2021 CVEs (page 142)
Page 142 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-28838 | High | 7.5 | 2021-08-10 | Null pointer dereference vulnerability in D-Link DAP-2310 2,10RC039, DAP-2330 1.10RC036 BETA, DAP-2360 2.10RC055, DAP-2553 3.10rc039 BETA, DAP-2660 1.15rc131b… |
CVE-2021-3692 | Medium | 5.3 | 2021-08-10 | yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator |
CVE-2021-37367 | High | 7.8 | 2021-08-10 | CTparental before 4.45.07 is affected by a code execution vulnerability in the CTparental admin panel. Because The file "bl_categories_help.php" is vulnerable… |
CVE-2021-37366 | High | 8.8 | 2021-08-10 | CTparental before 4.45.03 is vulnerable to cross-site request forgery (CSRF) in the CTparental admin panel. By combining CSRF with XSS, an attacker can trick t… |
CVE-2021-37365 | Medium | 6.1 | 2021-08-10 | CTparental before 4.45.03 is vulnerable to cross-site scripting (XSS) in the CTparental admin panel. In bl_categires_help.php, the 'categories' variable is ass… |
CVE-2021-32768 | Medium | 6.1 | 2021-08-10 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode… |
CVE-2021-38373 | Medium | 5.3 | 2021-08-10 | In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked. |
CVE-2021-38372 | Low | 3.7 | 2021-08-10 | In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS. |
CVE-2021-38371 | High | 7.5 | 2021-08-10 | The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending. |
CVE-2021-38370 | Medium | 5.9 | 2021-08-10 | In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS. |
CVE-2021-36601 | Medium | 6.1 | 2021-08-10 | GetSimpleCMS 3.3.16 contains a cross-site Scripting (XSS) vulnerability, where Function TSL does not filter check settings.php Website URL: "siteURL" parameter. |
CVE-2021-33707 | Medium | 6.1 | 2021-08-10 | SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component… |
CVE-2021-33706 | Medium | 4.3 | 2021-08-10 | Due to improper input validation in InfraBox, logs can be modified by an authenticated user. |
CVE-2021-33703 | Medium | 6.1 | 2021-08-10 | Under certain conditions, NetWeaver Enterprise Portal, versions - 7.30, 7.31, 7.40, 7.50, does not sufficiently encode URL parameters. An attacker can craft a… |
CVE-2021-33702 | Medium | 6.1 | 2021-08-10 | Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode report data. An attack… |
CVE-2021-33699 | Medium | 6.5 | 2021-08-10 | Task Hijacking is a vulnerability that affects the applications running on Android devices due to a misconfiguration in their AndroidManifest.xml with their Ta… |
CVE-2021-32943 | Critical | 9.8 | 2021-08-10 | The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code on the WebAccess/SCADA (Web… |
CVE-2021-22676 | Medium | 6.1 | 2021-08-10 | UserExcelOut.asp within WebAccess/SCADA is vulnerable to cross-site scripting (XSS), which could allow an attacker to send malicious JavaScript code. This coul… |
CVE-2021-38365 | Low | 3.7 | 2021-08-10 | Winner (aka ToneWinner) desktop speakers through 2021-08-09 allow remote attackers to recover speech signals from the power-indicator LED via a telescope and a… |
CVE-2021-37152 | Medium | 5.4 | 2021-08-10 | Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. An authenticated attacker with the ability to add HTML files to a repository co… |
CVE-2021-29739 | Medium | 4.9 | 2021-08-10 | IBM Planning Analytics Local 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. X-Force ID: 19884… |
CVE-2021-22674 | Medium | 6.5 | 2021-08-10 | The affected product is vulnerable to a relative path traversal condition, which may allow an attacker access to unauthorized files and directories on the WebA… |
CVE-2021-22386 | High | 7.0 | 2021-08-10 | A component of the Huawei smartphone has a Double Free vulnerability. Local attackers may exploit this vulnerability to cause Root Elevation of Privileges. |
CVE-2021-22385 | High | 7.8 | 2021-08-10 | A component of the Huawei smartphone has a External Control of System or Configuration Setting vulnerability. Local attackers may exploit this vulnerability to… |
