2021 CVEs (page 155)
Page 155 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-33211 | Medium | 6.5 | 2021-07-14 | A Directory Traversal vulnerability in the Unzip feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to write files to arbitrary dire… |
CVE-2021-24117 | Medium | 4.9 | 2021-07-14 | In Apache Teaclave Rust SGX SDK 1.1.3, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain informa… |
CVE-2021-0654 | Medium | 5.5 | 2021-07-14 | In isRealSnapshot of TaskThumbnailView.java, there is possible data exposure due to a missing permission check. This could lead to local information disclosure… |
CVE-2021-0604 | Medium | 5.5 | 2021-07-14 | In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible way to share private files over Bluetooth due to a confused deputy. This could lead t… |
CVE-2021-0603 | High | 7.8 | 2021-07-14 | In onCreate of ContactSelectionActivity.java, there is a possible way to get access to contacts without permission due to a tapjacking/overlay attack. This cou… |
CVE-2021-0602 | High | 7.8 | 2021-07-14 | In onCreateOptionsMenu of WifiNetworkDetailsFragment.java, there is a possible way for guest users to view and modify Wi-Fi settings for all configured APs due… |
CVE-2021-0601 | Medium | 5.5 | 2021-07-14 | In encodeFrames of avc_enc_fuzzer.cpp, there is a possible out of bounds write due to a double free. This could lead to local information disclosure with no ad… |
CVE-2021-0600 | High | 7.8 | 2021-07-14 | In onCreate of DeviceAdminAdd.java, there is a possible way to mislead a user to activate a device admin app due to improper input validation. This could lead… |
CVE-2021-0599 | Medium | 5.5 | 2021-07-14 | In scheduleTimeoutLocked of NotificationRecord.java, there is a possible disclosure of a sensitive identifier via broadcasted intent due to a confused deputy… |
CVE-2021-0597 | Medium | 5.5 | 2021-07-14 | In notifyProfileAdded and notifyProfileRemoved of SipService.java, there is a possible way to retrieve SIP account names due to a missing permission check. Thi… |
CVE-2021-0596 | High | 7.5 | 2021-07-14 | In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information… |
CVE-2021-0594 | High | 8.0 | 2021-07-14 | In onCreate of ConfirmConnectActivity, there is a possible remote bypass of user consent due to improper input validation. This could lead to remote (proximal… |
CVE-2021-0592 | High | 8.8 | 2021-07-14 | In various functions in WideVine, there are possible out of bounds writes due to improper input validation. This could lead to remote code execution with no ad… |
CVE-2021-0590 | Medium | 4.4 | 2021-07-14 | In sendNetworkConditionsBroadcast of NetworkMonitor.java, there is a possible way for a privileged app to receive WiFi BSSID and SSID without location permissi… |
CVE-2021-0589 | High | 7.8 | 2021-07-14 | In BTM_TryAllocateSCN of btm_scn.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege… |
CVE-2021-0588 | Medium | 5.5 | 2021-07-14 | In processInboundMessage of MceStateMachine.java, there is a possible SMS disclosure due to a missing permission check. This could lead to local information di… |
CVE-2021-0587 | High | 7.8 | 2021-07-14 | In StreamOut::prepareForWriting of StreamOut.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privi… |
CVE-2021-0586 | High | 7.8 | 2021-07-14 | In onCreate of DevicePickerFragment.java, there is a possible way to trick the user to select an unwanted bluetooth device due to a tapjacking/overlay attack… |
CVE-2021-0585 | Medium | 6.7 | 2021-07-14 | In beginWrite and beginRead of MessageQueueBase.h, there is a possible out of bounds write due to improper input validation. This could lead to local escalatio… |
CVE-2021-0577 | High | 7.8 | 2021-07-14 | In flv extractor, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional ex… |
CVE-2021-0518 | Medium | 5.5 | 2021-07-14 | In Wi-Fi, there is a possible leak of location-sensitive data due to a missing permission check. This could lead to local information disclosure with no additi… |
CVE-2021-0515 | Critical | 9.8 | 2021-07-14 | In Factory::CreateStrictFunctionMap of factory.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code exe… |
CVE-2021-0514 | High | 8.1 | 2021-07-14 | In several functions of the V8 library, there is a possible use after free due to a race condition. This could lead to remote code execution in an unprivileged… |
CVE-2021-0486 | High | 7.8 | 2021-07-14 | In onPackageAddedInternal of PermissionManagerService.java, there is possible access to external storage due to a permissions bypass. This could lead to local… |
CVE-2021-0441 | High | 7.3 | 2021-07-14 | In onCreate of PermissionActivity.java, there is a possible permission bypass due to Confusing UI. This could lead to local escalation of privilege with no add… |
CVE-2021-0144 | Medium | 6.7 | 2021-07-14 | Insecure default variable initialization for the Intel BSSA DFT feature may allow a privileged user to potentially enable an escalation of privilege via local… |
CVE-2021-24119 | Medium | 4.9 | 2021-07-14 | In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain informati… |
CVE-2021-24116 | Medium | 4.9 | 2021-07-14 | In wolfSSL through 4.6.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about se… |
