2021 CVEs (page 144)
Page 144 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21870 | High | 8.8 | 2021-08-05 | A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.4.37651. A specially crafted PDF document can trigg… |
CVE-2021-21831 | High | 8.8 | 2021-08-05 | A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.3.37598. A specially crafted PDF document can trigg… |
CVE-2021-21805 | Critical | 9.8 | 2021-08-05 | An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request… |
CVE-2021-21792 | Medium | 5.5 | 2021-08-05 | An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A spec… |
CVE-2021-21791 | Medium | 5.5 | 2021-08-05 | An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A spec… |
CVE-2021-21790 | Medium | 5.5 | 2021-08-05 | An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A spec… |
CVE-2021-21785 | Medium | 5.5 | 2021-08-05 | An information disclosure vulnerability exists in the IOCTL 0x9c40a148 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A specially crafted I/O reque… |
CVE-2021-20592 | High | 7.5 | 2021-08-05 | Missing synchronization vulnerability in GOT2000 series GT27 model communication driver versions 01.19.000 through 01.39.010, GT25 model communication driver v… |
CVE-2021-20116 | Medium | 6.1 | 2021-08-05 | A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.4. The paths provided in the f, d, and dir parameters in tce_select_mediafile.php were… |
CVE-2021-20115 | Medium | 6.1 | 2021-08-05 | A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.3. The paths provided in the f, d, and dir parameters in tce_filemanager.php were not p… |
CVE-2021-1630 | High | 7.5 | 2021-08-05 | XML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect CloudHub, GovCloud, Runtime Fabric, Pivotal Clou… |
CVE-2021-3682 | High | 8.5 | 2021-08-05 | A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a S… |
CVE-2021-3679 | Medium | 5.5 | 2021-08-05 | A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the way user uses trace ring buffer in a spe… |
CVE-2021-37859 | High | 7.1 | 2021-08-05 | Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost. |
CVE-2021-37614 | High | 8.8 | 2021-08-05 | In certain Progress MOVEit Transfer versions before 2021.0.3 (aka 13.0.3), SQL injection in the MOVEit Transfer web application could allow an authenticated re… |
CVE-2021-36584 | Medium | 5.5 | 2021-08-05 | An issue was discovered in GPAC 1.0.1. There is a heap-based buffer overflow in the function gp_rtp_builder_do_tx3g function in ietf/rtp_pck_3gpp.c, as demonst… |
CVE-2021-35307 | Medium | 6.5 | 2021-08-05 | An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the AP4_DescriptorFinder::Test component located in /Core/Ap4Descrip… |
CVE-2021-35306 | Medium | 6.5 | 2021-08-05 | An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the function AP4_StszAtom::WriteFields located in Ap4StszAtom.cpp. I… |
CVE-2021-34631 | High | 8.8 | 2021-08-05 | The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handle_save_style function found in the ~/news-plugin.php file which allows… |
CVE-2021-34371 | Critical | 9.8 | 2021-08-05 | Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An at… |
CVE-2021-33597 | Low | 3.5 | 2021-08-05 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the SAVAPI component used in certain F-Secure products can crash while scanni… |
CVE-2021-33596 | Low | 3.5 | 2021-08-05 | Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit do… |
CVE-2021-32581 | High | 8.1 | 2021-08-05 | Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac, Acronis Agent prior to build 26653, Acronis Cyber Pro… |
CVE-2021-32580 | High | 7.8 | 2021-08-05 | Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to DLL hijacking. |
CVE-2021-32579 | High | 7.8 | 2021-08-05 | Acronis True Image prior to 2021 Update 4 for Windows and Acronis True Image prior to 2021 Update 5 for macOS allowed an unauthenticated attacker (who has a lo… |
CVE-2021-32578 | High | 7.8 | 2021-08-05 | Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 2 of 2). |
CVE-2021-32577 | High | 7.8 | 2021-08-05 | Acronis True Image prior to 2021 Update 5 for Windows allowed local privilege escalation due to insecure folder permissions. |
CVE-2021-32576 | High | 7.8 | 2021-08-05 | Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 1 of 2). |
CVE-2021-29978 | Critical | 9.8 | 2021-08-05 | Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd party security audit. This vulnerability… |
CVE-2021-29977 | High | 8.8 | 2021-08-05 | Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence of memory corruption and we presume that with enough e… |
CVE-2021-29976 | High | 8.8 | 2021-08-05 | Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bugs showed evidence of memory corruption… |
