2021 CVEs (page 146)
Page 146 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-22421 | High | 7.8 | 2021-08-03 | A component of the HarmonyOS has a Improper Privilege Management vulnerability. Local attackers may exploit this vulnerability to cause further Elevation of Pr… |
CVE-2021-22420 | High | 7.8 | 2021-08-03 | A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability. Local attackers may exploit this vulnerability to cause t… |
CVE-2021-22419 | Medium | 5.5 | 2021-08-03 | A component of the HarmonyOS has a Insufficient Verification of Data Authenticity vulnerability. Local attackers may exploit this vulnerability to cause persis… |
CVE-2021-22418 | High | 7.8 | 2021-08-03 | A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. Local attackers may exploit this vulnerability to cause memory overwriting. |
CVE-2021-22417 | Medium | 5.5 | 2021-08-03 | A component of the HarmonyOS has a Data Processing Errors vulnerability. Local attackers may exploit this vulnerability to cause Kernel Memory Leakage. |
CVE-2021-22416 | High | 7.8 | 2021-08-03 | A component of the HarmonyOS has a Data Processing Errors vulnerability. Local attackers may exploit this vulnerability to cause Kernel Code Execution. |
CVE-2021-32814 | High | 8.8 | 2021-08-03 | Skytable is a NoSQL database with automated snapshots and TLS. Versions prior to 0.5.1 are vulnerable to a a directory traversal attack enabling remotely conne… |
CVE-2021-32017 | Critical | 9.9 | 2021-08-03 | An issue was discovered in JUMP AMS 3.6.0.04.009-2487. A JUMP SOAP endpoint permitted the listing of the content of the remote file system. This can be used to… |
CVE-2021-37558 | Critical | 9.8 | 2021-08-03 | A SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote unauthenticated attackers to execute arbitr… |
CVE-2021-37557 | High | 8.8 | 2021-08-03 | A SQL injection vulnerability in image generation in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-privileged) attackers… |
CVE-2021-37556 | High | 8.8 | 2021-08-03 | A SQL injection vulnerability in reporting export in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-privileged) attackers… |
CVE-2021-36763 | High | 7.5 | 2021-08-03 | In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties. |
CVE-2021-33486 | High | 7.5 | 2021-08-03 | All versions of the CODESYS V3 Runtime Toolkit for VxWorks from version V3.5.8.0 and before version V3.5.17.10 have Improper Handling of Exceptional Conditions. |
CVE-2021-33485 | Critical | 9.8 | 2021-08-03 | CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow. |
CVE-2021-31504 | High | 7.8 | 2021-08-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.3.84 (package 16.6.3.134)… |
CVE-2021-31503 | High | 7.8 | 2021-08-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.3.84 (package 16.6.3.134)… |
CVE-2021-21581 | Medium | 6.5 | 2021-08-03 | Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerability to ru… |
CVE-2021-21580 | Medium | 4.3 | 2021-08-03 | Dell EMC iDRAC8 versions prior to 2.80.80.80 & Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a Content spoofing / Text injection, where a malicious URL… |
CVE-2021-21579 | Medium | 6.1 | 2021-08-03 | Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redire… |
CVE-2021-21578 | Medium | 6.1 | 2021-08-03 | Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redire… |
CVE-2021-21577 | Medium | 6.1 | 2021-08-03 | Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerabi… |
CVE-2021-21576 | Medium | 6.1 | 2021-08-03 | Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerabi… |
CVE-2021-36157 | Medium | 5.3 | 2021-08-03 | An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to cond… |
CVE-2021-36156 | Medium | 5.3 | 2021-08-03 | An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduc… |
CVE-2021-32772 | High | 8.8 | 2021-08-03 | Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious characters and execute comman… |
CVE-2021-31630 | High | 8.8 | 2021-08-03 | Command Injection in Open PLC Webserver v3 allows remote attackers to execute arbitrary code via the "Hardware Layer Code Box" component on the "/hardware" pag… |
CVE-2021-27954 | High | 8.2 | 2021-08-03 | A heap-based buffer overflow vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HKProcessConfig function of the HomeKit Wireless Access Control… |
CVE-2021-27953 | High | 7.5 | 2021-08-03 | A NULL pointer dereference vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HomeKit Wireless Access Control setup process. A threat actor can… |
CVE-2021-27952 | Critical | 9.8 | 2021-08-03 | Hardcoded default root credentials exist on the ecobee3 lite 4.5.81.200 device. This allows a threat actor to gain access to the password-protected bootloader… |
CVE-2021-36159 | Critical | 9.1 | 2021-08-03 | libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode imp… |
CVE-2021-22400 | Medium | 5.5 | 2021-08-03 | Some Huawei Smartphones has an insufficient input validation vulnerability due to the lack of parameter validation. An attacker may trick a user into installin… |
CVE-2021-37833 | Medium | 6.1 | 2021-08-03 | A reflected cross-site scripting (XSS) vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary executi… |