CVE-2021-35469 | High | 7.8 | 2021-07-14 | The Lexmark Printer Software G2, G3 and G4 Installation Packages have a local escalation of privilege vulnerability due to a registry entry that has an unquote… |
CVE-2021-33689 | Medium | 4.3 | 2021-07-14 | When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator (Administrator applications), version - 7.50, no security… |
CVE-2021-33687 | Medium | 4.9 | 2021-07-14 | SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP requests, an attack… |
CVE-2021-33684 | Medium | 5.3 | 2021-07-14 | SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.2… |
CVE-2021-33683 | Medium | 4.3 | 2021-07-14 | SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NU… |
CVE-2021-33682 | Medium | 5.4 | 2021-07-14 | SAP Lumira Server version 2.4 does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This would allow an a… |
CVE-2021-33681 | Medium | 6.5 | 2021-07-14 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes out of bounds write and c… |
CVE-2021-33680 | Medium | 6.5 | 2021-07-14 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes buffer overflow and cause… |
CVE-2021-33678 | Medium | 6.5 | 2021-07-14 | A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75… |
CVE-2021-33677 | High | 7.5 | 2021-07-14 | SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 702, 730, 731, 804, 740, 750, 784, expose functions to external which can lead to information disc… |
CVE-2021-33676 | High | 7.2 | 2021-07-14 | A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with high privileges to compromise confidentia… |
CVE-2021-33671 | High | 8.8 | 2021-07-14 | SAP NetWeaver Guided Procedures (Administration Workset), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks for an… |
CVE-2021-33670 | High | 7.5 | 2021-07-14 | SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP reque… |
CVE-2021-33667 | Medium | 4.3 | 2021-07-14 | Under certain conditions, SAP Business Objects Web Intelligence (BI Launchpad) versions - 420, 430, allows an attacker to access jsp source code, through SDK c… |
CVE-2021-25953 | Critical | 9.8 | 2021-07-14 | Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code executi… |
CVE-2021-22318 | Medium | 5.5 | 2021-07-14 | A component of the HarmonyOS 2.0 has a Null Pointer Dereference Vulnerability. Local attackers may exploit this vulnerability to cause system denial of service. |
CVE-2021-36374 | Medium | 5.5 | 2021-07-14 | When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of… |
CVE-2021-36373 | Medium | 5.5 | 2021-07-14 | When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error… |
CVE-2021-20784 | Medium | 6.1 | 2021-07-14 | HTTP header injection vulnerability in Everything version 1.0, 1.1, and 1.2 except the Lite version may allow a remote attacker to inject an arbitrary script o… |
CVE-2021-20782 | High | 8.8 | 2021-07-14 | Cross-site request forgery (CSRF) vulnerability in Software License Manager versions prior to 4.4.6 allows remote attackers to hijack the authentication of adm… |
CVE-2021-20781 | High | 8.8 | 2021-07-14 | Cross-site request forgery (CSRF) vulnerability in WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8 allow… |
CVE-2021-20748 | High | 7.5 | 2021-07-14 | Retty App for Android versions prior to 4.8.13 and Retty App for iOS versions prior to 4.11.14 uses a hard-coded API key for an external service. By exploiting… |
CVE-2021-20747 | Medium | 4.3 | 2021-07-14 | Improper authorization in handler for custom URL scheme vulnerability in Retty App for Android versions prior to 4.8.13 and Retty App for iOS versions prior to… |
CVE-2021-32755 | Medium | 5.4 | 2021-07-13 | Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retries for the iOS implementation of Wire. In t… |
CVE-2021-22000 | High | 7.8 | 2021-07-13 | VMware Thinapp version 5.x prior to 5.2.10 contain a DLL hijacking vulnerability due to insecure loading of DLLs. A malicious actor with non-administrative pri… |
CVE-2021-21995 | High | 7.5 | 2021-07-13 | OpenSLP as used in ESXi has a denial-of-service vulnerability due a heap out-of-bounds read issue. A malicious actor with network access to port 427 on ESXi ma… |
CVE-2021-21994 | Critical | 9.8 | 2021-07-13 | SFCB (Small Footprint CIM Broker) as used in ESXi has an authentication bypass vulnerability. A malicious actor with network access to port 5989 on ESXi may ex… |
CVE-2021-36214 | Medium | 6.1 | 2021-07-13 | LINE client for iOS before 10.16.3 allows cross site script with specific header in WebView. |
CVE-2021-31217 | Critical | 9.1 | 2021-07-13 | In SolarWinds DameWare Mini Remote Control Server 12.0.1.200, insecure file permissions allow file deletion as SYSTEM. |
CVE-2021-34552 | Critical | 9.8 | 2021-07-13 | Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to tri… |
CVE-2021-20424 | Medium | 4.3 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the bro… |
CVE-2021-20423 | High | 8.8 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 could allow an authenticated user gain escalated privilesges due to improper application permissions. IBM X-Force ID: 196308. |
CVE-2021-20422 | High | 7.5 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 could disclose sensitive information to a malicious attacker by accessing data stored in memory. IBM X-Force ID: 196304. |
