2021 CVEs (page 157)
Page 157 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-32703 | Medium | 5.3 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the sh… |
CVE-2021-29822 | Medium | 5.4 | 2021-07-12 | IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI th… |
CVE-2021-29805 | Medium | 5.4 | 2021-07-12 | IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2021-29804 | Medium | 5.4 | 2021-07-12 | IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2021-29803 | Medium | 5.4 | 2021-07-12 | IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2021-29794 | High | 7.5 | 2021-07-12 | IBM Tivoli Netcool/Impact 7.1.0.20 and 7.1.0.21 uses an insecure SSH server configuration which enables weaker than expected cryptographic algorithms that coul… |
CVE-2021-29792 | High | 7.2 | 2021-07-12 | IBM Event Streams 10.0, 10.1, 10.2, and 10.3 could allow a user the CA private key to create their own certificates and deploy them in the cluster and gain pri… |
CVE-2021-23390 | Critical | 9.8 | 2021-07-12 | The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions. |
CVE-2021-23389 | Critical | 9.8 | 2021-07-12 | The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions. |
CVE-2021-21591 | Medium | 6.4 | 2021-07-12 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text password storage vulnerability. A local malicious user with high pr… |
CVE-2021-21590 | Medium | 6.4 | 2021-07-12 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text password storage vulnerability. A local malicious user with high pr… |
CVE-2021-21589 | Medium | 5.7 | 2021-07-12 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 do not exit on failed Initialization. A local authenticated Service user could potential… |
CVE-2021-21588 | Medium | 6.5 | 2021-07-12 | Dell EMC PowerFlex, v3.5.x contain a Cross-Site WebSocket Hijacking Vulnerability in the Presentation Server/WebUI. An unauthenticated attacker could potential… |
CVE-2021-20414 | Medium | 4.9 | 2021-07-12 | IBM Guardium Data Encryption (GDE) 3.0.0.2 could allow a user to bruce force sensitive information due to not properly limiting the number of interactions. IBM… |
CVE-2021-33807 | High | 7.5 | 2021-07-12 | Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData. |
CVE-2021-33037 | Medium | 5.3 | 2021-07-12 | Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstanc… |
CVE-2021-30640 | Medium | 6.5 | 2021-07-12 | A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protec… |
CVE-2021-30639 | High | 7.5 | 2021-07-12 | A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling… |
CVE-2021-36383 | Medium | 4.3 | 2021-07-12 | Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data… |
CVE-2021-36382 | Low | 2.6 | 2021-07-12 | Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connection… |
CVE-2021-32688 | High | 8.8 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tok… |
CVE-2021-32680 | Low | 3.3 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions priot to 19.0.13, 20.0.11, and 21.0.3, Nextcloud Server audit logging functional… |
CVE-2021-26088 | High | 7.1 | 2021-07-12 | An improper authentication vulnerability in FSSO Collector version 5.0.295 and below may allow an unauthenticated user to bypass a FSSO firewall policy and acc… |
CVE-2021-24015 | High | 7.2 | 2021-07-12 | An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authe… |
CVE-2021-24013 | High | 8.8 | 2021-07-12 | Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via s… |
CVE-2021-36377 | High | 7.5 | 2021-07-12 | Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation. |
CVE-2021-32679 | Low | 3.5 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, filenames where not escaped by default in… |
CVE-2021-32678 | Low | 3.7 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API res… |
CVE-2021-26090 | Medium | 5.3 | 2021-07-12 | A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an una… |
CVE-2021-26089 | Medium | 6.7 | 2021-07-12 | An improper symlink following in FortiClient for Mac 6.4.3 and below may allow an non-privileged user to execute arbitrary privileged shell commands during ins… |
CVE-2021-35064 | Critical | 9.8 | 2021-07-12 | KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits running of multiple dangerous commands, inc… |
CVE-2021-30129 | Medium | 6.5 | 2021-07-12 | A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port f… |
CVE-2021-3547 | High | 7.4 | 2021-07-12 | OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certif… |
CVE-2021-35037 | Medium | 6.1 | 2021-07-12 | Jamf Pro before 10.30.1 allows for an unvalidated URL redirect vulnerability affecting Jamf Pro customers who host their environments on-premises. An attacker… |
CVE-2021-27293 | High | 7.5 | 2021-07-12 | RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into Date… |
