2021 CVEs (page 149)
Page 149 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-37467 | Medium | 5.4 | 2021-07-25 | In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected). |
CVE-2021-37466 | Medium | 5.4 | 2021-07-25 | In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected). |
CVE-2021-37465 | Medium | 5.4 | 2021-07-25 | In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected). |
CVE-2021-37464 | Medium | 5.4 | 2021-07-25 | In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored). |
CVE-2021-37463 | Medium | 5.4 | 2021-07-25 | In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored). |
CVE-2021-37462 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected). |
CVE-2021-37461 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected). |
CVE-2021-37460 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected). |
CVE-2021-37459 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored). |
CVE-2021-37458 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored). |
CVE-2021-37457 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored). |
CVE-2021-37456 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored). |
CVE-2021-37455 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored). |
CVE-2021-37454 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored). |
CVE-2021-37453 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored). |
CVE-2021-37452 | Medium | 5.5 | 2021-07-25 | NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading the local .dat configuration files. |
CVE-2021-37451 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected). |
CVE-2021-37450 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected). |
CVE-2021-3663 | High | 7.5 | 2021-07-25 | firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts |
CVE-2021-23413 | Medium | 5.3 | 2021-07-25 | This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a… |
CVE-2021-37436 | Medium | 4.2 | 2021-07-24 | Amazon Echo Dot devices through 2021-07-02 sometimes allow attackers, who have physical access to a device after a factory reset, to obtain sensitive informati… |
CVE-2021-32783 | High | 8.5 | 2021-07-23 | Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to acc… |
CVE-2021-32686 | Medium | 5.9 | 2021-07-23 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN… |
CVE-2021-3169 | Critical | 9.8 | 2021-07-23 | An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to create a connection token through an API which does not have access control… |
CVE-2021-25809 | Medium | 5.3 | 2021-07-23 | UCMS 1.5.0 was discovered to contain a physical path leakage via an error message returned by the adminchannelscache() function in top.php. |
CVE-2021-25808 | High | 7.8 | 2021-07-23 | A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file. |
CVE-2021-25791 | Medium | 5.4 | 2021-07-23 | Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment System 1.0 allows authenticated attacker… |
CVE-2021-25790 | Medium | 5.4 | 2021-07-23 | Multiple stored cross site scripting (XSS) vulnerabilities in the "Register" module of House Rental and Property Listing 1.0 allows authenticated attackers to… |
CVE-2021-23412 | High | 8.1 | 2021-07-23 | All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be exec… |
CVE-2021-3159 | Medium | 5.4 | 2021-07-23 | A stored cross site scripting (XSS) vulnerability in the /sys/attachment/uploaderServlet component of Landray EKP V12.0.9.R.20160325 allows attackers to execut… |
CVE-2021-25208 | Critical | 9.8 | 2021-07-23 | Arbitrary file upload vulnerability in SourceCodester Travel Management System v 1.0 allows attackers to execute arbitrary code via the file upload to updatepa… |
CVE-2021-25206 | Critical | 9.8 | 2021-07-23 | Arbitrary file upload vulnerability in SourceCodester Responsive Ordering System v 1.0 allows attackers to execute arbitrary code via the file upload to Produc… |
CVE-2021-25204 | Medium | 5.4 | 2021-07-23 | Cross-site scripting (XSS) vulnerability in SourceCodester E-Commerce Website v 1.0 allows remote attackers to inject arbitrary web script or HTM via the subje… |
CVE-2021-25203 | Critical | 9.8 | 2021-07-23 | Arbitrary file upload vulnerability in Victor CMS v 1.0 allows attackers to execute arbitrary code via the file upload to \CMSsite-master\admin\includes\admin_… |
CVE-2021-25201 | High | 7.5 | 2021-07-23 | SQL injection vulnerability in Learning Management System v 1.0 allows remote attackers to execute arbitrary SQL statements through the id parameter to obtain… |
CVE-2021-25207 | Critical | 9.8 | 2021-07-23 | Arbitrary file upload vulnerability in SourceCodester E-Commerce Website v 1.0 allows attackers to execute arbitrary code via the file upload to prodViewUpdate… |
CVE-2021-20333 | Medium | 5.3 | 2021-07-23 | Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects… |
