2021 CVEs (page 153)
Page 153 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-34444 | Medium | 6.5 | 2021-07-16 | Windows DNS Server Denial of Service Vulnerability |
CVE-2021-34442 | High | 8.8 | 2021-07-16 | Windows DNS Server Remote Code Execution Vulnerability |
CVE-2021-34441 | High | 7.8 | 2021-07-16 | Microsoft Windows Media Foundation Remote Code Execution Vulnerability |
CVE-2021-34440 | Medium | 5.5 | 2021-07-16 | GDI+ Information Disclosure Vulnerability |
CVE-2021-34439 | High | 7.8 | 2021-07-16 | Microsoft Windows Media Foundation Remote Code Execution Vulnerability |
CVE-2021-34438 | High | 7.8 | 2021-07-16 | Windows Font Driver Host Remote Code Execution Vulnerability |
CVE-2021-32769 | High | 7.5 | 2021-07-16 | Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versions prior to 2.5.9. W… |
CVE-2021-32749 | Medium | 6.1 | 2021-07-16 | fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 through 0.11.2, the… |
CVE-2021-35962 | High | 7.5 | 2021-07-16 | Specific page parameters in Dr. ID Door Access Control and Personnel Attendance Management system does not filter special characters. Remote attackers can appl… |
CVE-2021-35961 | Critical | 9.8 | 2021-07-16 | Dr. ID Door Access Control and Personnel Attendance Management system uses the hard-code admin default credentials that allows remote attackers to access the s… |
CVE-2021-28053 | High | 8.8 | 2021-07-16 | An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A SQL injection vulnerability in "Configuration > Users > Contacts / Users" allows remote… |
CVE-2021-28054 | Medium | 5.4 | 2021-07-16 | An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A Stored Cross-Site Scripting (XSS) issue in "Configuration > Hosts" allows remote authen… |
CVE-2021-3649 | High | 7.5 | 2021-07-16 | chatwoot is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-28114 | Medium | 5.4 | 2021-07-16 | Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing. |
CVE-2021-1422 | High | 7.7 | 2021-07-16 | A vulnerability in the software cryptography module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could… |
CVE-2021-3647 | Medium | 6.1 | 2021-07-16 | URI.js is vulnerable to URL Redirection to Untrusted Site |
CVE-2021-21820 | Critical | 9.8 | 2021-07-16 | A hard-coded password vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lea… |
CVE-2021-21819 | High | 7.2 | 2021-07-16 | A code execution vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to… |
CVE-2021-21818 | High | 7.5 | 2021-07-16 | A hard-coded password vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can le… |
CVE-2021-21817 | High | 7.5 | 2021-07-16 | An information disclosure vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request ca… |
CVE-2021-21816 | Medium | 4.3 | 2021-07-16 | An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to the disc… |
CVE-2021-21804 | Critical | 9.8 | 2021-07-16 | A local file inclusion (LFI) vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP… |
CVE-2021-21803 | Medium | 6.1 | 2021-07-16 | This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attack… |
CVE-2021-21802 | Medium | 6.1 | 2021-07-16 | This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attack… |
CVE-2021-21801 | Medium | 6.1 | 2021-07-16 | This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attack… |
CVE-2021-21800 | Medium | 6.1 | 2021-07-16 | Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user visits a specially c… |
CVE-2021-21799 | Medium | 6.1 | 2021-07-16 | Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user visits a speciall… |
CVE-2021-36758 | Medium | 5.4 | 2021-07-16 | 1Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens that can be used to perform privi… |
CVE-2021-36755 | Medium | 6.1 | 2021-07-16 | Nightscout Web Monitor (aka cgm-remote-monitor) 14.2.2 allows XSS via a crafted X-Forwarded-For header. |
CVE-2021-32764 | High | 8.1 | 2021-07-15 | Discourse is an open-source discussion platform. In Discourse versions 2.7.5 and prior, parsing and rendering of YouTube Oneboxes can be susceptible to XSS att… |
CVE-2021-36753 | High | 7.8 | 2021-07-15 | sharkdp BAT before 0.18.2 executes less.exe from the current working directory. |
CVE-2021-0295 | Medium | 6.1 | 2021-07-15 | A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) of Juniper Networks Junos OS on the QFX10K Series switches allows an attacker to trig… |
CVE-2021-0294 | Medium | 5.3 | 2021-07-15 | A vulnerability in Juniper Networks Junos OS, which only affects the release 18.4R2-S5, where a function is inconsistently implemented on Juniper Networks Juno… |
CVE-2021-0293 | Medium | 5.5 | 2021-07-15 | A vulnerability in Juniper Networks Junos OS caused by Missing Release of Memory after Effective Lifetime leads to a memory leak each time the CLI command 'sho… |
CVE-2021-0292 | Medium | 6.5 | 2021-07-15 | An Uncontrolled Resource Consumption vulnerability in the ARP daemon (arpd) and Network Discovery Protocol (ndp) process of Juniper Networks Junos OS Evolved a… |