CVE-2021-31655 | Medium | 6.1 | 2021-08-10 | Cross Site Scripting (XSS) vulnerability in TRENDnet TV-IP110WN V1.2.2.64 V1.2.2.65 V1.2.2.68 via the profile parameter. in a GET request in view.cgi. |
CVE-2021-3689 | High | 7.5 | 2021-08-10 | yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator |
CVE-2021-37180 | High | 7.8 | 2021-08-10 | A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). The PSKERNEL.dll library lacks proper validation while parsing user-suppli… |
CVE-2021-37179 | High | 7.8 | 2021-08-10 | A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). The PSKERNEL.dll library in affected application lacks proper validation w… |
CVE-2021-37178 | Medium | 5.5 | 2021-08-10 | A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). An XML external entity injection vulnerability in the underlying XML parse… |
CVE-2021-37172 | High | 7.5 | 2021-08-10 | A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (V4.5.0). Affected devices fail to authenticate against configured pa… |
CVE-2021-33738 | Low | 3.3 | 2021-08-10 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.2), Teamcenter Visualization (All versions < V13.2.0.2). The plmxmlAdapterSE70.dll library… |
CVE-2021-33721 | High | 7.2 | 2021-08-10 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2). The affected application incorrectly neutralizes special elements when creating bat… |
CVE-2021-33717 | Medium | 5.5 | 2021-08-10 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.1), Teamcenter Visualization (All versions < V13.2.0.1). When parsing specially crafted CG… |
CVE-2021-25659 | High | 7.5 | 2021-08-10 | A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions < V6.0 SP9 Update 2). Sending sp… |
CVE-2021-21501 | High | 7.5 | 2021-08-10 | Improper configuration will cause ServiceComb ServiceCenter Directory Traversal problem in ServcieCenter 1.x.x versions and fixed in 2.0.0. |
CVE-2021-38311 | High | 7.5 | 2021-08-09 | In Contiki 3.0, potential nonterminating acknowledgment loops exist in the Telnet service. When the negotiated options are already disabled, servers still resp… |
CVE-2021-38305 | High | 7.8 | 2021-08-09 | 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing… |
CVE-2021-36277 | High | 7.8 | 2021-08-09 | Dell Command | Update, Dell Update, and Alienware Update versions before 4.3 contains an Improper Verification of Cryptographic Signature Vulnerability. A loca… |
CVE-2021-36276 | High | 8.8 | 2021-08-09 | Dell DBUtilDrv2.sys driver (versions 2.5 and 2.6) contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of s… |
CVE-2021-32798 | Critical | 10.0 | 2021-08-09 | The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter N… |
CVE-2021-32797 | High | 7.4 | 2021-08-09 | JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can exec… |
CVE-2021-21596 | Critical | 9.6 | 2021-08-09 | Dell OpenManage Enterprise versions 3.4 through 3.6.1 and Dell OpenManage Enterprise Modular versions 1.20.00 through 1.30.00, contain a remote code execution… |
CVE-2021-21585 | Critical | 9.1 | 2021-08-09 | Dell OpenManage Enterprise versions prior to 3.6.1 contain an OS command injection vulnerability in RACADM and IPMI tools. A remote authenticated malicious use… |
CVE-2021-21584 | High | 7.7 | 2021-08-09 | Dell OpenManage Enterprise version 3.5 and OpenManage Enterprise-Modular version 1.30.00 contain an information disclosure vulnerability. An authenticated low… |
CVE-2021-21564 | Critical | 9.8 | 2021-08-09 | Dell OpenManage Enterprise versions prior to 3.6.1 contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit… |
CVE-2021-37634 | High | 7.4 | 2021-08-09 | Leafkit is a templating language with Swift-inspired syntax. Versions prior to 1.3.0 are susceptible to Cross-site Scripting (XSS) attacks. This affects anyone… |
CVE-2021-37633 | High | 7.4 | 2021-08-09 | Discourse is an open source discussion platform. In versions prior to 2.7.8 rendering of d-popover tooltips can be susceptible to XSS attacks. This vulnerabili… |
