17 | In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a proximal attacker w… |
CVE-2021-0579 | Medium | 6.5 | 2021-08-17 | In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a proximal attacker w… |
CVE-2021-0578 | Medium | 6.5 | 2021-08-17 | In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a proximal attacker w… |
CVE-2021-0576 | High | 7.8 | 2021-08-17 | In flv extractor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional ex… |
CVE-2021-0574 | High | 7.8 | 2021-08-17 | In asf extractor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional ex… |
CVE-2021-0573 | High | 7.8 | 2021-08-17 | In asf extractor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional ex… |
CVE-2021-0519 | High | 7.8 | 2021-08-17 | In BITSTREAM_FLUSH of ih264e_bitstream.h, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local information disclosur… |
CVE-2021-32830 | Low | 3.9 | 2021-08-17 | The @diez/generation npm package is a client for Diez. The locateFont method of @diez/generation has a command injection vulnerability. Clients of the @diez/ge… |
CVE-2021-29056 | Medium | 4.8 | 2021-08-17 | Cross Site Scripting (XSS) vulnerability exists in Pixelimity 1.0 via the HTTP POST parameter to admin/setting.php. |
CVE-2021-3633 | High | 7.3 | 2021-08-17 | A DLL preloading vulnerability was reported in Lenovo Driver Management prior to version 2.9.0719.1104 that could allow privilege escalation. |
CVE-2021-3617 | High | 7.2 | 2021-08-17 | A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted network configuration. Th… |
CVE-2021-3616 | Critical | 9.4 | 2021-08-17 | A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware content an… |
CVE-2021-3615 | Medium | 6.6 | 2021-08-17 | A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file exists on the attached SD card. This vul… |
CVE-2021-3459 | Medium | 6.8 | 2021-08-17 | A privilege escalation vulnerability was reported in the MM1000 device configuration web server, which could allow privileged shell access and/or arbitrary pri… |
CVE-2021-3458 | Medium | 6.1 | 2021-08-17 | The Motorola MM1000 device configuration portal can be accessed without authentication, which could allow adapter settings to be modified. |
CVE-2021-32829 | Critical | 9.6 | 2021-08-17 | ZStack is open source IaaS(infrastructure as a service) software aiming to automate datacenters, managing resources of compute, storage, and networking all by… |
CVE-2021-25957 | High | 8.8 | 2021-08-17 | In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the passw… |
CVE-2021-25956 | Medium | 4.7 | 2021-08-17 | In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate alrea… |
CVE-2021-37711 | High | 8.8 | 2021-08-16 | Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL. Version 6.4.3.1 contains a patch. As worka… |
CVE-2021-37710 | High | 8.0 | 2021-08-16 | Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a Cross-Site Scripting vulnerability via SVG media files. Version 6.4.3.1 cont… |
CVE-2021-37709 | Medium | 6.5 | 2021-08-16 | Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability involving an insecure direct object reference of log files of… |
CVE-2021-36282 | Low | 2.5 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x - 9.1.0.x contain a use of uninitialized resource vulnerability. This can potentially allow an authenticated user with… |
CVE-2021-36281 | High | 7.5 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment vulnerability. A low privileged authenticated user can potentially… |
CVE-2021-36280 | High | 7.8 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. This could allow a user with I… |
CVE-2021-36279 | High | 7.8 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. This could allow a user with I… |
CVE-2021-36278 | High | 8.1 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x, 9.1.0.x, and 9.1.1.1 contain a sensitive information exposure vulnerability in log files. A local malicious user with… |
CVE-2021-21599 | Medium | 6.0 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x - 9.2.1.x contain an OS command injection vulnerability. This may allow a user with ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOG… |
CVE-2021-21595 | Medium | 6.0 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x - 9.1.1.x contain an improper neutralization of special elements used in an OS command. This vulnerability could allow… |
CVE-2021-21594 | High | 8.2 | 2021-08-16 | Dell PowerScale OneFS versions 8.2.2 - 9.1.0.x contain a use of get request method with sensitive query strings vulnerability. It can lead to potential disclos… |
CVE-2021-21592 | Low | 3.1 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x improperly handle an exceptional condition. A remote low privileged user could potentially exploit this vulner… |
CVE-2021-21568 | Medium | 4.3 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an insufficient logging vulnerability. An authenticated user with ISI_PRIV_LOGIN_PAPI could make un-au… |