CVE-2021-26799 | Medium | 6.1 | 2021-07-23 | Cross Site Scripting (XSS) vulnerability in admin/files/edit in Omeka Classic <=2.7 allows remote attackers to inject arbitrary web script or HTML. |
CVE-2021-24036 | Critical | 9.8 | 2021-07-23 | Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of… |
CVE-2021-32786 | Medium | 4.7 | 2021-07-22 | mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating use… |
CVE-2021-32785 | Medium | 5.3 | 2021-07-22 | mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating use… |
CVE-2021-34268 | Medium | 4.6 | 2021-07-22 | An issue in the USBH_ParseDevDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) via a malformed USB d… |
CVE-2021-34267 | Medium | 4.6 | 2021-07-22 | An in the USBH_MSC_InterfaceInit() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) when the system tries… |
CVE-2021-34262 | Medium | 6.8 | 2021-07-22 | A buffer overflow vulnerability in the USBH_ParseEPDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbi… |
CVE-2021-34261 | Medium | 4.6 | 2021-07-22 | An issue in USBH_ParseCfgDesc() of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service due to the system hanging when trying to… |
CVE-2021-34260 | Medium | 6.8 | 2021-07-22 | A buffer overflow vulnerability in the USBH_ParseInterfaceDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execu… |
CVE-2021-34259 | Medium | 6.8 | 2021-07-22 | A buffer overflow vulnerability in the USBH_ParseCfgDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arb… |
CVE-2021-25213 | Critical | 9.8 | 2021-07-22 | SQL injection vulnerability in SourceCodester Travel Management System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the catid paramet… |
CVE-2021-25211 | Critical | 9.8 | 2021-07-22 | Arbitrary file upload vulnerability in SourceCodester Ordering System v 1.0 allows attackers to execute arbitrary code, via the file upload to ordering\admin\p… |
CVE-2021-25209 | Critical | 9.8 | 2021-07-22 | SQL injection vulnerability in SourceCodester Theme Park Ticketing System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id paramet… |
CVE-2021-25205 | Critical | 9.8 | 2021-07-22 | SQL injection vulnerability in SourceCodester E-Commerce Website V 1.0 allows remote attackers to execute arbitrary SQL statements, via the update parameter to… |
CVE-2021-3540 | Medium | 6.5 | 2021-07-22 | By abusing the 'install rpm info detail' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue… |
CVE-2021-3198 | Medium | 6.5 | 2021-07-22 | By abusing the 'install rpm url' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixe… |
CVE-2021-3619 | Low | 3.5 | 2021-07-22 | Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting (XSS) issue, where an authenticated user could abuse… |
CVE-2021-31581 | High | 7.9 | 2021-07-22 | The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be escaped by abusing the 'Edit MySQL Configuration' command. This command laun… |
CVE-2021-31580 | High | 8.7 | 2021-07-22 | The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be bypassed by switching the OpenSSH channel from `shell` to `exec` and providi… |
CVE-2021-31579 | High | 8.2 | 2021-07-22 | Akkadian Provisioning Manager Engine (PME) ships with a hard-coded credential, akkadianuser:haakkadianpassword. This issue was resolved in Akkadian OVA applian… |
CVE-2021-27332 | Medium | 6.1 | 2021-07-22 | Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HT… |
CVE-2021-26224 | Medium | 6.1 | 2021-07-22 | Cross-site scripting (XSS) vulnerability in SourceCodester Fantastic-Blog-CMS V 1.0 allows remote attackers to inject arbitrary web script or HTML via the sear… |
CVE-2021-26223 | Critical | 9.8 | 2021-07-22 | SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id p… |
CVE-2021-25212 | Critical | 9.8 | 2021-07-22 | SQL injection vulnerability in SourceCodester Alumni Management System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter… |
CVE-2021-25210 | Critical | 9.8 | 2021-07-22 | Arbitrary file upload vulnerability in SourceCodester Alumni Management System v 1.0 allows attackers to execute arbitrary code, via the file upload to manage_… |
CVE-2021-36222 | High | 7.5 | 2021-07-22 | ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attack… |
CVE-2021-35942 | Critical | 9.1 | 2021-07-22 | The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an u… |
CVE-2021-35464 | Critical | 9.8 | 2021-07-22 | ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require… |
CVE-2021-35063 | High | 7.5 | 2021-07-22 | Suricata before 5.0.7 and 6.x before 6.0.3 has a "critical evasion." |
CVE-2021-33032 | Critical | 10.0 | 2021-07-22 | A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up… |
CVE-2021-26226 | Critical | 9.8 | 2021-07-22 | SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id p… |
CVE-2021-25202 | Critical | 9.8 | 2021-07-22 | SQL injection vulnerability in SourceCodester Sales and Inventory System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id paramete… |
