2021 CVEs (page 15)
Page 15 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-28644 | High | 7.8 | 2023-09-06 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Path traversal vulnera… |
CVE-2021-21088 | High | 7.8 | 2023-09-06 | Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Use After Fre… |
CVE-2021-40546 | Medium | 4.9 | 2023-09-05 | Tenda AC6 US_AC6V4.0RTL_V02.03.01.26_cn.bin allows attackers (who have the administrator password) to cause a denial of service (device crash) via a long strin… |
CVE-2021-3262 | Critical | 9.8 | 2023-08-29 | TripSpark VEO Transportation-2.2.x-XP_BB-20201123-184084 NovusEDU-2.2.x-XP_BB-20201123-184084 allows unsafe data inputs in POST body parameters from end users… |
CVE-2021-32050 | Medium | 4.2 | 2023-08-29 | Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published ev… |
CVE-2021-27932 | High | 7.8 | 2023-08-25 | Stormshield Network Security (SNS) VPN SSL Client 2.1.0 through 2.8.0 has Insecure Permissions. |
CVE-2021-46312 | Medium | 6.5 | 2023-08-22 | An issue was discovered IW44EncodeCodec.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero. |
CVE-2021-46310 | Medium | 6.5 | 2023-08-22 | An issue was discovered IW44Image.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero. |
CVE-2021-46179 | Medium | 6.5 | 2023-08-22 | Reachable Assertion vulnerability in upx before 4.0.0 allows attackers to cause a denial of service via crafted file passed to the the readx function. |
CVE-2021-46174 | High | 7.5 | 2023-08-22 | Heap-based Buffer Overflow in function bfd_getl32 in Binutils objdump 3.37. |
CVE-2021-43171 | Medium | 6.5 | 2023-08-22 | Improper verification of applications' cryptographic signatures in the /e/OS app store client App Lounge before 0.19q allows attackers in control of the applic… |
CVE-2021-40266 | Medium | 6.5 | 2023-08-22 | FreeImage before 1.18.0, ReadPalette function in PluginTIFF.cpp is vulnerabile to null pointer dereference. |
CVE-2021-40265 | High | 8.8 | 2023-08-22 | A heap overflow bug exists FreeImage before 1.18.0 via ofLoad function in PluginJPEG.cpp. |
CVE-2021-40264 | Medium | 6.5 | 2023-08-22 | NULL pointer dereference vulnerability in FreeImage before 1.18.0 via the FreeImage_CloneTag function inFreeImageTag.cpp. |
CVE-2021-40263 | High | 8.8 | 2023-08-22 | A heap overflow vulnerability in FreeImage 1.18.0 via the ofLoad function in PluginTIFF.cpp. |
CVE-2021-40262 | Medium | 6.5 | 2023-08-22 | A stack exhaustion issue was discovered in FreeImage before 1.18.0 via the Validate function in PluginRAW.cpp. |
CVE-2021-40211 | High | 7.5 | 2023-08-22 | An issue was discovered with ImageMagick 7.1.0-4 via Division by zero in function ReadEnhMetaFile of coders/emf.c. |
CVE-2021-35309 | High | 7.5 | 2023-08-22 | An issue discovered in Samsung SyncThru Web Service SPL 5.93 06-09-2014 allows attackers to gain escalated privileges via MITM attacks. |
CVE-2021-34193 | High | 7.5 | 2023-08-22 | Stack overflow vulnerability in OpenSC smart card middleware before 0.23 via crafted responses to APDUs. |
CVE-2021-33390 | Critical | 9.8 | 2023-08-22 | dpic 2021.04.10 has a use-after-free in thedeletestringbox() function in dpic.y. A different vulnerablility than CVE-2021-32421. |
CVE-2021-33388 | Critical | 9.8 | 2023-08-22 | dpic 2021.04.10 has a Heap Buffer Overflow in themakevar() function in dpic.y |
CVE-2021-32422 | High | 7.5 | 2023-08-22 | dpic 2021.01.01 has a Global buffer overflow in theyylex() function in main.c and reads out of the bound array. |
CVE-2021-32421 | High | 7.5 | 2023-08-22 | dpic 2021.01.01 has a Heap Use-After-Free in thedeletestringbox() function in dpic.y. |
CVE-2021-32420 | High | 7.5 | 2023-08-22 | dpic 2021.01.01 has a Heap-based Buffer Overflow in thestorestring function in dpic.y. |
CVE-2021-32292 | Critical | 9.8 | 2023-08-22 | An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample progr… |
