2021 CVEs (page 145)
Page 145 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-34838 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34837 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34836 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34835 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34834 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34833 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34832 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required t… |
CVE-2021-34831 | High | 7.8 | 2021-08-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.4.37651. User interaction is required to ex… |
CVE-2021-32596 | Medium | 6.0 | 2021-08-04 | A use of one-way hash with a predictable salt vulnerability in the password storing mechanism of FortiPortal 6.0.0 through 6.04 may allow an attacker already i… |
CVE-2021-26097 | High | 8.8 | 2021-08-04 | An improper neutralization of special elements used in an OS Command vulnerability in FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through… |
CVE-2021-36168 | Medium | 6.5 | 2021-08-04 | A Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Fortinet FortiPortal 6.x before 6.0.5, FortiPortal 5.3.x before 5.3.6 and a… |
CVE-2021-24018 | Medium | 4.3 | 2021-08-04 | A buffer underwrite vulnerability in the firmware verification routine of FortiOS before 7.0.1 may allow an attacker located in the adjacent network to potenti… |
CVE-2021-24010 | High | 8.1 | 2021-08-04 | Improper limitation of a pathname to a restricted directory vulnerabilities in FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 through 3.1.4 may allow an authentic… |
CVE-2021-3678 | Medium | 5.9 | 2021-08-04 | showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) |
CVE-2021-36765 | High | 7.5 | 2021-08-04 | In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause a null pointer dereference in the downloaded vulnerable EtherNet/IP stack that is… |
CVE-2021-36764 | High | 7.5 | 2021-08-04 | In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a Null pointer dereference in the affecte… |
CVE-2021-35463 | Medium | 6.1 | 2021-08-04 | Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML i… |
CVE-2021-33338 | High | 7.5 | 2021-08-04 | The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, whi… |
CVE-2021-33337 | Medium | 6.1 | 2021-08-04 | Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before f… |
CVE-2021-32594 | Medium | 5.4 | 2021-08-04 | An unrestricted file upload vulnerability in the web interface of FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earl… |
CVE-2021-32590 | Critical | 9.9 | 2021-08-04 | Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 thro… |
CVE-2021-29765 | High | 7.5 | 2021-08-04 | IBM PowerVM Hypervisor FW940 and FW950 could allow an attacker to obtain sensitive information if they gain service access to the FSP. IBM X-Force ID: 202476. |
CVE-2021-26098 | Medium | 5.3 | 2021-08-04 | An instance of small space of random values in the RPC API of FortiSandbox before 4.0.0 may allow an attacker in possession of a few information pieces about t… |
CVE-2021-3680 | Medium | 4.9 | 2021-08-04 | showdoc is vulnerable to Missing Cryptographic Step |
CVE-2021-33339 | Medium | 4.8 | 2021-08-04 | Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote atta… |
CVE-2021-33336 | Medium | 5.4 | 2021-08-04 | Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7… |
CVE-2021-36483 | High | 8.8 | 2021-08-04 | DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization. |
CVE-2021-35397 | High | 7.5 | 2021-08-04 | A path traversal vulnerability in the static router for Drogon from 1.0.0-beta14 to 1.6.0 could allow an unauthenticated, remote attacker to arbitrarily read f… |
CVE-2021-37232 | Critical | 9.8 | 2021-08-04 | A stack overflow vulnerability occurs in Atomicparsley 20210124.204813.840499f through APar_read64() in src/util.cpp due to the lack of buffer size of uint32_b… |
CVE-2021-37231 | Medium | 5.5 | 2021-08-04 | A stack-buffer-overflow occurs in Atomicparsley 20210124.204813.840499f through APar_readX() in src/util.cpp while parsing a crafted mp4 file because of the mi… |
CVE-2021-32813 | Medium | 4.8 | 2021-08-03 | Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.4.13, there exists a potential header vulnerability in Traefik's handling of the Connect… |
CVE-2021-38084 | High | 8.1 | 2021-08-03 | An issue was discovered in the POP3 component of Courier Mail Server before 1.1.5. Meddler-in-the-middle attackers can pipeline commands after the POP3 STLS co… |
CVE-2021-34273 | High | 7.5 | 2021-08-03 | A security flaw in the 'owned' function of a smart contract implementation for BTC2X (B2X), a tradeable Ethereum ERC20 token, allows attackers to hijack victim… |
