2021 CVEs (page 159)
Page 159 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-32509 | Medium | 6.5 | 2021-07-07 | Absolute Path Traversal vulnerability in FileviewDoc in QSAN Storage Manager allows remote authenticated attackers access arbitrary files by injecting the Symb… |
CVE-2021-32508 | Medium | 6.5 | 2021-07-07 | Absolute Path Traversal vulnerability in FileStreaming in QSAN Storage Manager allows remote authenticated attackers access arbitrary files by injecting the Sy… |
CVE-2021-32507 | Medium | 6.5 | 2021-07-07 | Absolute Path Traversal vulnerability in FileDownload in QSAN Storage Manager allows remote authenticated attackers download arbitrary files via the Url path p… |
CVE-2021-32506 | Medium | 6.5 | 2021-07-07 | Absolute Path Traversal vulnerability in GetImage in QSAN Storage Manager allows remote authenticated attackers download arbitrary files via the Url path param… |
CVE-2021-26274 | High | 7.1 | 2021-07-07 | The Agent in NinjaRMM 5.0.909 has Insecure Permissions. |
CVE-2021-26273 | High | 7.8 | 2021-07-07 | The Agent in NinjaRMM 5.0.909 has Incorrect Access Control. |
CVE-2021-22233 | Medium | 4.3 | 2021-07-07 | An information disclosure vulnerability in GitLab EE versions 13.10 and later allowed a user to read project details |
CVE-2021-36212 | Medium | 6.1 | 2021-07-07 | app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view. |
CVE-2021-34627 | Medium | 4.3 | 2021-07-07 | A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom ex… |
CVE-2021-34626 | Medium | 4.3 | 2021-07-07 | A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions… |
CVE-2021-34625 | Medium | 6.4 | 2021-07-07 | A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scrip… |
CVE-2021-34624 | Critical | 9.8 | 2021-07-07 | A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users… |
CVE-2021-34623 | Critical | 9.8 | 2021-07-07 | A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for use… |
CVE-2021-34622 | Critical | 9.8 | 2021-07-07 | A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible… |
CVE-2021-34621 | Critical | 9.8 | 2021-07-07 | A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible f… |
CVE-2021-34620 | High | 8.8 | 2021-07-07 | The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Esca… |
CVE-2021-25952 | Critical | 9.8 | 2021-07-07 | Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code e… |
CVE-2021-22555 | High | 8.3 | 2021-07-07 | A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a… |
CVE-2021-22225 | Medium | 4.7 | 2021-07-07 | Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a spec… |
CVE-2021-22224 | High | 7.1 | 2021-07-07 | A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call… |
CVE-2021-26039 | Medium | 6.1 | 2021-07-07 | An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the imagelist view of com_media leads to a XSS vulnerability. |
CVE-2021-26038 | High | 7.5 | 2021-07-07 | An issue was discovered in Joomla! 2.5.0 through 3.9.27. Install action in com_installer lack the required hardcoded ACL checks for superusers. A default syste… |
CVE-2021-26037 | Medium | 5.3 | 2021-07-07 | An issue was discovered in Joomla! 2.5.0 through 3.9.27. CMS functions did not properly termine existing user sessions when a user's password was changed or th… |
CVE-2021-26036 | High | 7.5 | 2021-07-07 | An issue was discovered in Joomla! 2.5.0 through 3.9.27. Missing validation of input could lead to a broken usergroups table. |
CVE-2021-26035 | Medium | 6.1 | 2021-07-07 | An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the rules field of the JForm API leads to a XSS vulnerability. |
CVE-2021-22231 | Low | 3.5 | 2021-07-07 | A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile page via using a spec… |
CVE-2021-22230 | Medium | 4.9 | 2021-07-07 | Improper code rendering while rendering merge requests could be exploited to submit malicious code. This vulnerability affects GitLab CE/EE 9.3 and later throu… |
CVE-2021-22227 | Medium | 6.1 | 2021-07-07 | A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker to send a malicious link to a victim and… |
CVE-2021-20780 | High | 8.8 | 2021-07-07 | Cross-site request forgery (CSRF) vulnerability in WPCS - WordPress Currency Switcher 1.1.6 and earlier allows remote attackers to hijack the authentication of… |
CVE-2021-20779 | High | 8.8 | 2021-07-07 | Cross-site request forgery (CSRF) vulnerability in WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 allows remote attackers to hijack t… |
CVE-2021-20777 | Medium | 4.3 | 2021-07-07 | Improper authorization in handler for custom URL scheme vulnerability in GU App for Android versions from 4.8.0 to 5.0.2 allows a remote attacker to lead a use… |
CVE-2021-20776 | Critical | 9.8 | 2021-07-07 | Improper authentication vulnerability in SCT-40CM01SR and AT-40CM01SR allows an attacker to bypass access restriction and execute an arbitrary command via teln… |
CVE-2021-20739 | High | 8.8 | 2021-07-07 | WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S all versions allows an u… |
