2021 CVEs (page 14)
Page 14 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-24566 | High | 8.8 | 2024-01-16 | The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode. |
CVE-2021-24559 | Medium | 5.4 | 2024-01-16 | The Qyrr WordPress plugin before 0.7 does not escape the data-uri of the QR Code when outputting it in a src attribute, allowing for Cross-Site Scripting attac… |
CVE-2021-24433 | Medium | 5.4 | 2024-01-16 | The simple sort&search WordPress plugin through 0.0.3 does not make sure that the indexurl parameter of the shortcodes "category_sims", "order_sims", "orderby_… |
CVE-2021-24432 | Medium | 6.1 | 2024-01-16 | The Advanced AJAX Product Filters WordPress plugin does not sanitise the 'term_id' POST parameter before outputting it in the page, leading to reflected Cross-… |
CVE-2021-24151 | High | 7.2 | 2024-01-16 | The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via… |
CVE-2021-4432 | Medium | 5.3 | 2024-01-16 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as problematic. This affects an unknown part of the component USER Command Handler… |
CVE-2021-3600 | High | 7.8 | 2024-01-08 | It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod o… |
CVE-2021-45465 | High | 7.8 | 2024-01-04 | A vulnerability has been identified in syngo fastView (All versions). The affected application lacks proper validation of user-supplied data when parsing BMP f… |
CVE-2021-42028 | High | 7.8 | 2024-01-04 | A vulnerability has been identified in syngo fastView (All versions). The affected application lacks proper validation of user-supplied data when parsing BMP f… |
CVE-2021-40367 | High | 7.8 | 2024-01-04 | A vulnerability has been identified in syngo fastView (All versions). The affected application lacks proper validation of user-supplied data when parsing DICOM… |
CVE-2021-46901 | High | 7.5 | 2023-12-31 | examples/6lbr/apps/6lbr-webserver/httpd.c in CETIC-6LBR (aka 6lbr) 1.5.0 has a strcat stack-based buffer overflow via a request for a long URL over a 6LoWPAN n… |
CVE-2021-46900 | High | 7.5 | 2023-12-31 | Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an unpredictable value… |
CVE-2021-38927 | High | 7.2 | 2023-12-25 | IBM Aspera Console 3.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2021-22962 | Critical | 9.1 | 2023-12-19 | An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. |
CVE-2021-42797 | High | 7.5 | 2023-12-16 | Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal the Windows access t… |
CVE-2021-42796 | Critical | 9.8 | 2023-12-16 | An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticated arbitrary command… |
CVE-2021-42794 | Medium | 5.3 | 2023-12-16 | An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior. The application allows a client to provide a malicious connectio… |
CVE-2021-3187 | High | 8.8 | 2023-12-11 | An issue was discovered in BeyondTrust Privilege Management for Mac before 5.7. An authenticated, unprivileged user can elevate privileges by running a malicio… |
CVE-2021-46899 | High | 7.8 | 2023-12-09 | SyncTrayzor 1.1.29 enables CEF (Chromium Embedded Framework) remote debugging, allowing a local attacker to control the application. |
CVE-2021-27795 | Medium | 6.4 | 2023-12-06 | Brocade Fabric OS (FOS) hardware platforms running any version of Brocade Fabric OS software, which supports the license string format; contain cryptographic… |
CVE-2021-35975 | Medium | 5.3 | 2023-11-30 | Absolute path traversal vulnerability in the Systematica SMTP Adapter component (up to v2.0.1.101) in Systematica Radius (up to v.3.9.256.777) allows remote at… |
CVE-2021-36806 | Medium | 4.7 | 2023-11-30 | A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sophos Email Appliance older than versio… |
CVE-2021-39008 | Low | 2.7 | 2023-11-23 | IBM QRadar WinCollect Agent 10.0 through 10.1.7 could allow a privileged user to obtain sensitive information due to missing best practices. IBM X-Force ID: 2… |
CVE-2021-37942 | High | 7.0 | 2023-11-22 | A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the… |
CVE-2021-37937 | Medium | 5.9 | 2023-11-22 | An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that… |
CVE-2021-22143 | Low | 2.1 | 2023-11-22 | The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will saniti… |
CVE-2021-22151 | Low | 3.1 | 2023-11-22 | It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily travers… |
CVE-2021-22150 | Medium | 6.6 | 2023-11-22 | It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package… |
CVE-2021-22142 | Medium | 6.6 | 2023-11-22 | Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user with permissions to… |
CVE-2021-38405 | High | 7.8 | 2023-11-21 | The Datalogics APDFL library used in affected products is vulnerable to memory corruption condition while parsing specially crafted PDF files. An attacker coul… |
CVE-2021-27504 | High | 7.4 | 2023-11-21 | Texas Instruments devices running FREERTOS, malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow… |
CVE-2021-27502 | High | 7.4 | 2023-11-21 | Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which ca… |
CVE-2021-27429 | High | 7.4 | 2023-11-20 | Texas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in 'HeapTrac… |