CVE-2021-22921 | High | 7.8 | 2021-07-12 | Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specificall… |
CVE-2021-22918 | Medium | 5.3 | 2021-07-12 | Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is re… |
CVE-2021-22917 | Medium | 6.5 | 2021-07-12 | Brave Browser Desktop between versions 1.17 and 1.20 is vulnerable to information disclosure by way of DNS requests in Tor windows not flowing through Tor if a… |
CVE-2021-22916 | Medium | 5.9 | 2021-07-12 | In Brave Desktop between versions 1.17 and 1.26.60, when adblocking is enabled and a proxy browser extension is installed, the CNAME adblocking feature issues… |
CVE-2021-22515 | Medium | 4.8 | 2021-07-12 | Multi-Factor Authentication (MFA) functionality can be bypassed, allowing the use of single factor authentication in NetIQ Advanced Authentication versions pri… |
CVE-2021-26099 | Medium | 4.4 | 2021-07-12 | Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an attacker who comes in possession of the encrypted m… |
CVE-2021-29105 | Medium | 5.4 | 2021-07-11 | A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker t… |
CVE-2021-29104 | Medium | 6.1 | 2021-07-11 | A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and sto… |
CVE-2021-29103 | Medium | 6.1 | 2021-07-11 | A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on… |
CVE-2021-29102 | Critical | 9.1 | 2021-07-11 | A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET… |
CVE-2021-29107 | Medium | 6.1 | 2021-07-10 | A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and sto… |
CVE-2021-29106 | Medium | 6.1 | 2021-07-10 | A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to clic… |
CVE-2021-35361 | Medium | 4.8 | 2021-07-09 | A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/links of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a craft… |
CVE-2021-35360 | Medium | 4.8 | 2021-07-09 | A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/containers of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a… |
CVE-2021-35358 | Medium | 4.8 | 2021-07-09 | A stored cross site scripting (XSS) vulnerability in dotAdmin/#/c/c_Images of dotCMS 21.05.1 allows authenticated attackers to execute arbitrary web scripts or… |
CVE-2021-20024 | High | 8.1 | 2021-07-09 | Multiple Out-of-Bound read vulnerability in SonicWall Switch when handling LLDP Protocol allows an attacker to cause a system instability or potentially read s… |
CVE-2021-36371 | Low | 3.7 | 2021-07-09 | Emissary-Ingress (formerly Ambassador API Gateway) through 1.13.9 allows attackers to bypass client certificate requirements (i.e., mTLS cert_required) on back… |
CVE-2021-36367 | High | 8.1 | 2021-07-09 | PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it easier for an attac… |
CVE-2021-33214 | Medium | 6.1 | 2021-07-09 | In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive information disclosure… |
CVE-2021-32753 | High | 8.3 | 2021-07-09 | EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fu… |
CVE-2021-26106 | High | 7.8 | 2021-07-09 | An improper neutralization of special elements used in an OS Command vulnerability in FortiAP's console 6.4.1 through 6.4.5 and 6.2.4 through 6.2.5 may allow a… |
CVE-2021-26100 | Medium | 5.9 | 2021-07-09 | A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who intercepts the encryp… |
CVE-2021-24020 | High | 7.5 | 2021-07-09 | A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthen… |
CVE-2021-24007 | Critical | 9.8 | 2021-07-09 | Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execut… |
CVE-2021-22129 | High | 8.8 | 2021-07-09 | Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated att… |
CVE-2021-33795 | Medium | 5.5 | 2021-07-09 | Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 produce incorrect PDF document signatures because the certificate name, document owner, and signature a… |
CVE-2021-33792 | High | 7.8 | 2021-07-09 | Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write via a crafted /Size key in the Trailer dictionary. |
CVE-2021-3541 | Medium | 6.5 | 2021-07-09 | A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service. |
CVE-2021-29730 | High | 8.8 | 2021-07-09 | IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the att… |
CVE-2021-29712 | Medium | 6.1 | 2021-07-09 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2021-33012 | High | 8.6 | 2021-07-09 | Rockwell Automation MicroLogix 1100, all versions, allows a remote, unauthenticated attacker sending specially crafted commands to cause the PLC to fault when… |
CVE-2021-27039 | High | 7.8 | 2021-07-09 | A maliciously crafted TIFF and PCX file can be forced to read and write beyond allocated boundaries when parsing the TIFF and PCX file for based overflow. This… |