CVE-2021-32827 | Medium | 6.1 | 2021-08-16 | MockServer is open source software which enables easy mocking of any system you integrate with via HTTP or HTTPS. An attacker that can trick a victim into visi… |
CVE-2021-32826 | Medium | 6.8 | 2021-08-16 | Proxyee-Down is open source proxy software. An attacker being able to provide an extension script (eg: through a MiTM attack or by hosting a malicious extensio… |
CVE-2021-38608 | High | 7.8 | 2021-08-16 | Incorrect Access Control in Tranquil WAPT Enterprise - before 1.8.2.7373 and before 2.0.0.9450 allows guest OS users to escalate privileges via WAPT Agent. |
CVE-2021-37708 | High | 8.8 | 2021-08-16 | Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a command injection vulnerability in mail agent settings. Version 6.4.3.1 cont… |
CVE-2021-21861 | High | 8.8 | 2021-08-16 | An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. When pr… |
CVE-2021-21860 | High | 8.8 | 2021-08-16 | An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A speci… |
CVE-2021-21859 | High | 8.8 | 2021-08-16 | An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. The str… |
CVE-2021-38315 | Medium | 6.1 | 2021-08-16 | The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the ~/func… |
CVE-2021-37707 | Medium | 6.5 | 2021-08-16 | Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability that allows manipulation of product reviews via API. Version 6… |
CVE-2021-34667 | Medium | 6.1 | 2021-08-16 | The Calendar_plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of `$_SERVER['PHP_SELF']` in the ~/calendar.php file which… |
CVE-2021-34666 | Medium | 6.1 | 2021-08-16 | The Add Sidebar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the add parameter in the ~/wp_sidebarMenu.php file which allows attackers… |
CVE-2021-34665 | Medium | 6.1 | 2021-08-16 | The WP SEO Tags WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the saq_txt_the_filter parameter in the ~/wp-seo-tags.php file which allow… |
CVE-2021-34664 | Medium | 6.1 | 2021-08-16 | The Moova for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the lat parameter in the ~/Checkout/Checkout.php file which allo… |
CVE-2021-34663 | Medium | 6.1 | 2021-08-16 | The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/jquery-tagline-rota… |
CVE-2021-34659 | Medium | 6.1 | 2021-08-16 | The Plugmatter Pricing Table Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `email` parameter in the ~/license.php file which al… |
CVE-2021-34658 | Medium | 6.1 | 2021-08-16 | The Simple Popup Newsletter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/simple-popup-newsl… |
CVE-2021-34657 | Medium | 6.1 | 2021-08-16 | The 2TypoFR WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the text function found in the ~/vendor/Org_Heigl/Hyphenator/index.php file wh… |
CVE-2021-34656 | Medium | 6.1 | 2021-08-16 | The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `vws_notice` function fou… |
CVE-2021-34655 | Medium | 6.1 | 2021-08-16 | The WP Songbook WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the url parameter found in the ~/inc/class.ajax.php file which allows atta… |
CVE-2021-34654 | Medium | 6.1 | 2021-08-16 | The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptr[name] parameter found in the ~/pages/admin-page.ph… |
CVE-2021-34653 | Medium | 6.1 | 2021-08-16 | The WP Fountain WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/wp-fountain.php file which all… |
CVE-2021-34652 | Medium | 6.1 | 2021-08-16 | The Media Usage WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the ~/mmu_admin.php file which allows attackers to inj… |
CVE-2021-34651 | Medium | 6.1 | 2021-08-16 | The Scribble Maps WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the map parameter in the ~/includes/admin.php file which allows attacker… |
CVE-2021-34649 | Medium | 6.1 | 2021-08-16 | The Simple Behance Portfolio WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `dark` parameter in the ~/titan-framework/iframe-font-pre… |
CVE-2021-34644 | Medium | 6.1 | 2021-08-16 | The Multiplayer Games WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/multiplayergames.php fil… |
CVE-2021-34643 | Medium | 6.1 | 2021-08-16 | The Skaut bazar WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/skaut-bazar.php file which all… |
CVE-2021-34642 | Medium | 6.1 | 2021-08-16 | The Smart Email Alerts WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the api_key in the ~/views/settings.php file which allows attackers… |
CVE-2021-34641 | Medium | 6.4 | 2021-08-16 | The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/src/Actions/Api/TitleDescriptionMeta.php… |
CVE-2021-32825 | Low | 2.7 | 2021-08-16 | bblfshd is an open source self-hosted server for source code parsing. In bblfshd before commit 4265465b9b6fb5663c30ee43806126012066aad4 there is a "zipslip" vu… |
CVE-2021-32822 | Medium | 4.0 | 2021-08-16 | The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. Th… |
CVE-2021-22940 | High | 7.5 | 2021-08-16 | Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to chang… |
CVE-2021-22939 | Medium | 5.3 | 2021-08-16 | If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to se… |