CVE-2021-34272 | High | 7.5 | 2021-08-03 | A security flaw in the 'owned' function of a smart contract implementation for RobotCoin (RBTC), a tradeable Ethereum ERC20 token, allows attackers to hijack v… |
CVE-2021-34270 | High | 7.5 | 2021-08-03 | An integer overflow in the mintToken function of a smart contract implementation for Doftcoin Token, an Ethereum ERC20 token, allows the owner to cause unexpec… |
CVE-2021-33403 | High | 7.5 | 2021-08-03 | An integer overflow in the transfer function of a smart contract implementation for Lancer Token, an Ethereum ERC20 token, allows the owner to cause unexpected… |
CVE-2021-33335 | High | 7.2 | 2021-08-03 | Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authe… |
CVE-2021-33334 | Medium | 4.3 | 2021-08-03 | The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack… |
CVE-2021-33333 | Medium | 6.3 | 2021-08-03 | The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does… |
CVE-2021-33332 | Medium | 6.1 | 2021-08-03 | Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and… |
CVE-2021-33331 | Medium | 6.1 | 2021-08-03 | Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19 a… |
CVE-2021-30589 | Medium | 4.3 | 2021-08-03 | Insufficient validation of untrusted input in Sharing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to bypass navigation restrictions via a… |
CVE-2021-30588 | High | 8.8 | 2021-08-03 | Type confusion in V8 in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30587 | Medium | 4.3 | 2021-08-03 | Inappropriate implementation in Compositing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially spoof the contents of the Omnibox… |
CVE-2021-30586 | High | 8.8 | 2021-08-03 | Use after free in dialog box handling in Windows in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extens… |
CVE-2021-30585 | High | 8.8 | 2021-08-03 | Use after free in sensor handling in Google Chrome on Windows prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a cra… |
CVE-2021-30584 | Medium | 6.5 | 2021-08-03 | Incorrect security UI in Downloads in Google Chrome on Android prior to 92.0.4515.107 allowed a remote attacker to perform domain spoofing via a crafted HTML p… |
CVE-2021-30583 | Medium | 6.5 | 2021-08-03 | Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via… |
CVE-2021-30582 | Medium | 6.5 | 2021-08-03 | Inappropriate implementation in Animation in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2021-30581 | High | 8.8 | 2021-08-03 | Use after free in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to potentially exp… |
CVE-2021-30580 | Medium | 6.5 | 2021-08-03 | Insufficient policy enforcement in Android intents in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious appl… |
CVE-2021-30579 | High | 8.8 | 2021-08-03 | Use after free in UI framework in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30578 | High | 8.8 | 2021-08-03 | Uninitialized use in Media in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. |
CVE-2021-30577 | High | 7.8 | 2021-08-03 | Insufficient policy enforcement in Installer in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform local privilege escalation via a craf… |
CVE-2021-30576 | High | 8.8 | 2021-08-03 | Use after free in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to potentially exp… |
CVE-2021-30575 | High | 8.8 | 2021-08-03 | Out of bounds write in Autofill in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to potentially explo… |
CVE-2021-30574 | High | 8.8 | 2021-08-03 | Use after free in protocol handling in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2021-30573 | High | 8.8 | 2021-08-03 | Use after free in GPU in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30572 | High | 8.8 | 2021-08-03 | Use after free in Autofill in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30571 | Critical | 9.6 | 2021-08-03 | Insufficient policy enforcement in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2021-30569 | High | 8.8 | 2021-08-03 | Use after free in sqlite in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30568 | High | 8.8 | 2021-08-03 | Heap buffer overflow in WebGL in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30567 | High | 8.8 | 2021-08-03 | Use after free in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to open DevTools to potentially exploit heap corrup… |
CVE-2021-30566 | High | 8.8 | 2021-08-03 | Stack buffer overflow in Printing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to potentially exp… |
CVE-2021-30565 | High | 8.8 | 2021-08-03 | Out of bounds write in Tab Groups in Google Chrome on Linux and ChromeOS prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious… |
