2021 CVEs (page 139)
Page 139 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-27741 | Critical | 9.1 | 2021-08-13 | " Security vulnerability in HCL Commerce Management Center allowing XML external entity (XXE) injection" |
CVE-2021-31399 | Medium | 4.6 | 2021-08-13 | On 2N Access Unit 2.0 2.31.0.40.5 devices, an attacker can pose as the web relay for a man-in-the-middle attack. |
CVE-2021-37353 | Critical | 9.8 | 2021-08-13 | Nagios XI Docker Wizard before version 1.1.3 is vulnerable to SSRF due to improper sanitation in table_population.php. |
CVE-2021-37352 | Medium | 6.1 | 2021-08-13 | An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. To exploit the vulnerability, an attacker could send a lin… |
CVE-2021-37351 | Medium | 5.3 | 2021-08-13 | Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a crafted HTTP request to… |
CVE-2021-37350 | Critical | 9.8 | 2021-08-13 | Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation. |
CVE-2021-37349 | High | 7.8 | 2021-08-13 | Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the database. |
CVE-2021-37348 | High | 7.5 | 2021-08-13 | Nagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation of a pathname in index.php. |
CVE-2021-37347 | High | 7.8 | 2021-08-13 | Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argumen… |
CVE-2021-37346 | Critical | 9.8 | 2021-08-13 | Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Comma… |
CVE-2021-37345 | High | 7.8 | 2021-08-13 | Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for some scripts with el… |
CVE-2021-37344 | Critical | 9.8 | 2021-08-13 | Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (… |
CVE-2021-37343 | High | 8.8 | 2021-08-13 | A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context… |
CVE-2021-37695 | High | 7.3 | 2021-08-13 | ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ck… |
CVE-2021-37690 | Medium | 6.6 | 2021-08-13 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions when running shape functions, some functions (such as `MutableHashT… |
CVE-2021-38614 | High | 7.5 | 2021-08-12 | Polipo through 1.1.1, when NDEBUG is used, allows a heap-based buffer overflow during parsing of a Range header. NOTE: This vulnerability only affects products… |
CVE-2021-38603 | Medium | 4.8 | 2021-08-12 | PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field. |
CVE-2021-38602 | Medium | 4.8 | 2021-08-12 | PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content. |
CVE-2021-37692 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions under certain conditions, Go code can trigger a segfault in string… |
CVE-2021-37691 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a division… |
CVE-2021-37687 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions TFLite's [`GatherNd` implementation](https://github.com/tensorflow/… |
CVE-2021-37685 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions TFLite's [`expand_dims.cc`](https://github.com/tensorflow/tensorflo… |
CVE-2021-37684 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementations of pooling in TFLite are vulnerable to division… |
CVE-2021-37683 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of division in TFLite is [vulnerable to a divisi… |
CVE-2021-37682 | Medium | 4.4 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions all TFLite operations that use quantization can be made to use unit… |
CVE-2021-37679 | High | 7.1 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions it is possible to nest a `tf.map_fn` within another `tf.map_fn` cal… |
CVE-2021-37678 | Critical | 9.3 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execu… |
CVE-2021-37677 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the shape inference code for `tf.raw_ops.Dequantize` has a vulnerab… |
CVE-2021-37674 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a denial of service via a segmentation faul… |
CVE-2021-37673 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a denial of service via a `CHECK`-fail in `… |
CVE-2021-37672 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of heap allocated data… |
CVE-2021-37670 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of heap allocated data… |
CVE-2021-37669 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause denial of service in applications serving mod… |
CVE-2021-37668 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause denial of service in applications serving mod… |
CVE-2021-37665 | High | 7.8 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions due to incomplete validation in MKL implementation of requantizatio… |
CVE-2021-37663 | High | 7.8 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions due to incomplete validation in `tf.raw_ops.QuantizeV2`, an attacke… |
CVE-2021-37689 | High | 7.8 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a null poin… |
CVE-2021-37688 | High | 7.8 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a null poin… |
CVE-2021-37686 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the strided slice implementation in TFLite has a logic bug which ca… |
CVE-2021-37681 | High | 7.8 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of SVDF in TFLite is [vulnerable to a null point… |
CVE-2021-37680 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of fully connected layers in TFLite is [vulnerab… |
CVE-2021-37676 | High | 7.8 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to… |
CVE-2021-37675 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions most implementations of convolution operators in TensorFlow are aff… |
CVE-2021-37671 | High | 7.8 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to… |
CVE-2021-37667 | High | 7.8 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to… |
CVE-2021-37666 | High | 7.8 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to… |
CVE-2021-37652 | High | 7.8 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation for `tf.raw_ops.BoostedTreesCreateEnsemble` can… |
CVE-2021-37648 | High | 7.8 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the code for `tf.raw_ops.SaveV2` does not properly validate the inp… |
CVE-2021-31731 | Medium | 6.5 | 2021-08-12 | A directory traversal issue in KiteCMS 1.1.1 allows remote administrators to overwrite arbitrary files via ../ in the path parameter to index.php/admin/Templat… |
CVE-2021-31698 | Critical | 9.8 | 2021-08-12 | Quectel EG25-G devices through 202006130814 allow executing arbitrary code remotely by using an AT command to place shell metacharacters in quectel_handle_fumo… |
