2021 CVEs (page 16)
Page 16 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-4407 | Medium | 4.3 | 2023-07-12 | The Custom Banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.2 This is due to missing or incorrect… |
CVE-2021-4406 | Critical | 9.1 | 2023-07-10 | An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITSM tab * add a we… |
CVE-2021-42083 | High | 8.7 | 2023-07-10 | An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITSM tab * add a we… |
CVE-2021-42082 | High | 7.8 | 2023-07-10 | Local users are able to execute scripts under root privileges. POC On the local host run the following command: curl 'localhost:8154/qstor/qs_upgrade.py?tas… |
CVE-2021-42081 | Critical | 9.1 | 2023-07-10 | An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API. POC http://<IP_ADDRESS>/qstorapi/storageSystemModify?stora… |
CVE-2021-42080 | High | 7.4 | 2023-07-10 | An attacker is able to launch a Reflected XSS attack using a crafted URL. POC: Visit the following URL https://<IPADDRESS>:8153/qstorapi/echo?inputMessage=<i… |
CVE-2021-42079 | Medium | 6.2 | 2023-07-10 | An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests. POC Step 1: Prepar… |
CVE-2021-39014 | Medium | 6.4 | 2023-07-07 | IBM Cloud Object System 3.15.8.97 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2021-32495 | Critical | 10.0 | 2023-07-07 | Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function. Attacker can read freed memory afterwards. This will allow attackers to ca… |
CVE-2021-32494 | Critical | 10.0 | 2023-07-07 | Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function. This allow attackers to create malicious inputs that can cause denial o… |
CVE-2021-33798 | Medium | 4.7 | 2023-07-07 | A null pointer dereference was found in libpano13, version libpano13-2.9.20. The flow allows attackers to cause a denial of service and potential code execute… |
CVE-2021-33796 | Critical | 10.0 | 2023-07-07 | In MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service. |
CVE-2021-46896 | High | 7.5 | 2023-07-06 | Buffer Overflow vulnerability in PX4-Autopilot allows attackers to cause a denial of service via handler function handling msgid 332. |
CVE-2021-46894 | Critical | 9.8 | 2023-07-06 | Use After Free (UAF) vulnerability in the uinput module.Successful exploitation of this vulnerability may lead to kernel privilege escalation. |
CVE-2021-46892 | High | 7.5 | 2023-07-06 | Encryption bypass vulnerability in Maintenance mode. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-46893 | High | 7.5 | 2023-07-05 | Vulnerability of unstrict data verification and parameter check. Successful exploitation of this vulnerability may affect integrity. |
CVE-2021-46891 | Critical | 9.8 | 2023-07-05 | Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this vulnerability may affect service confiden… |
CVE-2021-46890 | Critical | 9.8 | 2023-07-05 | Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this vulnerability may affect service confiden… |
CVE-2021-4405 | Medium | 4.3 | 2023-07-01 | The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. This is due to missing or incorrect… |
CVE-2021-4404 | Medium | 4.3 | 2023-07-01 | The Event Espresso 4 Decaf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.11. This is due to missing o… |
CVE-2021-4403 | Medium | 4.3 | 2023-07-01 | The Remove Schema plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect n… |
CVE-2021-4402 | Medium | 4.3 | 2023-07-01 | The Multiple Roles plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.1. This is due to missing or incorrec… |
CVE-2021-4401 | High | 8.8 | 2023-07-01 | The Style Kits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.0. This is due to missing or incorrect no… |
CVE-2021-4400 | Medium | 4.3 | 2023-07-01 | The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This is due to missing or incorrect… |
CVE-2021-4399 | Medium | 4.3 | 2023-07-01 | The Edwiser Bridge plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,2.0.6. This is due to missing or incorrect… |
CVE-2021-4398 | Medium | 4.3 | 2023-07-01 | The Amministrazione Trasparente plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.1. This is due to missing… |
CVE-2021-4397 | Medium | 4.3 | 2023-07-01 | The Staff Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6. This is due to missing or in… |
CVE-2021-4396 | Medium | 4.3 | 2023-07-01 | The Rucy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.4.4. This is due to missing or incorrect nonce va… |
CVE-2021-4395 | Medium | 4.3 | 2023-07-01 | The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.4. This is d… |
CVE-2021-4394 | Medium | 4.3 | 2023-07-01 | The Locations plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.1. This is due to missing or incorrect non… |