CVE-2021-20369 | Medium | 5.9 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM… |
CVE-2021-20368 | Medium | 5.4 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2021-20366 | Medium | 5.4 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2021-20365 | Medium | 5.4 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2021-20364 | Medium | 5.4 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2021-20363 | Medium | 5.4 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2021-20362 | Medium | 5.4 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2021-20361 | Medium | 5.4 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2021-20360 | High | 7.5 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM… |
CVE-2021-36124 | Critical | 9.8 | 2021-07-13 | An issue was discovered in Echo ShareCare 8.15.5. It does not perform authentication or authorization checks when accessing a subset of sensitive resources, le… |
CVE-2021-36123 | Medium | 6.5 | 2021-07-13 | An issue was discovered in Echo ShareCare 8.15.5. The TextReader feature in General/TextReader/TextReader.cfm is susceptible to a local file inclusion vulnerab… |
CVE-2021-36122 | High | 8.8 | 2021-07-13 | An issue was discovered in Echo ShareCare 8.15.5. The UnzipFile feature in Access/EligFeedParse_Sup/UnzipFile_Upd.cfm is susceptible to a command argument inje… |
CVE-2021-36121 | High | 8.8 | 2021-07-13 | An issue was discovered in Echo ShareCare 8.15.5. The file-upload feature in Access/DownloadFeed_Mnt/FileUpload_Upd.cfm is susceptible to an unrestricted uploa… |
CVE-2021-35957 | Medium | 6.7 | 2021-07-13 | Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can replace the Visual C+… |
CVE-2021-33578 | Critical | 9.8 | 2021-07-13 | Echo ShareCare 8.15.5 is susceptible to SQL injection vulnerabilities when processing remote input from both authenticated and unauthenticated users, leading t… |
CVE-2021-31224 | Low | 3.5 | 2021-07-13 | SES Evolution before 2.1.0 allows duplicating an existing security policy by leveraging access of a user having read-only access to security policies. |
CVE-2021-31223 | Medium | 5.7 | 2021-07-13 | SES Evolution before 2.1.0 allows reading some parts of a security policy by leveraging access to a computer having the administration console installed. |
CVE-2021-31222 | Medium | 5.7 | 2021-07-13 | SES Evolution before 2.1.0 allows updating some parts of a security policy by leveraging access to a computer having the administration console installed. |
CVE-2021-31221 | Medium | 5.7 | 2021-07-13 | SES Evolution before 2.1.0 allows deleting some parts of a security policy by leveraging access to a computer having the administration console installed. |
CVE-2021-31220 | Medium | 5.2 | 2021-07-13 | SES Evolution before 2.1.0 allows modifying security policies by leveraging access of a user having read-only access to security policies. |
CVE-2021-20593 | High | 7.1 | 2021-07-13 | Incorrect Implementation of Authentication Algorithm in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.2.50 to Ver. 3.35, GB-50… |
CVE-2021-36376 | High | 7.8 | 2021-07-13 | dandavison delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory. |
CVE-2021-31810 | Medium | 5.8 | 2021-07-13 | An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP i… |
CVE-2021-31225 | High | 7.3 | 2021-07-13 | SES Evolution before 2.1.0 allows deleting some resources not currently in use by any security policy by leveraging access to a computer having the administrat… |
CVE-2021-22440 | Medium | 4.6 | 2021-07-13 | There is a path traversal vulnerability in some Huawei products. The vulnerability is due to that the software uses external input to construct a pathname that… |
CVE-2021-22399 | Medium | 5.5 | 2021-07-13 | The Bluetooth function of some Huawei smartphones has a DoS vulnerability. Attackers can install third-party apps to send specific broadcasts, causing the Blue… |
CVE-2021-34333 | Medium | 5.5 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected ap… |
CVE-2021-34332 | Medium | 5.5 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected ap… |
CVE-2021-34331 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Jt981.dll library in affected applica… |
CVE-2021-34330 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Jt981.dll library in affected applica… |
CVE-2021-34329 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13… |
CVE-2021-34328 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13… |
CVE-2021-34327 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13… |
CVE-2021-34326 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13… |
CVE-2021-34325 | Medium | 5.5 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Jt981.dll library in affected applica… |
CVE-2021-34324 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Jt981.dll library in affected applica… |
CVE-2021-34323 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Jt981.dll library in affected applica… |
CVE-2021-34322 | Medium | 5.5 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The JPEG2K_Loader.dll library in affected… |
CVE-2021-34321 | Medium | 5.5 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The VisDraw.dll library in affected appli… |