CVE-2021-20738 | Medium | 6.5 | 2021-07-07 | WRC-1167FS-W, WRC-1167FS-B, and WRC-1167FSA all versions allow an unauthenticated network-adjacent attacker to obtain sensitive information via unspecified vec… |
CVE-2021-35039 | High | 7.8 | 2021-07-07 | kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kern… |
CVE-2021-22228 | Medium | 6.5 | 2021-07-06 | An issue has been discovered in GitLab affecting all versions before 13.11.6, all versions starting from 13.12 before 13.12.6, and all versions starting from 1… |
CVE-2021-22223 | Medium | 6.1 | 2021-07-06 | Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf… |
CVE-2021-22232 | Low | 3.5 | 2021-07-06 | HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE |
CVE-2021-22229 | Medium | 5.9 | 2021-07-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.8. Under a special condition it was possible to access data of an internal… |
CVE-2021-22226 | Medium | 6.5 | 2021-07-06 | Under certain conditions, some users were able to push to protected branches that were restricted to deploy keys in GitLab CE/EE since version 13.9 |
CVE-2021-34190 | Medium | 4.8 | 2021-07-06 | A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or… |
CVE-2021-3598 | Medium | 5.5 | 2021-07-06 | There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an applicati… |
CVE-2021-35440 | Medium | 6.1 | 2021-07-06 | Smashing 1.3.4 is vulnerable to Cross Site Scripting (XSS). A URL for a widget can be crafted and used to execute JavaScript on the victim's computer. The Java… |
CVE-2021-32740 | High | 7.5 | 2021-07-06 | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerabil… |
CVE-2021-32559 | Medium | 6.5 | 2021-07-06 | An integer overflow exists in pywin32 prior to version b301 when adding an access control entry (ACE) to an access control list (ACL) that would cause the size… |
CVE-2021-27930 | Medium | 5.4 | 2021-07-06 | Multiple stored XSS vulnerabilities in IrisNext Edition 9.5.16, which allows an authenticated (or compromised) user to inject malicious JavaScript in folder/fi… |
CVE-2021-24494 | Medium | 5.4 | 2021-07-06 | The WP Offload SES Lite WordPress plugin before 1.4.5 did not escape some of the fields in the Activity page of the admin dashboard, such as the email's id, su… |
CVE-2021-24451 | High | 7.2 | 2021-07-06 | The Export Users With Meta WordPress plugin before 0.6.5 did not escape the list of roles to export before using them in a SQL statement in the export function… |
CVE-2021-24407 | Medium | 6.1 | 2021-07-06 | The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX action, leading to a Reflected Cross-s… |
CVE-2021-24406 | Medium | 6.1 | 2021-07-06 | The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum, leading to an open redirect issue aft… |
CVE-2021-24405 | Medium | 6.5 | 2021-07-06 | The Easy Cookies Policy WordPress plugin through 1.6.2 is lacking any capability and CSRF check when saving its settings, allowing any authenticated users (suc… |
CVE-2021-24389 | Medium | 6.1 | 2021-07-06 | The WP Foodbakery WordPress plugin before 2.2, used in the FoodBakery WordPress theme before 2.2 did not properly sanitize the foodbakery_radius parameter befo… |
CVE-2021-24388 | Medium | 5.4 | 2021-07-06 | In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the fields that the use… |
CVE-2021-24387 | Medium | 6.1 | 2021-07-06 | The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back… |
CVE-2021-24386 | Medium | 5.4 | 2021-07-06 | The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malici… |
CVE-2021-24384 | Critical | 9.8 | 2021-07-06 | The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised u… |
CVE-2021-24375 | Critical | 9.8 | 2021-07-06 | Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor Word… |
CVE-2021-24005 | Medium | 4.0 | 2021-07-06 | Usage of hard-coded cryptographic keys to encrypt configuration files and debug logs in FortiAuthenticator versions before 6.3.0 may allow an attacker with acc… |
CVE-2021-32233 | Medium | 6.1 | 2021-07-06 | SmarterTools SmarterMail before Build 7776 allows XSS. |
CVE-2021-36158 | Medium | 5.9 | 2021-07-05 | In the xrdp package (in branches through 3.14) for Alpine Linux, RDP sessions are vulnerable to man-in-the-middle attacks because pre-generated RSA certificate… |
CVE-2021-35331 | High | 7.8 | 2021-07-05 | In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance… |
CVE-2021-23401 | Medium | 5.4 | 2021-07-05 | This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect a user to an arbit… |
CVE-2021-33192 | Medium | 6.1 | 2021-07-05 | A vulnerability in the HTML pages of Apache Jena Fuseki allows an attacker to execute arbitrary javascript on certain page views. This issue affects Apache Jen… |
CVE-2021-36148 | High | 7.8 | 2021-07-02 | An issue was discovered in ACRN before 2.5. dmar_free_irte in hypervisor/arch/x86/vtd.c allows an irte_alloc_bitmap buffer overflow. |
CVE-2021-36147 | High | 7.5 | 2021-07-02 | An issue was discovered in ACRN before 2.5. It allows a devicemodel/hw/pci/virtio/virtio_net.c virtio_net_ping_rxq NULL pointer dereference for vq->used. |
CVE-2021-36146 | High | 7.5 | 2021-07-02 | ACRN before 2.5 has a devicemodel/hw/pci/xhci.c NULL Pointer Dereference for a trb pointer. |