CVE-2021-37615 | Medium | 4.7 | 2021-08-09 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A null pointer dereference was found… |
CVE-2021-34335 | Medium | 4.7 | 2021-08-09 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A floating point exception (FPE) due… |
CVE-2021-37622 | Medium | 5.5 | 2021-08-09 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2… |
CVE-2021-37621 | Medium | 5.5 | 2021-08-09 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2… |
CVE-2021-37620 | Medium | 4.7 | 2021-08-09 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in E… |
CVE-2021-37619 | Medium | 4.7 | 2021-08-09 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in E… |
CVE-2021-37618 | Medium | 4.7 | 2021-08-09 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in E… |
CVE-2021-37616 | Medium | 5.5 | 2021-08-09 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A null pointer dereference was found… |
CVE-2021-37623 | Medium | 5.5 | 2021-08-09 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2… |
CVE-2021-34334 | Medium | 5.5 | 2021-08-09 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop is triggered when E… |
CVE-2021-32815 | Medium | 5.5 | 2021-08-09 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The assertion failure is triggered w… |
CVE-2021-25954 | Medium | 4.3 | 2021-08-09 | In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker c… |
CVE-2021-29714 | Medium | 6.5 | 2021-08-09 | IBM Content Navigator 3.0.CD could allow a malicious user to cause a denial of service due to improper input validation. IBM X-Force ID: 200968. |
CVE-2021-21740 | Low | 2.4 | 2021-08-09 | There is an information leak vulnerability in the digital media player (DMS) of ZTE's residential gateway product. The attacker could insert the USB disk with… |
CVE-2021-20349 | Medium | 5.3 | 2021-08-09 | IBM Tivoli Workload Scheduler 9.4 and 9.5 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local attacker could overflow a… |
CVE-2021-33256 | High | 8.8 | 2021-08-09 | A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. Th… |
CVE-2021-37788 | Medium | 5.4 | 2021-08-09 | A vulnerability in the web UI of Gurock TestRail v5.3.0.3603 could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjac… |
CVE-2021-37573 | Medium | 6.1 | 2021-08-09 | A reflected cross-site scripting (XSS) vulnerability in the web server TTiny Java Web Server and Servlet Container (TJWS) <=1.115 allows an adversary to inject… |
CVE-2021-36798 | High | 7.5 | 2021-08-09 | A Denial-of-Service (DoS) vulnerability was discovered in Team Server in HelpSystems Cobalt Strike 4.2 and 4.3. It allows remote attackers to crash the C2 serv… |
CVE-2021-34661 | Medium | 6.1 | 2021-08-09 | The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the `show_logs_section` function found in the ~/includes/admin/logging/clas… |
CVE-2021-34660 | Medium | 6.1 | 2021-08-09 | The WP Fusion Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the startdate parameter found in the ~/includes/admin/logging/class-log… |
CVE-2021-22910 | Critical | 9.8 | 2021-08-09 | A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could result in a NoSQL… |
CVE-2021-38290 | High | 8.1 | 2021-08-09 | A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php. An a… |
CVE-2021-37215 | Medium | 4.3 | 2021-08-09 | The employee management page of Flygo contains an Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote at… |
CVE-2021-37214 | High | 8.8 | 2021-08-09 | The employee management page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attac… |
CVE-2021-37213 | Medium | 4.3 | 2021-08-09 | The check-in record page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers… |
CVE-2021-37212 | Medium | 5.4 | 2021-08-09 | The bulletin function of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers ca… |
CVE-2021-37211 | Medium | 5.4 | 2021-08-09 | The bulletin function of Flygo does not filter special characters while a new announcement is added. Remoter attackers can use the vulnerability with general u… |