CVE-2021-4393 | Medium | 4.3 | 2023-07-01 | The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.17. T… |
CVE-2021-4392 | Medium | 4.3 | 2023-07-01 | The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.43. T… |
CVE-2021-4391 | Medium | 4.3 | 2023-07-01 | The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due t… |
CVE-2021-4390 | Medium | 4.3 | 2023-07-01 | The Contact Form 7 Style plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2. This is due to missing or inco… |
CVE-2021-4389 | Medium | 4.3 | 2023-07-01 | The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6. This is due to missing or incorrect non… |
CVE-2021-4388 | Medium | 4.3 | 2023-07-01 | The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due to missing capabil… |
CVE-2021-4387 | Medium | 4.3 | 2023-07-01 | The Opal Estate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.11. This is due to missing or incorrect… |
CVE-2021-4386 | Medium | 4.3 | 2023-07-01 | The WP Security Question plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5. This is due to missing or in… |
CVE-2021-4385 | Medium | 4.3 | 2023-07-01 | The WP Private Content Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to missing or i… |
CVE-2021-4384 | Medium | 4.3 | 2023-07-01 | The WordPress Photo Gallery – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.6. This is d… |
CVE-2021-42307 | Medium | 4.3 | 2023-07-01 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2021-34506 | Medium | 6.1 | 2023-07-01 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2021-34475 | Medium | 5.4 | 2023-07-01 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2021-31982 | High | 8.8 | 2023-07-01 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2021-25828 | Medium | 6.1 | 2023-06-28 | Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web. |
CVE-2021-25827 | Critical | 9.8 | 2023-06-28 | Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address. |
CVE-2021-31937 | High | 8.2 | 2023-06-28 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2021-30205 | Medium | 5.3 | 2023-06-27 | Incorrect access control in the component /index.php?mod=system&op=orgtree of dzzoffice 2.02.1_SC_UTF8 allows unauthenticated attackers to browse departments a… |
CVE-2021-30203 | Medium | 6.1 | 2023-06-27 | A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers to execute arbitrary web scripts or HTM… |
CVE-2021-31635 | Critical | 9.8 | 2023-06-26 | Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function. |
CVE-2021-0945 | Critical | 9.8 | 2023-06-15 | In _PMRCreate of the PowerVR kernel driver, a missing bounds check means it is possible to overwrite heap memory via PhysmemNewRamBackedPMR. This could lead to… |
CVE-2021-0701 | Critical | 9.8 | 2023-06-15 | In PVRSRVBridgeSyncPrimOpCreate of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds he… |
CVE-2021-31280 | Medium | 6.1 | 2023-06-14 | An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the keywords parameter. |
CVE-2021-46889 | Medium | 6.1 | 2023-06-07 | The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291… |
CVE-2021-4380 | Critical | 9.8 | 2023-06-07 | The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_reques… |
CVE-2021-4379 | Medium | 6.5 | 2023-06-07 | The WooCommerce Multi Currency plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wmc_bulk_fixed_price functio… |
CVE-2021-4337 | High | 8.8 | 2023-06-07 | Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory f… |
CVE-2021-4383 | High | 8.1 | 2023-06-07 | The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due to missing capabil… |
CVE-2021-4382 | High | 8.8 | 2023-06-07 | The Recently plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the fetch_external_image() function in version… |
CVE-2021-4381 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing security nonce, in the Stm… |
CVE-2021-4378 | Medium | 6.4 | 2023-06-07 | The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5 due to insufficient input… |
CVE-2021-4377 | Medium | 6.5 | 2023-06-07 | The Doneren met Mollie plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.8.5 via the dmm_export_donations() fun… |
CVE-2021-4376 | Medium | 4.3 | 2023-06-07 | The WooCommerce Multi Currency plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.17. This makes it possible fo… |
CVE-2021-4375 | Medium | 4.3 | 2023-06-07 | The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the usces_download_system_information()… |
CVE-2021-4374 | Critical | 9.1 | 2023-06-07 | The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing author… |
CVE-2021-4373 | High | 8.8 | 2023-06-07 | The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This makes it possible for unauthen… |