CVE-2021-29975 | Medium | 6.5 | 2021-08-05 | Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or formatting, could be overlaid on top of anoth… |
CVE-2021-29974 | Medium | 4.3 | 2021-08-05 | When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would allow the user to override an error on… |
CVE-2021-29973 | High | 8.8 | 2021-08-05 | Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This was corrected to require user interaction with the pag… |
CVE-2021-29972 | High | 8.8 | 2021-08-05 | A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library. Updating the library resolved the issue, and may have remedia… |
CVE-2021-29971 | Critical | 9.8 | 2021-08-05 | If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host - irrespective of scheme or port - would be granted… |
CVE-2021-29970 | High | 8.8 | 2021-08-05 | A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. *This bug could only be triggered when acces… |
CVE-2021-29969 | Medium | 5.9 | 2021-08-05 | If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS ha… |
CVE-2021-25448 | Medium | 5.3 | 2021-08-05 | Improper access control vulnerability in Smart Touch Call prior to version 1.0.0.5 allows arbitrary webpage loading in webview. |
CVE-2021-25447 | Medium | 5.3 | 2021-08-05 | Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause local file inclusion in webview. |
CVE-2021-25446 | Medium | 5.3 | 2021-08-05 | Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause arbitrary webpage loading in webview. |
CVE-2021-25445 | Medium | 5.3 | 2021-08-05 | Unprotected component vulnerability in Samsung Internet prior to version 14.2 allows untrusted application to access internal files in Samsung Internet. |
CVE-2021-25444 | Medium | 5.5 | 2021-08-05 | An IV reuse vulnerability in keymaster prior to SMR AUG-2021 Release 1 allows decryption of custom keyblob with privileged process. |
CVE-2021-25443 | Medium | 5.3 | 2021-08-05 | A use after free vulnerability in conn_gadget driver prior to SMR AUG-2021 Release 1 allows malicious action by an attacker. |
CVE-2021-23849 | High | 7.5 | 2021-08-05 | A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF -… |
CVE-2021-22241 | High | 8.7 | 2021-08-05 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specific… |
CVE-2021-22240 | Medium | 4.2 | 2021-08-05 | Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled |
CVE-2021-21863 | High | 7.8 | 2021-08-05 | A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5… |
CVE-2021-21739 | Medium | 4.6 | 2021-08-05 | A ZTE's product of the transport network access layer has a security vulnerability. Because the system does not sufficiently verify the data reliability, attac… |
CVE-2021-21738 | Medium | 6.1 | 2021-08-05 | ZTE's big video business platform has two reflective cross-site scripting (XSS) vulnerabilities. Due to insufficient input verification, the attacker could imp… |
CVE-2021-37625 | High | 7.5 | 2021-08-05 | Skytable is an open source NoSQL database. In versions prior to 0.6.4 an incorrect check of return value of the accept function in the run-loop for a TCP socke… |
CVE-2021-38138 | Medium | 5.4 | 2021-08-05 | OneNav beta 0.9.12 allows XSS via the Add Link feature. NOTE: the vendor's position is that there intentionally is not any XSS protection at present, because t… |
CVE-2021-37605 | High | 7.5 | 2021-08-05 | In version 6.5 Microchip MiWi software and all previous versions including legacy products, the stack is validating only two out of four Message Integrity Chec… |
CVE-2021-37604 | High | 7.5 | 2021-08-05 | In version 6.5 of Microchip MiWi software and all previous versions including legacy products, there is a possibility of frame counters being validated/updated… |
CVE-2021-38095 | High | 7.5 | 2021-08-05 | The REST API in Planview Spigit 4.5.3 allows remote unauthenticated attackers to query sensitive user accounts data, as demonstrated by an api/v1/users/1 reque… |
CVE-2021-32603 | High | 8.8 | 2021-08-05 | A server-side request forgery (SSRF) (CWE-918) vulnerability in FortiManager and FortiAnalyser GUI 7.0.0, 6.4.5 and below, 6.2.7 and below, 6.0.11 and below, 5… |
CVE-2021-32598 | Medium | 4.3 | 2021-08-05 | An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability In FortiManager and FortiAnalyzer GUI 7.0.0, 6.4.6 and b… |
CVE-2021-3539 | Medium | 6.3 | 2021-08-04 | EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was… |
CVE-2021-36805 | Medium | 5.2 | 2021-08-04 | Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in the sales invoice processing component of… |
CVE-2021-36804 | Medium | 5.4 | 2021-08-04 | Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a runn… |
CVE-2021-36803 | Medium | 6.3 | 2021-08-04 | Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. Th… |