CVE-2021-31556 | Critical | 9.8 | 2021-08-12 | An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. MWOAuthConsumerSubmitControl.php does not ensure that the length of an RSA key wil… |
CVE-2021-29377 | Critical | 9.8 | 2021-08-12 | Pear Admin Think through 2.1.2 has an arbitrary file upload vulnerability that allows attackers to execute arbitrary code remotely. A .php file can be uploaded… |
CVE-2021-28890 | Critical | 9.8 | 2021-08-12 | J2eeFAST 2.2.1 allows remote attackers to perform SQL injection via the (1) compId parameter to fast/sys/user/list, (2) deptId parameter to fast/sys/role/list… |
CVE-2021-28121 | Critical | 9.8 | 2021-08-12 | Virtual Robots.txt before 1.10 does not block HTML tags in the robots.txt field. |
CVE-2021-38366 | High | 8.8 | 2021-08-12 | Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code execution by visiting… |
CVE-2021-37700 | Medium | 6.5 | 2021-08-12 | @github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before ve… |
CVE-2021-37664 | High | 7.3 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of heap allocated data… |
CVE-2021-37662 | High | 7.1 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can generate undefined behavior via a reference binding… |
CVE-2021-37661 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a denial of service in `boosted_trees_create_… |
CVE-2021-37659 | High | 7.3 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to… |
CVE-2021-37658 | High | 7.1 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to… |
CVE-2021-37657 | High | 7.1 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to… |
CVE-2021-37656 | High | 7.1 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to… |
CVE-2021-37655 | High | 7.3 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a read from outside of bounds of heap alloc… |
CVE-2021-37654 | High | 7.3 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a crash via a `CHECK`-fail in debug builds… |
CVE-2021-37651 | High | 7.1 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation for `tf.raw_ops.FractionalAvgPoolGrad` can be tr… |
CVE-2021-37650 | High | 7.8 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation for `tf.raw_ops.ExperimentalDatasetToTFRecord` a… |
CVE-2021-37646 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.StringNGrams` is vulnerable to an… |
CVE-2021-37645 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.QuantizeAndDequantizeV4Grad` is v… |
CVE-2021-37644 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions providing a negative element to `num_elements` list argument of `tf… |
CVE-2021-37641 | High | 7.3 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions if the arguments to `tf.raw_ops.RaggedGather` don't determine a val… |
CVE-2021-37635 | High | 7.3 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of sparse reduction operations in TensorFlow can… |
CVE-2021-37599 | Critical | 9.8 | 2021-08-12 | The exporter/Login.aspx login form in the Exporter in Nuance Winscribe Dictation 4.1.0.99 is vulnerable to SQL injection that allows a remote, unauthenticated… |
CVE-2021-33199 | Critical | 9.8 | 2021-08-12 | In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input->get('file') instead of the fixed file na… |
CVE-2021-33056 | High | 7.5 | 2021-08-12 | Belledonne Belle-sip before 4.5.20, as used in Linphone and other products, can crash via an invalid From header in a SIP message. |
CVE-2021-37704 | Medium | 5.4 | 2021-08-12 | PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and 8.0.7 the `phpinfo(… |
CVE-2021-37649 | High | 7.7 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. The code for `tf.raw_ops.UncompressElement` can be made to trigger a null pointer derefe… |
CVE-2021-37647 | High | 7.7 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. When a user does not supply arguments that determine a valid sparse tensor, `tf.raw_ops… |
CVE-2021-37643 | High | 7.7 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. If a user does not provide a valid padding value to `tf.raw_ops.MatrixDiagPartOp`, then… |
CVE-2021-37639 | High | 8.4 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. When restoring tensors via raw APIs, if the tensor name is not provided, TensorFlow can… |
CVE-2021-37638 | High | 7.7 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. Sending invalid argument for `row_partition_types` of `tf.raw_ops.RaggedTensorToTensor`… |
CVE-2021-37637 | High | 7.7 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. It is possible to trigger a null pointer dereference in TensorFlow by passing an invalid… |
CVE-2021-37660 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a floating point exception by calling inplace… |
CVE-2021-37653 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a crash via a floating point exception in `… |
CVE-2021-37642 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.ResourceScatterDiv` is vulnerable… |
CVE-2021-37640 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.SparseReshape` can be made to tri… |
CVE-2021-37636 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.SparseDenseCwiseDiv` is vulnerabl… |
CVE-2021-36982 | High | 8.1 | 2021-08-12 | AIMANAGER before B115 on MONITORAPP Application Insight Web Application Firewall (AIWAF) devices with Manager 2.1.0 allows OS Command Injection because of miss… |
CVE-2021-36958 | High | 7.8 | 2021-08-12 | A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfull… |
CVE-2021-36950 | Medium | 5.4 | 2021-08-12 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability |
CVE-2021-36949 | High | 7.1 | 2021-08-12 | Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability |
CVE-2021-36948 | High | 7.8 | 2021-08-12 | Windows Update Medic Service Elevation of Privilege Vulnerability |
CVE-2021-36947 | High | 8.8 | 2021-08-12 | Windows Print Spooler Remote Code Execution Vulnerability |
CVE-2021-36946 | Medium | 5.4 | 2021-08-12 | Microsoft Dynamics Business Central Cross-site Scripting Vulnerability |
CVE-2021-36945 | High | 7.3 | 2021-08-12 | Windows 10 Update Assistant Elevation of Privilege Vulnerability |
CVE-2021-36943 | Medium | 4.0 | 2021-08-12 | Azure CycleCloud Elevation of Privilege Vulnerability |
CVE-2021-36942 | High | 7.5 | 2021-08-12 | Windows LSA Spoofing Vulnerability |
CVE-2021-36941 | High | 7.8 | 2021-08-12 | Microsoft Word Remote Code Execution Vulnerability |
CVE-2021-36940 | High | 7.6 | 2021-08-12 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2021-36938 | Medium | 5.5 | 2021-08-12 | Windows Cryptographic Primitives Library Information Disclosure Vulnerability |