CVE-2021-36703 | Medium | 6.1 | 2021-08-03 | The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows rem… |
CVE-2021-36702 | Medium | 6.1 | 2021-08-03 | The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerabilit… |
CVE-2021-36701 | Critical | 9.1 | 2021-08-03 | In htmly version 2.8.1, is vulnerable to an Arbitrary File Deletion on the local host when delete backup files. The vulnerability may allow a remote attacker t… |
CVE-2021-36543 | Medium | 4.3 | 2021-08-03 | Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <6.0.16 allows a remote attacker to unloc… |
CVE-2021-36542 | Medium | 4.3 | 2021-08-03 | Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0.16 allows a remote attacker to lock any… |
CVE-2021-35343 | Medium | 4.3 | 2021-08-03 | Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allows a remote attacker to edit document nam… |
CVE-2021-33330 | Medium | 4.3 | 2021-08-03 | Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the use… |
CVE-2021-33328 | Medium | 5.4 | 2021-08-03 | Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack… |
CVE-2021-33327 | Medium | 4.3 | 2021-08-03 | The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8… |
CVE-2021-33326 | Medium | 6.1 | 2021-08-03 | Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix… |
CVE-2021-33325 | Medium | 4.9 | 2021-08-03 | The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user… |
CVE-2021-33324 | Medium | 4.3 | 2021-08-03 | The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission… |
CVE-2021-33323 | High | 7.5 | 2021-08-03 | The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values… |
CVE-2021-33322 | High | 7.5 | 2021-08-03 | In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not i… |
CVE-2021-33321 | High | 7.5 | 2021-08-03 | Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via t… |
CVE-2021-33320 | Medium | 4.3 | 2021-08-03 | The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5, does not limit… |
CVE-2021-32804 | High | 8.2 | 2021-08-03 | The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient… |
CVE-2021-32803 | High | 8.2 | 2021-08-03 | The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient sy… |
CVE-2021-30564 | High | 8.8 | 2021-08-03 | Heap buffer overflow in WebXR in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30563 | High | 8.8 | 2021-08-03 | Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30562 | High | 8.8 | 2021-08-03 | Use after free in WebSerial in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30561 | High | 8.8 | 2021-08-03 | Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30560 | High | 8.8 | 2021-08-03 | Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30559 | High | 8.8 | 2021-08-03 | Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30541 | High | 8.8 | 2021-08-03 | Use after free in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-36654 | Medium | 5.4 | 2021-08-03 | CMSuno 1.7 is vulnerable to an authenticated stored cross site scripting in modifying the filename parameter (tgo) while updating the theme. |
CVE-2021-36623 | Critical | 9.8 | 2021-08-03 | Arbitrary File Upload in Sourcecodester Phone Shop Sales Management System 1.0 enables RCE. |
CVE-2021-36622 | Critical | 9.8 | 2021-08-03 | Sourcecodester Online Covid Vaccination Scheduler System 1.0 is affected vulnerable to Arbitrary File Upload. The admin panel has an upload function of profile… |
CVE-2021-32018 | High | 8.5 | 2021-08-03 | An issue was discovered in JUMP AMS 3.6.0.04.009-2487. The JUMP SOAP API was vulnerable to arbitrary file reading due to an improper limitation of file loading… |
CVE-2021-32016 | Critical | 9.9 | 2021-08-03 | An issue was discovered in JUMP AMS 3.6.0.04.009-2487. A JUMP SOAP endpoint permitted the writing of arbitrary files to a user-controlled location on the remot… |
CVE-2021-27942 | Medium | 6.8 | 2021-08-03 | Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs allow a threat actor to execute arbitrary code from a USB drive via the Smart Cast functionality, bec… |
CVE-2021-22425 | High | 7.8 | 2021-08-03 | A component of the HarmonyOS has a Double Free vulnerability. Local attackers may exploit this vulnerability to cause Root Elevating Privileges. |
CVE-2021-22424 | Medium | 5.5 | 2021-08-03 | A component of the HarmonyOS has a Kernel Memory Leakage Vulnerability. Local attackers may exploit this vulnerability to cause Kernel Denial of Service. |
CVE-2021-22423 | High | 7.8 | 2021-08-03 | A component of the HarmonyOS has a Out-of-bounds Write Vulnerability. Local attackers may exploit this vulnerability to cause integer overflow. |
CVE-2021-22422 | High | 7.8 | 2021-08-03 | A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. Local attackers may exploit this vulnerability to cause memory overwriting. |