CVE-2021-0291 | Medium | 6.5 | 2021-07-15 | An Exposure of System Data vulnerability in Juniper Networks Junos OS and Junos OS Evolved, where a sensitive system-level resource is not being sufficiently p… |
CVE-2021-0290 | Medium | 6.5 | 2021-07-15 | Improper Handling of Exceptional Conditions in Ethernet interface frame processing of Juniper Networks Junos OS allows an attacker to send specially crafted fr… |
CVE-2021-0289 | Medium | 6.5 | 2021-07-15 | When user-defined ARP Policer is configured and applied on one or more Aggregated Ethernet (AE) interface units, a Time-of-check Time-of-use (TOCTOU) Race Cond… |
CVE-2021-0288 | Medium | 6.5 | 2021-07-15 | A vulnerability in the processing of specific MPLS packets in Juniper Networks Junos OS on MX Series and EX9200 Series devices with Trio-based MPCs (Modular Po… |
CVE-2021-0287 | Medium | 6.5 | 2021-07-15 | In a Segment Routing ISIS (SR-ISIS)/MPLS environment, on Juniper Networks Junos OS and Junos OS Evolved devices, configured with ISIS Flexible Algorithm for Se… |
CVE-2021-0286 | High | 7.5 | 2021-07-15 | A vulnerability in the handling of exceptional conditions in Juniper Networks Junos OS Evolved (EVO) allows an attacker to send specially crafted packets to th… |
CVE-2021-0285 | High | 7.5 | 2021-07-15 | An uncontrolled resource consumption vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series switches allows an attacker sending large a… |
CVE-2021-0283 | High | 7.5 | 2021-07-15 | A buffer overflow vulnerability in the TCP/IP stack of Juniper Networks Junos OS allows an attacker to send specific sequences of packets to the device thereby… |
CVE-2021-0282 | High | 7.5 | 2021-07-15 | On Juniper Networks Junos OS devices with Multipath or add-path feature enabled, processing a specific BGP UPDATE can lead to a routing process daemon (RPD) cr… |
CVE-2021-0281 | Medium | 5.9 | 2021-07-15 | On Juniper Networks Junos OS devices configured with BGP origin validation using Resource Public Key Infrastructure (RPKI) receipt of a specific packet from th… |
CVE-2021-0280 | High | 7.5 | 2021-07-15 | Due to an Improper Initialization vulnerability in Juniper Networks Junos OS on PTX platforms and QFX10K Series with Paradise (PE) chipset-based line cards, dd… |
CVE-2021-0279 | High | 8.6 | 2021-07-15 | Juniper Networks Contrail Cloud (CC) releases prior to 13.6.0 have RabbitMQ service enabled by default with hardcoded credentials. The messaging services of Ra… |
CVE-2021-0278 | High | 8.8 | 2021-07-15 | An Improper Input Validation vulnerability in J-Web of Juniper Networks Junos OS allows a locally authenticated attacker to escalate their privileges to root o… |
CVE-2021-0277 | High | 8.8 | 2021-07-15 | An Out-of-bounds Read vulnerability in the processing of specially crafted LLDP frames by the Layer 2 Control Protocol Daemon (l2cpd) of Juniper Networks Junos… |
CVE-2021-0276 | Critical | 9.8 | 2021-07-15 | A stack-based Buffer Overflow vulnerability in Juniper Networks SBR Carrier with EAP (Extensible Authentication Protocol) authentication configured, allows an… |
CVE-2021-35056 | Medium | 6.7 | 2021-07-15 | Unisys Stealth 5.1 before 5.1.025.0 and 6.0 before 6.0.055.0 has an unquoted Windows search path for a scheduled task. An unintended executable might run. |
CVE-2021-32770 | High | 7.5 | 2021-07-15 | Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication var… |
CVE-2021-34830 | High | 8.8 | 2021-07-15 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authenticatio… |
CVE-2021-34829 | High | 8.8 | 2021-07-15 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authenticatio… |
CVE-2021-34828 | High | 8.8 | 2021-07-15 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authenticatio… |
CVE-2021-34827 | High | 8.8 | 2021-07-15 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authenticatio… |
CVE-2021-29742 | High | 8.0 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a user to impersonate another user on the system. IBM X-Force ID: 201483. |
CVE-2021-29699 | Medium | 6.8 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote priviled user to upload arbitrary files with a dangerous file type that could be excuted by an us… |
CVE-2021-20537 | Medium | 6.5 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentica… |
CVE-2021-20534 | Low | 3.5 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to vi… |
CVE-2021-20533 | High | 7.2 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted… |
CVE-2021-20524 | Medium | 4.8 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2021-20523 | Low | 2.7 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in t… |
CVE-2021-20511 | Medium | 4.9 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL re… |
CVE-2021-20510 | Medium | 4.4 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 198299 |
CVE-2021-20500 | Medium | 4.4 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could reveal highly sensitive information to a local privileged user. IBM X-Force ID: 197980. |
CVE-2021-20499 | Low | 2.7 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in t… |
CVE-2021-20498 | Medium | 5.3 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the system. IBM X-Force ID… |