CVE-2021-36145 | High | 7.5 | 2021-07-02 | The Device Model in ACRN through 2.5 has a devicemodel/core/mem.c use-after-free for a freed rb_entry. |
CVE-2021-36144 | High | 7.5 | 2021-07-02 | The polling timer handler in ACRN before 2.5 has a use-after-free for a freed virtio device, related to devicemodel/hw/pci/virtio/*.c. |
CVE-2021-36143 | High | 7.5 | 2021-07-02 | ACRN before 2.5 has a hw/pci/virtio/virtio.c vq_endchains NULL Pointer Dereference. |
CVE-2021-34527 | High | 8.8 | 2021-07-02 | A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfull… |
CVE-2021-35209 | Critical | 9.8 | 2021-07-02 | An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16. The… |
CVE-2021-35208 | Medium | 5.4 | 2021-07-02 | An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could plac… |
CVE-2021-35207 | Medium | 6.1 | 2021-07-02 | An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login compon… |
CVE-2021-34807 | Medium | 6.1 | 2021-07-02 | An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an attacker would need t… |
CVE-2021-33889 | Medium | 6.8 | 2021-07-02 | OpenThread wpantund through 2021-07-02 has a stack-based Buffer Overflow because of an inconsistency in the integer data type for metric_len. |
CVE-2021-32738 | Medium | 6.5 | 2021-07-02 | js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The `Utils.readChallengeTx` function used in SEP-10 Stellar Web Authent… |
CVE-2021-30557 | High | 8.8 | 2021-07-02 | Use after free in TabGroups in Google Chrome prior to 91.0.4472.114 allowed an attacker who convinced a user to install a malicious extension to potentially ex… |
CVE-2021-30556 | High | 8.8 | 2021-07-02 | Use after free in WebAudio in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30555 | High | 8.8 | 2021-07-02 | Use after free in Sharing in Google Chrome prior to 91.0.4472.114 allowed an attacker who convinced a user to install a malicious extension to potentially expl… |
CVE-2021-30554 | High | 8.8 | 2021-07-02 | Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-32737 | High | 8.4 | 2021-07-02 | Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin… |
CVE-2021-31874 | Medium | 5.9 | 2021-07-02 | Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database applica… |
CVE-2021-23403 | High | 7.3 | 2021-07-02 | All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input. |
CVE-2021-32639 | High | 7.2 | 2021-07-02 | Emissary is a P2P-based, data-driven workflow engine. Emissary version 6.4.0 is vulnerable to Server-Side Request Forgery (SSRF). In particular, the `RegisterP… |
CVE-2021-23402 | High | 7.3 | 2021-07-02 | All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality. |
CVE-2021-32735 | High | 7.1 | 2021-07-02 | Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's `ListItem` component (used in the pages and files section for example)… |
CVE-2021-27950 | High | 8.8 | 2021-07-02 | A SQL injection vulnerability in azurWebEngine in Sita AzurCMS through 1.2.3.12 allows an authenticated attacker to execute arbitrary SQL commands via the id p… |
CVE-2021-3613 | High | 7.8 | 2021-07-02 | OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows… |
CVE-2021-3606 | High | 7.8 | 2021-07-02 | OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which all… |
CVE-2021-36132 | High | 8.8 | 2021-07-02 | An issue was discovered in the FileImporter extension in MediaWiki through 1.36. For certain relaxed configurations of the $wgFileImporterRequiredRight variabl… |
CVE-2021-36131 | Medium | 4.8 | 2021-07-02 | An XSS issue was discovered in the SportsTeams extension in MediaWiki through 1.36. Within several special pages, a privileged user could inject arbitrary HTML… |
CVE-2021-36130 | Medium | 4.8 | 2021-07-02 | An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36. Within several gift-related special pages, a privileged user with the awa… |
CVE-2021-36129 | Medium | 4.3 | 2021-07-02 | An issue was discovered in the Translate extension in MediaWiki through 1.36. The Aggregategroups Action API module does not validate the parameter for aggrega… |
CVE-2021-36128 | Critical | 9.8 | 2021-07-02 | An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. Autoblocks for CentralAuth-issued suppression blocks are not properly implement… |
CVE-2021-36127 | Medium | 4.3 | 2021-07-02 | An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalUserRights page provided search results which, for a suppress… |
CVE-2021-36126 | Critical | 9.8 | 2021-07-02 | An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. If the MediaWiki:Abusefilter-blocker message is invalid within the content lang… |
CVE-2021-36125 | High | 7.5 | 2021-07-02 | An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalRenameRequest page is vulnerable to infinite loops and denial… |
CVE-2021-35197 | High | 7.5 | 2021-07-02 | In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "… |
CVE-2021-35029 | Critical | 9.8 | 2021-07-02 | An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP… |
CVE-2021-27455 | Medium | 5.5 | 2021-07-02 | Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read while processing project files, which may allow an attacker to d… |