CVE-2021-30047 | High | 7.5 | 2023-08-22 | VSFTPD 3.0.3 allows attackers to cause a denial of service due to limited number of connections allowed. |
CVE-2021-29390 | High | 7.1 | 2023-08-22 | libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct.c. |
CVE-2021-46895 | Critical | 9.1 | 2023-08-13 | Vulnerability of defects introduced in the design process in the Multi-Device Task Center. Successful exploitation of this vulnerability will cause the hopped… |
CVE-2021-3236 | Medium | 5.5 | 2023-08-11 | vim 8.2.2348 is affected by null pointer dereference, allows local attackers to cause a denial of service (DoS) via the ex_buffer_all method. |
CVE-2021-29378 | High | 8.8 | 2023-08-11 | SQL Injection in pear-admin-think version 2.1.2, allows attackers to execute arbitrary code and escalate privileges via crafted GET request to Crud.php. |
CVE-2021-29057 | Medium | 6.5 | 2023-08-11 | An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service. |
CVE-2021-28835 | High | 7.8 | 2023-08-11 | Buffer Overflow vulnerability in XNView before 2.50, allows local attackers to execute arbitrary code via crafted GEM bitmap file. |
CVE-2021-28429 | Medium | 5.5 | 2023-08-11 | Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service… |
CVE-2021-28427 | High | 7.8 | 2023-08-11 | Buffer Overflow vulnerability in XNView version 2.49.3, allows local attackers to execute arbitrary code via crafted TIFF file. |
CVE-2021-28411 | Critical | 9.8 | 2023-08-11 | An issue was discovered in getRememberedSerializedIdentity function in CookieRememberMeManager class in lerry903 RuoYi version 3.4.0, allows remote attackers t… |
CVE-2021-28025 | Medium | 5.5 | 2023-08-11 | Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0, 6.0.2, and 6.2, allows local attackers to cause a denial of service (DoS). |
CVE-2021-27524 | Medium | 6.1 | 2023-08-11 | Cross Site Scripting (XSS) vulnerability in margox braft-editor version 2.3.8, allows remote attackers to execute arbitrary code via the embed media feature. |
CVE-2021-27523 | Critical | 9.8 | 2023-08-11 | An issue was discovered in open-falcon dashboard version 0.2.0, allows remote attackers to gain, modify, and delete sensitive information via crafted POST requ… |
CVE-2021-26505 | Critical | 9.8 | 2023-08-11 | Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function. |
CVE-2021-26504 | High | 7.5 | 2023-08-11 | Directory Traversal vulnerability in Foddy node-red-contrib-huemagic version 3.0.0, allows remote attackers to gain sensitive information via crafted request i… |
CVE-2021-25857 | High | 7.2 | 2023-08-11 | An issue was discovered in pcmt superMicro-CMS version 3.11, allows authenticated attackers to execute arbitrary code via the font_type parameter to setup.php. |
CVE-2021-25856 | Medium | 4.9 | 2023-08-11 | An issue was discovered in pcmt superMicro-CMS version 3.11, allows attackers to delete files via crafted image file in images.php. |
CVE-2021-25786 | Medium | 5.3 | 2023-08-11 | An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter i… |
CVE-2021-41544 | High | 7.8 | 2023-08-08 | A vulnerability has been identified in Siemens Software Center (All versions < V3.0). A DLL Hijacking vulnerability could allow a local attacker to execute cod… |
CVE-2021-24916 | High | 7.5 | 2023-08-07 | The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action. |
CVE-2021-31681 | High | 7.8 | 2023-07-31 | Deserialization of Untrusted Data vulnerability in yolo 3 allows attackers to execute arbitrary code via crafted yaml file. |
CVE-2021-31680 | High | 7.8 | 2023-07-31 | Deserialization of Untrusted Data vulnerability in yolo 5 allows attackers to execute arbitrary code via crafted yaml file. |
CVE-2021-31651 | Medium | 4.8 | 2023-07-31 | Cross Site Scripting (XSS) vulnerability in neofarg-cms 0.2.3 allows remoate attacker to run arbitrary code via the copyright field in copyright settings. |
CVE-2021-4324 | Medium | 6.5 | 2023-07-29 | Insufficient policy enforcement in Google Update in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to read arbitrary files via a malicious file… |
CVE-2021-4323 | Medium | 6.5 | 2023-07-29 | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious… |
CVE-2021-4322 | High | 8.8 | 2023-07-29 | Use after free in DevTools in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to execute arbitrar… |
CVE-2021-4321 | Medium | 4.3 | 2023-07-29 | Policy bypass in Blink in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium se… |
CVE-2021-4320 | High | 8.8 | 2023-07-29 | Use after free in Blink in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/wr… |
CVE-2021-4319 | High | 8.8 | 2023-07-29 | Use after free in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium sec… |
CVE-2021-4318 | High | 8.8 | 2023-07-29 | Object corruption in Blink in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (… |
CVE-2021-4317 | High | 8.8 | 2023-07-29 | Use after free in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium sec… |
CVE-2021-4316 | Medium | 4.3 | 2023-07-29 | Inappropriate implementation in Cast UI in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to spoof browser UI via a crafted HTML page. (Chromium… |
CVE-2021-36580 | Medium | 6.1 | 2023-07-27 | Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter. |
CVE-2021-39421 | Medium | 6.1 | 2023-07-24 | A cross-site scripting (XSS) vulnerability in SeedDMS v6.0.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2021-35391 | High | 7.2 | 2023-07-21 | Server Side Request Forgery vulnerability found in Deskpro Support Desk v2021.21.6 allows attackers to execute arbitrary code via a crafted URL. |
CVE-2021-39425 | Medium | 6.1 | 2023-07-20 | SeedDMS v6.0.15 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary web URLs by… |
CVE-2021-45094 | Medium | 5.4 | 2023-07-20 | Imprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108 allows XSS. |
CVE-2021-39822 | High | 7.8 | 2023-07-20 | Adobe InDesign versions 16.3 (and earlier), and 16.3.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code e… |
CVE-2021-38933 | Medium | 5.9 | 2023-07-19 | IBM Sterling Connect:Direct for UNIX 1.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informatio… |
CVE-2021-37522 | Critical | 9.8 | 2023-07-18 | SQL injection vulnerability in HKing2802 Locke-Bot 2.0.2 allows remote attackers to run arbitrary SQL commands via crafted string to /src/db.js, /commands/mute… |
CVE-2021-4428 | Low | 2.7 | 2023-07-18 | A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the f… |
CVE-2021-34123 | Critical | 9.8 | 2023-07-18 | An issue was discovered on atasm, version 1.09. A stack-buffer-overflow vulnerability in function aprintf() in asm.c allows attackers to execute arbitrary code… |
CVE-2021-34121 | High | 7.8 | 2023-07-18 | An Out of Bounds flaw was discovered in htmodoc 1.9.12 in function parse_tree() in toc.cxx, this possibly leads to memory layout information leaking in the dat… |
CVE-2021-34119 | High | 7.8 | 2023-07-18 | A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible code execution and a denial of service vi… |
CVE-2021-33294 | Medium | 5.5 | 2023-07-18 | In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cause a denial of service (infinite loop) v… |
CVE-2021-32256 | Medium | 6.5 | 2023-07-18 | An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle_type in rust-demangle.c. |
CVE-2021-43072 | Medium | 6.7 | 2023-07-18 | A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiAnalyzer version 7.0.2 and below, version 6.4.7 and below, version 6… |
CVE-2021-37384 | Critical | 9.8 | 2023-07-17 | RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to send arbitrary comma… |
CVE-2021-37386 | High | 7.5 | 2023-07-17 | Furukawa Electric LatAm 423-41W/AC before v1.1.4 and LD421-21W before v1.3.3 were discovered to contain an HTML injection vulnerability via the serial number u… |
CVE-2021-31294 | Medium | 5.9 | 2023-07-15 | Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command)… |
CVE-2021-0948 | Medium | 5.5 | 2023-07-13 | The PVRSRVBridgeGetMultiCoreInfo ioctl in the PowerVR kernel driver can return uninitialized kernel memory to user space. The contents of this memory could con… |
CVE-2021-44696 | Low | 3.3 | 2023-07-12 | Adobe Prelude version 22.1.1 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker co… |
CVE-2021-43760 | Low | 3.3 | 2023-07-12 | Adobe Media Encoder versions 22.0, 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory… |
CVE-2021-43759 | Low | 3.3 | 2023-07-12 | Adobe Media Encoder versions 22.0, 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory… |
CVE-2021-43758 | Low | 3.3 | 2023-07-12 | Adobe Media Encoder versions 22.0, 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory… |
CVE-2021-43757 | High | 7.8 | 2023-07-12 | Adobe Media Encoder versions 22.0, 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory… |
CVE-2021-4427 | Medium | 4.3 | 2023-07-12 | The Vuukle Comments, Reactions, Share Bar, Revenue plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.31. T… |
CVE-2021-4426 | Medium | 4.3 | 2023-07-12 | The Absolute Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.8. This is due to missing or incorr… |
CVE-2021-4425 | Medium | 4.3 | 2023-07-12 | The Defender Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.6. This is due to missing or incor… |
CVE-2021-4424 | Medium | 4.3 | 2023-07-12 | The Slider Hero plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.2.0. This is due to missing or incorrect n… |
CVE-2021-4423 | Medium | 4.3 | 2023-07-12 | The RAYS Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.2. This is due to missing or incorrect non… |
CVE-2021-4422 | Medium | 4.3 | 2023-07-12 | The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due to missing or incor… |
CVE-2021-4421 | Medium | 4.3 | 2023-07-12 | The Advanced Popups plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.1. This is due to missing or incorre… |
CVE-2021-4420 | Medium | 4.3 | 2023-07-12 | The Sell Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.5. This is due to missing or incorrect no… |
CVE-2021-4419 | Medium | 4.3 | 2023-07-12 | The WP-Backgrounds Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3. This is due to missing or incor… |
CVE-2021-4417 | Medium | 5.4 | 2023-07-12 | The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and inclu… |
CVE-2021-4416 | Medium | 4.3 | 2023-07-12 | The wp-mpdf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.1. This is due to missing or incorrect nonce… |
CVE-2021-4415 | Medium | 4.3 | 2023-07-12 | The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or inc… |
CVE-2021-4414 | Medium | 4.3 | 2023-07-12 | The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.5. This is due t… |
CVE-2021-4413 | Medium | 4.3 | 2023-07-12 | The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to mi… |
CVE-2021-4412 | Medium | 4.3 | 2023-07-12 | The WP Prayer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5. This is due to missing or incorrect non… |
CVE-2021-4411 | Medium | 4.3 | 2023-07-12 | The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.0. This is due to… |
CVE-2021-4410 | Medium | 4.3 | 2023-07-12 | The Qtranslate Slug plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.18. This is due to missing or incorr… |
CVE-2021-4409 | Medium | 4.3 | 2023-07-12 | The WooCommerce Etsy Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.1. This is due to missi… |
CVE-2021-4408 | Medium | 4.3 | 2023-07-12 | The DW Question & Answer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.8. This is due to missing or in… |