CVE-2021-27038 | High | 7.8 | 2021-07-09 | A Type Confusion vulnerability in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can occur when processing a maliciously crafted PDF file. A malicious act… |
CVE-2021-27037 | High | 7.8 | 2021-07-09 | A maliciously crafted PNG, PDF or DWF file in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can be used to attempt to free an object that has already bee… |
CVE-2021-27036 | High | 7.8 | 2021-07-09 | A maliciously crafted PCX, PICT, RCL, TIF, BMP, PSD or TIFF file can be used to write beyond the allocated buffer while parsing PCX, PDF, PICT, RCL, BMP, PSD o… |
CVE-2021-27035 | High | 7.8 | 2021-07-09 | A maliciously crafted TIFF, TIF, PICT, TGA, or DWF files in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can be forced to read beyond allocated boundari… |
CVE-2021-27034 | High | 7.8 | 2021-07-09 | A heap-based buffer overflow could occur while parsing PICT, PCX, RCL or TIFF files in Autodesk Design Review 2018, 2017, 2013, 2012, 2011. This vulnerability… |
CVE-2021-27033 | High | 8.1 | 2021-07-09 | A maliciously crafted PDF file, when opened by a user in Autodesk Design Review, can trigger a Double Free vulnerability in the Autodesk Design Review applicat… |
CVE-2021-32752 | High | 7.2 | 2021-07-09 | Ether Logs is a package that allows one to check one's logs in the Craft 3 utilities section. A vulnerability was found in versions prior to 3.0.4 that allowed… |
CVE-2021-32742 | High | 7.5 | 2021-07-09 | Vapor is a web framework for Swift. In versions 4.47.1 and prior, bug in the `Data.init(base32Encoded:)` function opens up the potential for exposing server me… |
CVE-2021-30201 | High | 7.5 | 2021-07-09 | The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system. When this XML is processed (external) entities are insecurely processed and fetched by th… |
CVE-2021-30121 | Medium | 6.5 | 2021-07-09 | Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request: `https://x.x.x.x/KLC/js/Kaseya.SB.JS/… |
CVE-2021-30120 | Critical | 9.9 | 2021-07-09 | Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side an… |
CVE-2021-30119 | Medium | 5.4 | 2021-07-09 | Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page a… |
CVE-2021-30118 | Critical | 9.8 | 2021-07-09 | An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management (RMM) 9.5.4.2149 and subsequent… |
CVE-2021-30117 | Critical | 9.8 | 2021-07-09 | The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injection in the parameter fldrId. Detailed description -… |
CVE-2021-30116 | Critical | 10.0 | 2021-07-09 | Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the… |
CVE-2021-23405 | High | 8.3 | 2021-07-09 | This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionG… |
CVE-2021-36155 | High | 7.5 | 2021-07-09 | LengthPrefixedMessageReader in gRPC Swift 1.1.0 and earlier allocates buffers of arbitrary length, which allows remote attackers to cause uncontrolled resource… |
CVE-2021-36154 | High | 7.5 | 2021-07-09 | HTTP2ToRawGRPCServerCodec in gRPC Swift 1.1.1 and earlier allows remote attackers to deny service via the delivery of many small messages within a single HTTP/… |
CVE-2021-36153 | High | 7.5 | 2021-07-09 | Mismanaged state in GRPCWebToHTTP2ServerCodec.swift in gRPC Swift 1.1.0 and 1.1.1 allows remote attackers to deny service by sending malformed requests. |
CVE-2021-3637 | High | 7.5 | 2021-07-09 | A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows boun… |
CVE-2021-3612 | High | 7.8 | 2021-07-09 | An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOC… |
CVE-2021-3571 | High | 7.1 | 2021-07-09 | A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote att… |
CVE-2021-3570 | High | 8.8 | 2021-07-09 | A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to c… |
CVE-2021-32972 | Medium | 5.5 | 2021-07-09 | Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser to access the URI a… |
CVE-2021-34616 | Medium | 6.3 | 2021-07-08 | A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has rel… |
CVE-2021-34615 | Medium | 6.3 | 2021-07-08 | A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has rel… |
CVE-2021-34613 | Medium | 6.3 | 2021-07-08 | A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has rel… |
CVE-2021-34612 | Medium | 6.3 | 2021-07-08 | A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has rel… |
CVE-2021-1607 | Medium | 4.8 | 2021-07-08 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct… |
CVE-2021-1606 | Medium | 4.8 | 2021-07-08 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct… |
CVE-2021-1605 | Medium | 4.8 | 2021-07-08 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct… |
CVE-2021-1604 | Medium | 4.8 | 2021-07-08 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct… |
CVE-2021-1603 | Medium | 4.8 | 2021-07-08 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct… |