CVE-2021-4372 | Medium | 6.5 | 2023-06-07 | The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.1. This i… |
CVE-2021-4371 | Medium | 4.3 | 2023-06-07 | The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Setting Changs in versions up to, and including, 5.5. This is due to lacking both a security… |
CVE-2021-4370 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security no… |
CVE-2021-4369 | Medium | 5.8 | 2023-06-07 | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and including, 18.2. This is due to lackin… |
CVE-2021-4368 | Critical | 9.9 | 2023-06-07 | The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 18.2. This is due to lacking ca… |
CVE-2021-4367 | Medium | 6.4 | 2023-06-07 | The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Options Change by using the flo_import_form… |
CVE-2021-4366 | Medium | 6.3 | 2023-06-07 | The PWA for WP & AMP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the pwaforwp_update_features_options func… |
CVE-2021-4365 | High | 7.2 | 2023-06-07 | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to, and including, 18.2. This is due… |
CVE-2021-4364 | Medium | 4.3 | 2023-06-07 | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_add_job_import_schedul… |
CVE-2021-4363 | Medium | 6.1 | 2023-06-07 | The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.5 due to insufficient inp… |
CVE-2021-4362 | Critical | 9.8 | 2023-06-07 | The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the kiwi_social_share_get_option() functi… |
CVE-2021-4361 | High | 8.8 | 2023-06-07 | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job_integrations_setti… |
CVE-2021-4360 | Critical | 9.9 | 2023-06-07 | The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting acce… |
CVE-2021-4359 | Medium | 6.5 | 2023-06-07 | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 18.2. This is due to… |
CVE-2021-4358 | High | 7.2 | 2023-06-07 | The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.1.23 d… |
CVE-2021-4357 | Critical | 9.1 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on the UlistingUserRole… |
CVE-2021-4356 | Critical | 9.0 | 2023-06-07 | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, 18.2. This is due t… |
CVE-2021-4355 | High | 7.5 | 2023-06-07 | The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the download_orderdetail_list(), change_o… |
CVE-2021-4354 | High | 8.8 | 2023-06-07 | The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwp_splashscreen_uploader function i… |
CVE-2021-4352 | Medium | 5.3 | 2023-06-07 | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_locsettings function in ver… |
CVE-2021-4351 | Medium | 5.8 | 2023-06-07 | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and including, 18.2. This is due to lacking… |
CVE-2021-4350 | High | 7.2 | 2023-06-07 | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and including, 18.2. This is due to lacking a… |
CVE-2021-4349 | High | 8.8 | 2023-06-07 | The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This makes it pos… |
CVE-2021-4348 | High | 7.5 | 2023-06-07 | The Ultimate GDPR & CCPA plugin for WordPress is vulnerable to unauthenticated settings import and export via the export_settings & import_settings functions i… |
CVE-2021-4347 | Critical | 9.9 | 2023-06-07 | The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenti… |
CVE-2021-4346 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions up to, and including, 1.6.6. This is due to missing lo… |
CVE-2021-4345 | Medium | 6.5 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability and nonce checks on the UlistingUserRole::save_role_api metho… |
CVE-2021-4344 | Medium | 6.4 | 2023-06-07 | The Frontend File Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 18.2. This is due to lacking mishandling… |
CVE-2021-4343 | Critical | 9.8 | 2023-06-07 | The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in versions up to, and including, 1.6.6. This is du… |
CVE-2021-4341 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to missing capability checks, missing input validation, and a missing secu… |
CVE-2021-4340 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to generic SQL Injection via the ‘listing_id’ parameter in versions up to, and including, 1.6.6 due to insuffic… |
CVE-2021-4339 | High | 7.5 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisting/includes/route.php" file on the /1/a… |
CVE-2021-4338 | Medium | 6.4 | 2023-06-07 | The 404 to 301 plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the open_redirect & save_redirect functions in ve… |
CVE-2021-33223 | High | 8.8 | 2023-06-07 | An issue discovered in SeedDMS 6.0.15 allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php file. |