CVE-2021-22636 | High | 7.4 | 2023-11-20 | Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, whi… |
CVE-2021-35437 | Critical | 9.8 | 2023-11-16 | SQL injection vulnerability in LMXCMS v.1.4 allows attacker to execute arbitrary code via the TagsAction.class. |
CVE-2021-46774 | Medium | 6.7 | 2023-11-14 | Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, potentially resulting… |
CVE-2021-46766 | Low | 2.5 | 2023-11-14 | Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially leading to a loss of… |
CVE-2021-46758 | Medium | 6.1 | 2023-11-14 | Insufficient validation of SPI flash addresses in the ASP (AMD Secure Processor) bootloader may allow an attacker to read data in memory mapped beyond SPI flas… |
CVE-2021-46748 | Medium | 5.5 | 2023-11-14 | Insufficient bounds checking in the ASP (AMD Secure Processor) may allow an attacker to access memory outside the bounds of what is permissible to a TA (Truste… |
CVE-2021-26345 | Low | 1.9 | 2023-11-14 | Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to force an out-of-bounds memory read potentially resulting… |
CVE-2021-43609 | Critical | 9.9 | 2023-11-09 | An issue was discovered in Spiceworks Help Desk Server before 1.3.3. A Blind Boolean SQL injection vulnerability within the order_by_for_ticket function in app… |
CVE-2021-43419 | High | 7.5 | 2023-11-07 | An Information Disclosure vulnerability exists in Opay Mobile application 1.5.1.26 and maybe be higher in the logcat app. |
CVE-2021-4431 | Low | 3.5 | 2023-11-07 | A vulnerability classified as problematic has been found in msyk FMDataAPI up to 22. Affected is an unknown function of the file FMDataAPI_Sample.php. The mani… |
CVE-2021-4430 | Low | 3.5 | 2023-11-06 | A vulnerability classified as problematic has been found in Ortus Solutions ColdBox Elixir 3.1.6. This affects an unknown part of the file src/defaultConfig.js… |
CVE-2021-39810 | High | 7.8 | 2023-10-30 | In verifyDefaults of CardEmulationManager.java, there is a possible way to set a third party app as the default contactless payment app without user consent du… |
CVE-2021-25736 | Medium | 5.8 | 2023-10-30 | Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (“spec.ports[*].port”) as a LoadBalancer Service whe… |
CVE-2021-33638 | High | 8.4 | 2023-10-29 | When the isula cp command is used to copy files from a container to a host machine and the container is controlled by an attacker, the attacker can escape the… |
CVE-2021-33637 | High | 8.4 | 2023-10-29 | When the isula export command is used to export a container to an image and the container is controlled by an attacker, the attacker can escape the container… |
CVE-2021-33636 | High | 8.4 | 2023-10-29 | When the isula load command is used to load malicious images, attackers can execute arbitrary code. |
CVE-2021-33635 | Critical | 9.8 | 2023-10-29 | When malicious images are pulled by isula pull, attackers can execute arbitrary code. |
CVE-2021-33634 | Medium | 6.3 | 2023-10-29 | iSulad uses the lcr+lxc runtime (default) to run malicious images, which can cause DOS. |
CVE-2021-26738 | High | 7.8 | 2023-10-23 | Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be able to execute code… |
CVE-2021-26737 | Medium | 5.5 | 2023-10-23 | The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients. A local adversary without sufficient privileges may be able to s… |
CVE-2021-26736 | Medium | 6.7 | 2023-10-23 | Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged… |
CVE-2021-26735 | Medium | 6.7 | 2023-10-23 | The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to ex… |
CVE-2021-26734 | Medium | 4.4 | 2023-10-23 | Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation. A local adversary may be a… |
CVE-2021-46898 | Medium | 6.1 | 2023-10-22 | views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consid… |
CVE-2021-46897 | Medium | 6.5 | 2023-10-22 | views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving pr… |
CVE-2021-4418 | Medium | 4.3 | 2023-10-20 | The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is due to missing or in… |
CVE-2021-4334 | High | 8.8 | 2023-10-20 | The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check on the fpd_update_… |
CVE-2021-4353 | Medium | 5.3 | 2023-10-20 | The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and including, 2.4.1. Th… |
CVE-2021-4335 | Medium | 6.3 | 2023-10-20 | The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized access to data and modification of plugin settings due to a missing capability ch… |
CVE-2021-38859 | Medium | 4.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a user to obtain version number information using a specially crafted HTTP request that could be us… |
CVE-2021-29913 | Medium | 6.5 | 2023-10-17 | IBM Security Verify Privilege On-Premise 11.5 could allow an authenticated user to obtain sensitive information or perform unauthorized actions due to imprope… |
CVE-2021-20581 | Medium | 5.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a user to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 19… |