CVE-2021-25197 | Medium | 6.1 | 2021-07-22 | Cross-site scripting (XSS) vulnerability in SourceCodester Content Management System v 1.0 allows remote attackers to inject arbitrary web script or HTML via t… |
CVE-2021-37403 | Medium | 6.1 | 2021-07-22 | OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and an Ap… |
CVE-2021-37402 | Medium | 6.1 | 2021-07-22 | OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval endpoint has been e… |
CVE-2021-33478 | Medium | 6.8 | 2021-07-22 | The TrustZone implementation in certain Broadcom MediaxChange firmware could allow an unauthenticated, physically proximate attacker to achieve arbitrary code… |
CVE-2021-29657 | High | 7.4 | 2021-07-22 | arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when ther… |
CVE-2021-26699 | Medium | 5.4 | 2021-07-22 | OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the… |
CVE-2021-26698 | Medium | 6.1 | 2021-07-22 | OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and the d… |
CVE-2021-26232 | Critical | 9.8 | 2021-07-22 | SQL injection vulnerability in SourceCodester Simple College Website v 1.0 allows remote attackers to execute arbitrary SQL statements via the id parameter to… |
CVE-2021-26231 | Critical | 9.8 | 2021-07-22 | SQL injection vulnerability in SourceCodester Fantastic Blog CMS v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to cat… |
CVE-2021-26230 | Medium | 6.1 | 2021-07-22 | Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HT… |
CVE-2021-26229 | Critical | 9.8 | 2021-07-22 | SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id p… |
CVE-2021-26228 | Critical | 9.8 | 2021-07-22 | SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id p… |
CVE-2021-26227 | Medium | 6.1 | 2021-07-22 | Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HT… |
CVE-2021-34700 | Medium | 5.5 | 2021-07-22 | A vulnerability in the CLI interface of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to read arbitrary files on the underlying fi… |
CVE-2021-26765 | Critical | 9.8 | 2021-07-22 | SQL injection vulnerability in PHPGurukul Student Record System 4.0 allows remote attackers to execute arbitrary SQL statements, via the sid parameter to edit-… |
CVE-2021-26764 | High | 8.8 | 2021-07-22 | SQL injection vulnerability in PHPGurukul Student Record System v 4.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edit… |
CVE-2021-26762 | High | 8.8 | 2021-07-22 | SQL injection vulnerability in PHPGurukul Student Record System 4.0 allows remote attackers to execute arbitrary SQL statements, via the cid parameter to edit-… |
CVE-2021-1618 | Medium | 6.5 | 2021-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to conduct a… |
CVE-2021-1617 | Medium | 6.5 | 2021-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to conduct a… |
CVE-2021-1614 | Medium | 5.3 | 2021-07-22 | A vulnerability in the Multiprotocol Label Switching (MPLS) packet handling function of Cisco SD-WAN Software could allow an unauthenticated, remote attacker t… |
CVE-2021-1601 | High | 8.3 | 2021-07-22 | Multiple vulnerabilities in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access sensitive internal services from an… |
CVE-2021-1600 | High | 8.3 | 2021-07-22 | Multiple vulnerabilities in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access sensitive internal services from an… |
CVE-2021-1599 | Medium | 5.4 | 2021-07-22 | A vulnerability in the web-based management interface of Cisco Unified Customer Voice Portal (CVP) could allow an authenticated, remote attacker to perform a c… |
CVE-2021-1518 | Medium | 6.3 | 2021-07-22 | A vulnerability in the REST API of Cisco Firepower Device Manager (FDM) On-Box Software could allow an authenticated, remote attacker to execute arbitrary code… |
CVE-2021-34431 | Medium | 6.5 | 2021-07-22 | In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted CONNECT message to the broker a memory le… |
CVE-2021-29149 | Medium | 6.2 | 2021-07-22 | A local bypass security restrictions vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 83… |
CVE-2021-29148 | Medium | 6.1 | 2021-07-22 | A local cross-site scripting (XSS) vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320… |
CVE-2021-29143 | High | 7.2 | 2021-07-22 | A remote execution of arbitrary commands vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Arub… |
CVE-2021-22001 | High | 7.5 | 2021-07-22 | In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provi… |
CVE-2021-30110 | High | 7.5 | 2021-07-22 | dttray.exe in Greyware Automation Products Inc Domain Time II before 5.2.b.20210331 allows remote attackers to execute arbitrary code via a URL to a malicious… |
CVE-2021-35522 | Critical | 9.8 | 2021-07-22 | A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before 4.9.4, and MA VP MD device… |