CVE-2021-20497 | High | 7.5 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informatio… |
CVE-2021-20496 | Medium | 4.9 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow an authenticated user to bypass input due to improper input validation. IBM X-Force ID: 197966. |
CVE-2021-3043 | High | 7.5 | 2021-07-15 | A reflected cross-site scripting (XSS) vulnerability exists in the Prisma Cloud Compute web console that enables a remote attacker to execute arbitrary JavaScr… |
CVE-2021-3042 | High | 7.8 | 2021-07-15 | A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Wind… |
CVE-2021-34429 | Medium | 5.3 | 2021-07-15 | For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF… |
CVE-2021-32750 | Medium | 6.8 | 2021-07-15 | MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop client prior to versio… |
CVE-2021-21587 | Medium | 5.3 | 2021-07-15 | Dell Wyse Management Suite versions 3.2 and earlier contain a full path disclosure vulnerability. A local unauthenticated attacker could exploit this vulnerabi… |
CVE-2021-21586 | High | 8.1 | 2021-07-15 | Wyse Management Suite versions 3.2 and earlier contain an absolute path traversal vulnerability. A remote authenticated malicious user could exploit this vulne… |
CVE-2021-32743 | High | 8.8 | 2021-07-15 | Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In v… |
CVE-2021-29749 | Medium | 5.4 | 2021-07-15 | IBM Secure External Authentication Server 6.0.2 and IBM Secure Proxy 6.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated… |
CVE-2021-29725 | High | 7.5 | 2021-07-15 | IBM Secure External Authentication Server 2.4.3.2, 6.0.1, 6.0.2 and IBM Secure Proxy 3.4.3.2, 6.0.1, 6.0.2 could allow a remote user to consume resources causi… |
CVE-2021-27847 | Medium | 6.5 | 2021-07-15 | Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point, mask.c#L85. |
CVE-2021-27845 | Medium | 5.5 | 2021-07-15 | A Divide-by-zero vulnerability exists in JasPer Image Coding Toolkit 2.0 in jasper/src/libjasper/jpc/jpc_enc.c |
CVE-2021-20439 | High | 7.5 | 2021-07-15 | IBM Security Access Manager 9.0 and IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by an unauthorized u… |
CVE-2021-32739 | High | 8.8 | 2021-07-15 | Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From… |
CVE-2021-34692 | High | 7.8 | 2021-07-15 | iDrive RemotePC before 7.6.48 on Windows allows privilege escalation. A local and low-privileged user can force RemotePC to execute an attacker-controlled exec… |
CVE-2021-34691 | High | 7.5 | 2021-07-15 | iDrive RemotePC before 4.0.1 on Linux allows denial of service. A remote and unauthenticated attacker can disconnect a valid user session by connecting to an e… |
CVE-2021-34690 | Critical | 9.8 | 2021-07-15 | iDrive RemotePC before 7.6.48 on Windows allows authentication bypass. A remote and unauthenticated attacker can bypass cloud authentication to connect and con… |
CVE-2021-34689 | Medium | 5.5 | 2021-07-15 | iDrive RemotePC before 7.6.48 on Windows allows information disclosure. A locally authenticated attacker can read the system's Personal Key in world-readable %… |
CVE-2021-34688 | Low | 3.3 | 2021-07-15 | iDrive RemotePC before 7.6.48 on Windows allows information disclosure. A locally authenticated attacker can read an encrypted version of the system's Personal… |
CVE-2021-34687 | Medium | 5.3 | 2021-07-15 | iDrive RemotePC before 7.6.48 on Windows allows information disclosure. A man in the middle can recover a system's Personal Key when a client attempts to make… |
CVE-2021-34558 | Medium | 6.5 | 2021-07-15 | The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a… |
CVE-2021-33505 | High | 7.8 | 2021-07-15 | A local malicious user can circumvent the Falco detection engine through 0.28.1 by running a program that alters arguments of system calls being executed. Issu… |
CVE-2021-31999 | High | 8.8 | 2021-07-15 | A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the… |
CVE-2021-25320 | Critical | 9.9 | 2021-07-15 | A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by creating requests with the cloud-credenti… |
CVE-2021-25318 | High | 8.8 | 2021-07-15 | A Incorrect Permission Assignment for Critical Resource vulnerability in Rancher allows users in the cluster to modify resources they should not have access to… |
CVE-2021-35211 | Critical | 9.0 | 2021-07-14 | Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited… |
CVE-2021-22867 | Medium | 6.5 | 2021-07-14 | A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configurat… |
CVE-2021-34174 | Medium | 4.6 | 2021-07-14 | A vulnerability exists in Broadcom BCM4352 and BCM43684 chips. Any wireless router using BCM4352 and BCM43684 will be affected, such as ASUS AX6100. An attacke… |
CVE-2021-34173 | High | 7.5 | 2021-07-14 | An attacker can cause a Denial of Service and kernel panic in v4.2 and earlier versions of Espressif esp32 via a malformed beacon csa frame. The device require… |
CVE-2021-34529 | High | 7.8 | 2021-07-14 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2021-34528 | High | 7.8 | 2021-07-14 | Visual Studio Code Remote Code Execution Vulnerability |