CVE-2021-3784 | Medium | 5.3 | 2023-10-04 | Garuda Linux performs an insecure user creation and authentication that allows any user to impersonate the created account. By creating users from the 'Garuda… |
CVE-2021-38243 | Critical | 9.8 | 2023-09-27 | xunruicms up to v4.5.1 was discovered to contain a remote code execution (RCE) vulnerability in /index.php. This vulnerability allows attackers to execute arbi… |
CVE-2021-26837 | Critical | 9.8 | 2023-09-19 | SQL Injection vulnerability in SearchTextBox parameter in Fortra (Formerly HelpSystems) DeliverNow before version 1.2.18, allows attackers to execute arbitrary… |
CVE-2021-28485 | Medium | 4.3 | 2023-09-14 | In Ericsson Mobile Switching Center Server (MSC-S) before IS 3.1 CP22, the SIS web application allows relative path traversal via a specific parameter in the h… |
CVE-2021-44172 | Medium | 4.3 | 2023-09-13 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClientEMS versions 7.0.0 through 7.0.4, 7.0.6 through 7.0.7, in a… |
CVE-2021-27715 | Critical | 9.8 | 2023-09-08 | An issue was discovered in MoFi Network MOFI4500-4GXeLTE-V2 3.5.6-xnet-5052 allows attackers to bypass the authentication and execute arbitrary code via crafte… |
CVE-2021-45811 | Medium | 6.5 | 2023-09-08 | A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL co… |
CVE-2021-33834 | High | 7.1 | 2023-09-08 | An issue was discovered in iscflashx64.sys 3.9.3.0 in Insyde H2OFFT 6.20.00. When handling IOCTL 0x22229a, the input used to allocate a buffer and copy memory… |
CVE-2021-44195 | Low | 3.3 | 2023-09-07 | Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2021-44194 | Low | 3.3 | 2023-09-07 | Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2021-44193 | Low | 3.3 | 2023-09-07 | Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2021-44192 | Low | 3.3 | 2023-09-07 | Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2021-44191 | Low | 3.3 | 2023-09-07 | Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2021-44190 | Low | 3.3 | 2023-09-07 | Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2021-44189 | Low | 3.3 | 2023-09-07 | Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an Use-After-Free vulnerability that could lead to disclosure of sensi… |
CVE-2021-44188 | High | 7.8 | 2023-09-07 | Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability which could result in a read past… |
CVE-2021-43753 | High | 7.8 | 2023-09-07 | Adobe Lightroom versions 4.4 (and earlier) are affected by a use-after-free vulnerability in the processing of parsing TIF files that could result in privilege… |
CVE-2021-43751 | Low | 3.3 | 2023-09-07 | Adobe Premiere Pro versions 22.0 (and earlier) and 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of se… |
CVE-2021-43027 | High | 7.8 | 2023-09-07 | Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability which could result in a read past… |
CVE-2021-43018 | High | 7.8 | 2023-09-07 | Adobe Photoshop versions 23.0.2 and 22.5.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in… |
CVE-2021-42734 | Medium | 5.5 | 2023-09-07 | Adobe Photoshop version 22.5.1 and earlier versions are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. A… |
CVE-2021-42265 | Medium | 5.5 | 2023-09-07 | Adobe Premiere Pro versions 22.0 (and earlier) and 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of se… |
CVE-2021-40795 | High | 7.8 | 2023-09-07 | Adobe Premiere Pro versions 22.0 (and earlier) and 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability which could result in a read past t… |
CVE-2021-40791 | Medium | 5.5 | 2023-09-07 | Adobe Premiere Pro versions 22.0 (and earlier) and 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of se… |
CVE-2021-40790 | Medium | 5.5 | 2023-09-07 | Adobe Premiere Pro versions 22.0 (and earlier) and 15.4.2 (and earlier) are affected by an Use-After-Free vulnerability that could lead to disclosure of sensit… |
CVE-2021-40723 | Medium | 5.5 | 2023-09-07 | Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an out-of-bound… |
CVE-2021-40699 | High | 7.4 | 2023-09-07 | ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability when checking permis… |
CVE-2021-40698 | High | 7.4 | 2023-09-07 | ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an Use of Inherently Dangerous Function vulnerability that ca… |
CVE-2021-36646 | Medium | 6.1 | 2023-09-06 | A Cross Site Scrtpting (XSS) vulnerability in KodExplorer 4.45 allows remote attackers to run arbitrary code via /index.php page. |
CVE-2021-39859 | Medium | 5.5 | 2023-09-06 | Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Use After Free vulnera… |
CVE-2021-36060 | Medium | 5.5 | 2023-09-06 | Adobe Media Encoder version 15.2 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacke… |
CVE-2021-36036 | High | 7.2 | 2023-09-06 | Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's… |
CVE-2021-36023 | Critical | 9.1 | 2023-09-06 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Upd… |
CVE-2021-36021 | High | 7.2 | 2023-09-06 | Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS… |
CVE-2021-35980 | High | 7.8 | 2023-09-06 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Path traversal vulnera… |