CVE-2021-36802 | Medium | 6.5 | 2021-08-04 | Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'locale' variable and sending it in an oth… |
CVE-2021-36801 | High | 8.1 | 2021-08-04 | Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies[0]. This issue was fixed in version… |
CVE-2021-36800 | High | 8.7 | 2021-08-04 | Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /{company_id}/sales/invo… |
CVE-2021-31869 | Medium | 6.5 | 2021-08-04 | Pimcore AdminBundle version 6.8.0 and earlier suffers from a SQL injection issue in the specificID variable used by the application. This issue was fixed in ve… |
CVE-2021-31867 | Medium | 6.5 | 2021-08-04 | Pimcore Customer Data Framework version 3.0.0 and earlier suffers from a Boolean-based blind SQL injection issue in the $id parameter of the SegmentAssignmentC… |
CVE-2021-38115 | Medium | 6.5 | 2021-08-04 | read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via… |
CVE-2021-38114 | Medium | 5.5 | 2021-08-04 | libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-2013-0868. |
CVE-2021-38113 | Medium | 5.4 | 2021-08-04 | In addBouquet in js/bqe.js in OpenWebif (aka e2openplugin-OpenWebif) through 1.4.7, inserting JavaScript into the Add Bouquet feature of the Bouquet Editor (i… |
CVE-2021-32465 | High | 8.8 | 2021-08-04 | An incorrect permission preservation vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a remote user to perform an… |
CVE-2021-32464 | High | 7.8 | 2021-08-04 | An incorrect permission assignment privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security Services… |
CVE-2021-24014 | Medium | 5.4 | 2021-08-04 | Multiple instances of improper neutralization of input during web page generation vulnerabilities in FortiSandbox before 4.0.0 may allow an unauthenticated att… |
CVE-2021-22124 | High | 7.5 | 2021-08-04 | An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0… |
CVE-2021-20028 | Critical | 9.8 | 2021-08-04 | Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA… |
CVE-2021-38111 | High | 8.8 | 2021-08-04 | The DEF CON 27 badge allows remote attackers to exploit a buffer overflow by sending an oversized packet via the NFMI (Near Field Magnetic Induction) protocol. |
CVE-2021-34707 | Medium | 6.5 | 2021-08-04 | A vulnerability in the REST API of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to access sensitive data on… |
CVE-2021-32793 | Medium | 5.7 | 2021-08-04 | Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5… |
CVE-2021-32706 | High | 7.6 | 2021-08-04 | Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5… |
CVE-2021-26096 | Medium | 6.4 | 2021-08-04 | Multiple instances of heap-based buffer overflow in the command shell of FortiSandbox before 4.0.0 may allow an authenticated attacker to manipulate memory and… |
CVE-2021-1610 | Critical | 9.8 | 2021-08-04 | Multiple vulnerabilities in the web-based management interface of the Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could… |
CVE-2021-1609 | Critical | 9.8 | 2021-08-04 | Multiple vulnerabilities in the web-based management interface of the Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could… |
CVE-2021-1602 | High | 8.2 | 2021-08-04 | A vulnerability in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticat… |
CVE-2021-1593 | High | 7.3 | 2021-08-04 | A vulnerability in Cisco Packet Tracer for Windows could allow an authenticated, local attacker to perform a DLL injection attack on an affected device. To exp… |
CVE-2021-1572 | High | 7.8 | 2021-08-04 | A vulnerability in ConfD could allow an authenticated, local attacker to execute arbitrary commands at the level of the account under which ConfD is running, w… |
CVE-2021-1522 | Medium | 4.3 | 2021-08-04 | A vulnerability in the change password API of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, remote attacker to alter their own passwor… |
CVE-2021-34853 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34852 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34851 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34850 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34849 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34848 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34847 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34846 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34845 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34844 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34843 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34842 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34841 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34840 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34839 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |