2021 CVEs (page 152)
Page 152 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-36230 | High | 8.8 | 2021-07-20 | HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API requests executed using the run token… |
CVE-2021-33910 | Medium | 5.5 | 2021-07-20 | basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a… |
CVE-2021-33909 | High | 7.8 | 2021-07-20 | fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-o… |
CVE-2021-32763 | Medium | 4.3 | 2021-07-20 | OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the `MessagesController` class of OpenProject has a `quote` met… |
CVE-2021-20478 | Low | 3.3 | 2021-07-20 | IBM Cloud Pak System 2.3 could allow a local user in some situations to view the artifacts of another user in self service console. IBM X-Force ID: 197497. |
CVE-2021-32767 | Medium | 5.3 | 2021-07-20 | TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user cred… |
CVE-2021-32669 | Medium | 6.4 | 2021-07-20 | TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-… |
CVE-2021-3246 | High | 8.8 | 2021-07-20 | A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to execute arbitrary code via a crafted WAV file. |
CVE-2021-32668 | Medium | 6.4 | 2021-07-20 | TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-… |
CVE-2021-32667 | Medium | 6.4 | 2021-07-20 | TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-… |
CVE-2021-27517 | Medium | 6.1 | 2021-07-20 | Foxit PDF SDK For Web through 7.5.0 allows XSS. There is arbitrary JavaScript code execution in the browser if a victim uploads a malicious PDF document contai… |
CVE-2021-27338 | Medium | 5.4 | 2021-07-20 | Faraday Edge before 3.7 allows XSS via the network/create/ page and its network name parameter. |
CVE-2021-22235 | High | 7.5 | 2021-07-20 | Crash in DNP dissector in Wireshark 3.4.0 to 3.4.6 and 3.2.0 to 3.2.14 allows denial of service via packet injection or crafted capture file |
CVE-2021-32463 | High | 7.8 | 2021-07-20 | An incorrect permission assignment denial-of-service vulnerability in Trend Micro Apex One, Apex One as a Service (SaaS), Worry-Free Business Security 10.0 SP1… |
CVE-2021-27021 | High | 8.8 | 2021-07-20 | A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query. |
CVE-2021-26095 | High | 7.5 | 2021-07-20 | The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption co… |
CVE-2021-24022 | Medium | 6.7 | 2021-07-20 | A buffer overflow vulnerability in FortiAnalyzer CLI 6.4.5 and below, 6.2.7 and below, 6.0.x and FortiManager CLI 6.4.5 and below, 6.2.7 and below, 6.0.x may a… |
CVE-2021-22125 | Medium | 6.3 | 2021-07-20 | An instance of improper neutralization of special elements in the sniffer module of FortiSandbox before 3.2.2 may allow an authenticated administrator to execu… |
CVE-2021-36980 | Medium | 5.5 | 2021-07-20 | Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_decode) during the d… |
CVE-2021-36979 | Medium | 5.5 | 2021-07-20 | Unicorn Engine 1.0.2 has an out-of-bounds write in tb_flush_armeb (called from cpu_arm_exec_armeb and tcg_cpu_exec_armeb). |
CVE-2021-36978 | Medium | 5.5 | 2021-07-20 | QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::fini… |
CVE-2021-36977 | Medium | 6.5 | 2021-07-20 | matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry), related to use… |
CVE-2021-36976 | Medium | 6.5 | 2021-07-20 | libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block). |
CVE-2021-35054 | High | 7.5 | 2021-07-20 | Minecraft before 1.17.1, when online-mode=false is configured, allows path traversal for deletion of arbitrary JSON files. |
CVE-2021-26083 | Medium | 5.4 | 2021-07-20 | Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1… |
CVE-2021-26082 | Medium | 5.4 | 2021-07-20 | The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 all… |
CVE-2021-26081 | Medium | 5.3 | 2021-07-20 | REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows re… |
CVE-2021-32774 | Medium | 6.1 | 2021-07-20 | DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no protection against CS… |
CVE-2021-32773 | Medium | 6.1 | 2021-07-20 | Racket is a general-purpose programming language and an ecosystem for language-oriented programming. In versions prior to 8.2, code evaluated using the Racket… |
CVE-2021-3135 | Medium | 6.1 | 2021-07-19 | An issue was discovered in the tagDiv Newspaper theme 10.3.9.1 for WordPress. It allows XSS via the wp-admin/admin-ajax.php td_block_id parameter in a td_ajax_… |
CVE-2021-32760 | Medium | 5.0 | 2021-07-19 | containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container i… |
CVE-2021-34618 | Medium | 6.5 | 2021-07-19 | A remote denial of service (DoS) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2… |
CVE-2021-34617 | Medium | 6.1 | 2021-07-19 | A remote cross-site scripting (XSS) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-… |
CVE-2021-31590 | High | 8.8 | 2021-07-19 | PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used… |
CVE-2021-34821 | Medium | 6.1 | 2021-07-19 | Cross Site Scripting (XSS) vulnerability exists in AAT Novus Management System through 1.51.2. The WebUI has wrong HTTP 404 error handling implemented. A remot… |
CVE-2021-34820 | High | 7.5 | 2021-07-19 | Web Path Directory Traversal in the Novus HTTP Server. The Novus HTTP Server is affected by the Directory Traversal for Arbitrary File Access vulnerability. A… |
CVE-2021-36799 | High | 8.8 | 2021-07-19 | KNX ETS5 through 5.7.6 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project information. NOTE: T… |
CVE-2021-36797 | Medium | 6.8 | 2021-07-19 | In Victron Energy Venus OS through 2.72, root access is granted by default to anyone with physical access to the device. NOTE: the vendor disagrees with the re… |
CVE-2021-34676 | High | 7.5 | 2021-07-19 | Basix NEX-Forms through 7.8.7 allows authentication bypass for Excel report generation. |
CVE-2021-34675 | High | 7.5 | 2021-07-19 | Basix NEX-Forms through 7.8.7 allows authentication bypass for stored PDF reports. |
CVE-2021-29780 | Medium | 4.7 | 2021-07-19 | IBM Resilient OnPrem v41.1 of IBM Security SOAR could allow an authenticated user to perform actions that they should not have access to due to improper input… |
CVE-2021-29707 | High | 7.8 | 2021-07-19 | IBM HMC (Hardware Management Console) V9.1.910.0 and V9.2.950.0 could allow a local user to escalate their privileges to root access on a restricted shell. IBM… |
CVE-2021-20507 | Medium | 5.4 | 2021-07-19 | IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2021-35449 | High | 7.8 | 2021-07-19 | The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below, and G4 driver 4.2.1.0 and below are af… |
CVE-2021-35043 | Medium | 6.1 | 2021-07-19 | OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript… |
CVE-2021-20110 | Critical | 9.8 | 2021-07-19 | Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure their IP address to mat… |
CVE-2021-20109 | High | 7.5 | 2021-07-19 | Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Expl… |
CVE-2021-20108 | High | 7.5 | 2021-07-19 | Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verif… |
CVE-2021-34817 | Medium | 6.1 | 2021-07-19 | A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a craft… |
CVE-2021-32014 | Medium | 5.5 | 2021-07-19 | SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when rea… |
CVE-2021-32013 | Medium | 5.5 | 2021-07-19 | SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when… |
CVE-2021-32012 | Medium | 5.5 | 2021-07-19 | SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when… |
CVE-2021-3279 | Medium | 6.1 | 2021-07-19 | sz.chat version 4 allows injection of web scripts and HTML in the message box. |
CVE-2021-31216 | High | 8.1 | 2021-07-19 | Siren Investigate before 11.1.1 contains a server side request forgery (SSRF) defect in the built-in image proxy route (which is enabled by default). An attack… |
CVE-2021-35968 | Medium | 4.3 | 2021-07-19 | The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system… |
CVE-2021-35967 | Medium | 5.3 | 2021-07-19 | The directory page parameter of the Orca HCM digital learning platform does not filter special characters. Remote attackers can access the system directory thr… |
CVE-2021-35966 | Medium | 6.1 | 2021-07-19 | The specific function of the Orca HCM digital learning platform does not filter input parameters properly, which causing the URL can be redirected to any websi… |
CVE-2021-35965 | Critical | 9.8 | 2021-07-19 | The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text… |
CVE-2021-35964 | High | 7.3 | 2021-07-19 | The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management f… |
CVE-2021-35963 | Critical | 9.8 | 2021-07-19 | The specific parameter of upload function of the Orca HCM digital learning platform does not filter file format, which allows remote unauthenticated attackers… |
CVE-2021-33501 | Critical | 9.6 | 2021-07-19 | Overwolf Client 0.169.0.22 allows XSS, with resultant Remote Code Execution, via an overwolfstore:// URL. |
CVE-2021-33027 | Critical | 9.8 | 2021-07-19 | Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce. |
CVE-2021-24482 | Medium | 4.8 | 2021-07-19 | The Related Posts for WordPress plugin through 2.0.4 does not sanitise its heading_text and CSS settings, allowing high privilege users (admin) to set XSS payl… |
CVE-2021-24453 | High | 8.8 | 2021-07-19 | The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution (RCE) of the syst… |
CVE-2021-24452 | Medium | 6.1 | 2021-07-19 | The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extension… |
CVE-2021-24447 | Medium | 5.3 | 2021-07-19 | The WP Image Zoom WordPress plugin before 1.47 did not validate its tab parameter before using it in the include_once() function, leading to a local file inclu… |
CVE-2021-24436 | Medium | 6.1 | 2021-07-19 | The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" paramet… |
CVE-2021-33592 | Critical | 9.8 | 2021-07-19 | NAVER Toolbar before 4.0.30.323 allows remote attackers to execute arbitrary code via a crafted upgrade.xml file. Special characters in filename parameter can… |
CVE-2021-36773 | High | 7.5 | 2021-07-18 | uBlock Origin before 1.36.2 and nMatrix before 4.4.9 support an arbitrary depth of parameter nesting for strict blocking, which allows crafted web sites to cau… |
CVE-2021-36772 | Medium | 6.1 | 2021-07-17 | Zoho ManageEngine ADManager Plus before 7110 allows stored XSS. |
CVE-2021-36771 | Medium | 6.1 | 2021-07-17 | Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS. |
CVE-2021-33911 | Critical | 9.8 | 2021-07-17 | Zoho ManageEngine ADManager Plus before 7110 allows remote code execution. |
CVE-2021-36213 | High | 7.5 | 2021-07-17 | HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing t… |
CVE-2021-32574 | High | 7.5 | 2021-07-17 | HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject… |
CVE-2021-36769 | Medium | 5.3 | 2021-07-17 | A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. An attacker can cause the ser… |
CVE-2021-3614 | Medium | 6.4 | 2021-07-16 | A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions d… |
CVE-2021-3550 | High | 7.8 | 2021-07-16 | A DLL search path vulnerability was reported in Lenovo PCManager, prior to version 3.0.500.5102, that could allow privilege escalation. |
CVE-2021-3453 | Medium | 6.8 | 2021-07-16 | Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access… |
CVE-2021-3452 | Medium | 6.7 | 2021-07-16 | A potential vulnerability in the system shutdown SMI callback function in some ThinkPad models may allow an attacker with local access and elevated privileges… |
CVE-2021-34481 | High | 8.8 | 2021-07-16 | A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfull… |
CVE-2021-34467 | High | 7.1 | 2021-07-16 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2021-34466 | Medium | 5.7 | 2021-07-16 | Windows Hello Security Feature Bypass Vulnerability |
CVE-2021-34464 | High | 7.8 | 2021-07-16 | Microsoft Defender Remote Code Execution Vulnerability |
CVE-2021-34462 | High | 7.0 | 2021-07-16 | Windows AppX Deployment Extensions Elevation of Privilege Vulnerability |
CVE-2021-34461 | High | 7.8 | 2021-07-16 | Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability |
CVE-2021-34460 | High | 7.8 | 2021-07-16 | Windows Storage Spaces Controller Elevation of Privilege Vulnerability |
CVE-2021-34459 | High | 7.8 | 2021-07-16 | Windows AppContainer Elevation Of Privilege Vulnerability |
CVE-2021-34458 | Critical | 9.9 | 2021-07-16 | Windows Kernel Remote Code Execution Vulnerability |
CVE-2021-34457 | Medium | 5.5 | 2021-07-16 | Windows Remote Access Connection Manager Information Disclosure Vulnerability |
CVE-2021-34456 | High | 7.8 | 2021-07-16 | Windows Remote Access Connection Manager Elevation of Privilege Vulnerability |
CVE-2021-34455 | High | 7.8 | 2021-07-16 | Windows File History Service Elevation of Privilege Vulnerability |
CVE-2021-34454 | Medium | 5.5 | 2021-07-16 | Windows Remote Access Connection Manager Information Disclosure Vulnerability |
CVE-2021-34452 | High | 7.8 | 2021-07-16 | Microsoft Word Remote Code Execution Vulnerability |
CVE-2021-34451 | Medium | 5.3 | 2021-07-16 | Microsoft Office Online Server Spoofing Vulnerability |
CVE-2021-34450 | High | 8.5 | 2021-07-16 | Windows Hyper-V Remote Code Execution Vulnerability |
CVE-2021-34449 | High | 7.0 | 2021-07-16 | Win32k Elevation of Privilege Vulnerability |
CVE-2021-34448 | Medium | 6.8 | 2021-07-16 | Scripting Engine Memory Corruption Vulnerability |
CVE-2021-34447 | Medium | 6.8 | 2021-07-16 | Windows MSHTML Platform Remote Code Execution Vulnerability |
CVE-2021-34446 | High | 8.0 | 2021-07-16 | Windows HTML Platforms Security Feature Bypass Vulnerability |
CVE-2021-34445 | High | 7.8 | 2021-07-16 | Windows Remote Access Connection Manager Elevation of Privilege Vulnerability |