CVE-2021-37832 | Critical | 9.8 | 2021-08-03 | A SQL injection vulnerability exists in version 3.0.2 of Hotel Druid when SQLite is being used as the application database. A malicious attacker can issue SQL… |
CVE-2021-35265 | Medium | 6.1 | 2021-08-03 | A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitrary web script to a… |
CVE-2021-37916 | Medium | 6.1 | 2021-08-03 | Joplin before 2.0.9 allows XSS via button and form in the note body. |
CVE-2021-37914 | Medium | 6.5 | 2021-08-03 | In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an atta… |
CVE-2021-26085 | Medium | 5.3 | 2021-08-03 | Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability… |
CVE-2021-21565 | Medium | 5.3 | 2021-08-03 | Dell PowerScale OneFS versions 9.1.0.3 and earlier contain a denial of service vulnerability. SmartConnect had an error condition that may be triggered to loop… |
CVE-2021-21563 | Medium | 6.5 | 2021-08-03 | Dell EMC PowerScale OneFS versions 8.1.2-9.1.0.x contain an Improper Check for Unusual or Exceptional Conditions in its auditing component.This can lead to an… |
CVE-2021-21562 | Medium | 4.4 | 2021-08-03 | Dell EMC PowerScale OneFS contains an untrusted search path vulnerability. This vulnerability allows a user with (ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOGIN_CONSOLE)… |
CVE-2021-21553 | High | 7.3 | 2021-08-03 | Dell PowerScale OneFS versions 8.1.0-9.1.0 contain an Incorrect User Management vulnerability.under some specific conditions, this can allow the CompAdmin user… |
CVE-2021-32812 | Medium | 4.6 | 2021-08-02 | Monkshu is an enterprise application server for mobile apps (iOS and Android), responsive HTML 5 apps, and JSON API services. In version 2.90 and earlier, ther… |
CVE-2021-32811 | High | 7.5 | 2021-08-02 | Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affect… |
CVE-2021-32787 | Low | 3.1 | 2021-08-02 | Sourcegraph is a code search and navigation engine. Sourcegraph before version 3.30.0 has two potential information leaks. The site-admin area can be accessed… |
CVE-2021-34637 | High | 8.8 | 2021-08-02 | The Post Index WordPress plugin is vulnerable to Cross-Site Request Forgery via the OptionsPage function found in the ~/php/settings.php file which allows atta… |
CVE-2021-34635 | Medium | 6.1 | 2021-08-02 | The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the ~/admin/partials/settings/poll-maker-sett… |
CVE-2021-34632 | High | 8.8 | 2021-08-02 | The SEO Backlinks WordPress plugin is vulnerable to Cross-Site Request Forgery via the loc_config function found in the ~/seo-backlinks.php file which allows a… |
CVE-2021-34628 | High | 8.8 | 2021-08-02 | The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the ~/includes/Login-form-setting/Lo… |
CVE-2021-32019 | Medium | 6.1 | 2021-08-02 | There is missing input validation of host names displayed in OpenWrt before 19.07.8. The Connection Status page of the luci web-interface allows XSS, which can… |
CVE-2021-29979 | Medium | 6.1 | 2021-08-02 | Hubs Cloud allows users to download shared content, specifically HTML and JS, which could allow javascript execution in the Hub Cloud instance’s primary hostin… |
CVE-2021-27943 | High | 7.5 | 2021-08-02 | The pairing procedure used by the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs and mobile application is vulnerable to a brute-force attack (again… |
CVE-2021-27503 | Medium | 4.8 | 2021-08-02 | Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior to 1.7.5,The applica… |
CVE-2021-27499 | Medium | 5.9 | 2021-08-02 | Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior to 1.7.5,The applica… |
CVE-2021-21866 | High | 7.8 | 2021-08-02 | A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development Syst… |
CVE-2021-21865 | High | 7.8 | 2021-08-02 | A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYS Development System… |
CVE-2021-21864 | High | 7.8 | 2021-08-02 | A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionality of CODESYS GmbH CODESYS Development S… |
CVE-2021-37848 | High | 7.5 | 2021-08-02 | common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison. |
CVE-2021-37847 | High | 7.5 | 2021-08-02 | crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification. |
CVE-2021-35450 | High | 7.2 | 2021-08-02 | A Server Side Template Injection in the Entando Admin Console 6.3.9 and before allows a user with privileges to execute FreeMarker template with command execut… |
CVE-2021-3673 | High | 7.5 | 2021-08-02 | A vulnerability was found in Radare2 in version 5.3.1. Improper input validation when reading a crafted LE binary can lead to resource exhaustion and DoS. |
CVE-2021-37843 | Critical | 9.8 | 2021-08-02 | The resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the username is known (i.e., no other authenti… |
CVE-2021-33198 | High | 7.5 | 2021-08-02 | In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method. |
CVE-2021-33197 | Medium | 5.3 | 2021-08-02 | In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to… |
CVE-2021-33196 | High | 7.5 | 2021-08-02 | In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic. |
CVE-2021-33195 | High | 7.3 | 2021-08-02 | Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an… |
CVE-2021-32810 | Critical | 9.8 | 2021-08-02 | crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of… |