CVE-2021-24522 | Medium | 6.1 | 2021-08-09 | The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/regis… |
CVE-2021-24521 | High | 7.2 | 2021-08-09 | The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL state… |
CVE-2021-24520 | High | 8.8 | 2021-08-09 | The Stock in & out WordPress plugin through 1.0.4 lacks proper sanitization before passing variables to an SQL request, making it vulnerable to SQL Injection a… |
CVE-2021-24509 | Medium | 5.4 | 2021-08-09 | The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvc_stats shortcode, allowing users with a role as low as Contributor… |
CVE-2021-24507 | Critical | 9.8 | 2021-08-09 | The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_… |
CVE-2021-24505 | Medium | 5.4 | 2021-08-09 | The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issues. The plugin was vulnerable to an Auth… |
CVE-2021-24502 | Medium | 4.8 | 2021-08-09 | The WP Google Map WordPress plugin before 1.7.7 did not sanitise or escape the Map Title before outputting them in the page, leading to a Stored Cross-Site Scr… |
CVE-2021-24501 | High | 8.1 | 2021-08-09 | The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operat… |
CVE-2021-24500 | High | 8.1 | 2021-08-09 | Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that… |
CVE-2021-24499 | Critical | 9.8 | 2021-08-09 | The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or valid… |
CVE-2021-24495 | Medium | 6.1 | 2021-08-09 | The Marmoset Viewer WordPress plugin before 1.9.3 does not property sanitize, validate or escape the 'id' parameter before outputting back in the page, leading… |
CVE-2021-24467 | Medium | 6.5 | 2021-08-09 | The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update… |
CVE-2021-24304 | Medium | 6.1 | 2021-08-09 | The Newsmag WordPress theme before 5.0 does not sanitise the td_block_id parameter in its td_ajax_block AJAX action, leading to an unauthenticated Reflected Cr… |
CVE-2021-38209 | Low | 3.3 | 2021-08-08 | net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked i… |
CVE-2021-38208 | Medium | 5.5 | 2021-08-08 | net/nfc/llcp_sock.c in the Linux kernel before 5.12.10 allows local unprivileged users to cause a denial of service (NULL pointer dereference and BUG) by makin… |
CVE-2021-38207 | High | 7.5 | 2021-08-08 | drivers/net/ethernet/xilinx/ll_temac_main.c in the Linux kernel before 5.12.13 allows remote attackers to cause a denial of service (buffer overflow and lockup… |
CVE-2021-38206 | Medium | 5.5 | 2021-08-08 | The mac80211 subsystem in the Linux kernel before 5.12.13, when a device supporting only 5 GHz is used, allows attackers to cause a denial of service (NULL poi… |
CVE-2021-38205 | Low | 3.3 | 2021-08-08 | drivers/net/ethernet/xilinx/xilinx_emaclite.c in the Linux kernel before 5.13.3 makes it easier for attackers to defeat an ASLR protection mechanism because it… |
CVE-2021-38204 | Medium | 6.8 | 2021-08-08 | drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to cause a denial of service (use-after-free and panic)… |
CVE-2021-38203 | Medium | 5.5 | 2021-08-08 | btrfs in the Linux kernel before 5.13.4 allows attackers to cause a denial of service (deadlock) via processes that trigger allocation of new system chunks dur… |
CVE-2021-38202 | High | 7.5 | 2021-08-08 | fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traff… |
CVE-2021-38201 | High | 7.5 | 2021-08-08 | net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service (xdr_set_page_base slab-out-of-bounds access) by perfor… |
CVE-2021-38200 | Medium | 5.5 | 2021-08-08 | arch/powerpc/perf/core-book3s.c in the Linux kernel before 5.12.13, on systems with perf_event_paranoid=-1 and no specific PMU driver support registered, allow… |
CVE-2021-38199 | Medium | 6.5 | 2021-08-08 | fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which allows operators of remote NFSv4 servers to cause a denial… |
CVE-2021-38198 | Medium | 5.5 | 2021-08-08 | arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access permissions of a shadow page, leading to a missing guest prot… |