CVE-2021-32806 | Medium | 6.5 | 2021-08-02 | Products.isurlinportal is a replacement for isURLInPortal method in Plone. Versions of Products.isurlinportal prior to 1.2.0 have an Open Redirect vulnerabilit… |
CVE-2021-22447 | High | 7.5 | 2021-08-02 | There is an Improper Check for Unusual or Exceptional Conditions Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the… |
CVE-2021-22446 | High | 7.5 | 2021-08-02 | There is an Information Disclosure Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reset. |
CVE-2021-22445 | High | 7.5 | 2021-08-02 | There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reset. |
CVE-2021-29697 | Medium | 4.9 | 2021-08-02 | IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to obtain sensitive info… |
CVE-2021-29696 | High | 7.2 | 2021-08-02 | IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to execute arbitrary com… |
CVE-2021-22444 | Critical | 9.8 | 2021-08-02 | There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause code injection. |
CVE-2021-22443 | High | 7.5 | 2021-08-02 | There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause random address access. |
CVE-2021-22442 | High | 7.5 | 2021-08-02 | There is an Improper Validation of Integrity Check Value Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system… |
CVE-2021-22438 | Critical | 9.8 | 2021-08-02 | There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause malicious code to… |
CVE-2021-22435 | Critical | 9.1 | 2021-08-02 | There is a Configuration Defect Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service integrity and availability. |
CVE-2021-22428 | High | 8.1 | 2021-08-02 | There is an Incomplete Cleanup Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to authentication bypass. |
CVE-2021-22427 | High | 8.1 | 2021-08-02 | There is a Heap-based Buffer Overflow Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to authentication bypass. |
CVE-2021-22415 | High | 7.5 | 2021-08-02 | There is an Incorrect Calculation of Buffer Size Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause kernel exceptions w… |
CVE-2021-22414 | High | 7.5 | 2021-08-02 | There is a Memory Buffer Errors Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reset. |
CVE-2021-22413 | High | 7.5 | 2021-08-02 | There is an Integer Overflow Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reset. |
CVE-2021-22412 | High | 7.5 | 2021-08-02 | There is an Integer Overflow Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause random kernel address access. |
CVE-2021-22398 | Medium | 4.6 | 2021-08-02 | There is a logic error vulnerability in several smartphones. The software does not properly restrict certain operation when the Digital Balance function is on… |
CVE-2021-22397 | Medium | 6.7 | 2021-08-02 | There is a privilege escalation vulnerability in Huawei ManageOne 8.0.0. External parameters of some files are lack of verification when they are be called. At… |
CVE-2021-22396 | High | 7.8 | 2021-08-02 | There is a privilege escalation vulnerability in some Huawei products. Due to improper privilege management, a local attacker with common privilege may access… |
CVE-2021-22392 | High | 7.5 | 2021-08-02 | There is an Incorrect Calculation of Buffer Size in Huawei Smartphone.Successful exploitation of this vulnerability may cause verification bypass and direction… |
CVE-2021-22391 | High | 7.5 | 2021-08-02 | There is an Incorrect Calculation of Buffer Size in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reset. |
CVE-2021-22390 | Critical | 9.8 | 2021-08-02 | There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause certain codes to b… |
CVE-2021-22389 | Critical | 9.8 | 2021-08-02 | There is a Permission Control Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause certain codes to be executed. |
CVE-2021-22388 | Critical | 9.8 | 2021-08-02 | There is an Integer Overflow Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause certain codes to be executed. |
CVE-2021-22387 | Critical | 9.8 | 2021-08-02 | There is an Improper Control of Dynamically Managing Code Resources Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow… |
CVE-2021-22384 | High | 8.1 | 2021-08-02 | There is an Information Disclosure Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to authentication bypass. |
CVE-2021-22381 | High | 7.5 | 2021-08-02 | There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause an infinite loop in DoS. |
CVE-2021-22379 | High | 7.5 | 2021-08-02 | There is an Integer Underflow (Wrap or Wraparound) Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause DoS of Samgr. |
CVE-2021-20541 | Medium | 5.3 | 2021-08-02 | IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through… |
CVE-2021-20540 | Medium | 5.3 | 2021-08-02 | IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through… |
CVE-2021-20539 | Medium | 5.3 | 2021-08-02 | IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through… |
CVE-2021-29757 | High | 8.8 | 2021-08-02 | IBM QRadar User Behavior Analytics 4.1.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized action… |
CVE-2021-22552 | Medium | 5.3 | 2021-08-02 | An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall number in MessageReader that is then used b… |