2021 CVEs (page 160)
Page 160 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-32731 | Medium | 5.3 | 2021-07-01 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13.1RC1 and 13.1, the… |
CVE-2021-32730 | Medium | 5.7 | 2021-07-01 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulnerability exists in v… |
CVE-2021-32729 | Low | 2.0 | 2021-07-01 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 1… |
CVE-2021-28424 | Medium | 5.4 | 2021-07-01 | A stored cross-site scripting (XSS) vulnerability in Teachers Record Management System 1.0 allows remote authenticated users to inject arbitrary web script or… |
CVE-2021-28423 | High | 8.8 | 2021-07-01 | Multiple SQL Injection vulnerabilities in Teachers Record Management System 1.0 thru 2.1 allow remote authenticated users to execute arbitrary SQL commands via… |
CVE-2021-28127 | High | 7.5 | 2021-07-01 | An issue was discovered in Stormshield SNS through 4.2.1. A brute-force attack can occur. |
CVE-2021-35337 | Medium | 4.3 | 2021-07-01 | Sourcecodester Phone Shop Sales Managements System 1.0 is vulnerable to Insecure Direct Object Reference (IDOR). Any attacker will be able to see the invoices… |
CVE-2021-27661 | High | 8.8 | 2021-07-01 | Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level… |
CVE-2021-27660 | High | 8.8 | 2021-07-01 | An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs. |
CVE-2021-35336 | Critical | 9.8 | 2021-07-01 | Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control. A vulnerability in the Tieline Web Administrative Interface could allow an… |
CVE-2021-27477 | High | 7.5 | 2021-07-01 | When JTEKT Corporation TOYOPUC PLC versions PC10G-CPU, 2PORT-EFR, Plus CPU, Plus EX, Plus EX2, Plus EFR, Plus EFR2, Plus 2P-EFR, PC10P-DP, PC10P-DP-IO, Plus BU… |
CVE-2021-31813 | Medium | 5.4 | 2021-07-01 | Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD. |
CVE-2021-22344 | Medium | 5.3 | 2021-07-01 | There is an Improper Access Control vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause temporary DoS. |
CVE-2021-22343 | Critical | 9.1 | 2021-07-01 | There is a Configuration Defect vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service integrity and availability. |
CVE-2021-22347 | Medium | 5.3 | 2021-07-01 | There is an Improper Access Control vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause temporary DoS. |
CVE-2021-20778 | High | 7.5 | 2021-07-01 | Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive informatio… |
CVE-2021-20752 | Medium | 6.1 | 2021-07-01 | Cross-site scripting vulnerability in IkaIka RSS Reader all versions allows a remote attacker to inject an arbitrary script via unspecified vectors. |
CVE-2021-36089 | High | 7.8 | 2021-07-01 | Grok 7.6.6 through 9.2.0 has a heap-based buffer overflow in grk::FileFormatDecompress::apply_palette_clr (called from grk::FileFormatDecompress::applyColour). |
CVE-2021-36088 | Critical | 9.8 | 2021-07-01 | Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do). |
CVE-2021-36087 | Low | 3.3 | 2021-07-01 | The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there… |
CVE-2021-36086 | Low | 3.3 | 2021-07-01 | The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list). |
CVE-2021-36085 | Low | 3.3 | 2021-07-01 | The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map). |
CVE-2021-36084 | Low | 3.3 | 2021-07-01 | The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper). |
CVE-2021-36083 | Medium | 5.5 | 2021-07-01 | KDE KImageFormats 5.70.0 through 5.81.0 has a stack-based buffer overflow in XCFImageFormat::loadTileRLE. |
CVE-2021-36082 | High | 8.8 | 2021-07-01 | ntop nDPI 3.4 has a stack-based buffer overflow in processClientServerHello. |
CVE-2021-36081 | High | 7.8 | 2021-07-01 | Tesseract OCR 5.0.0-alpha-20201231 has a one_ell_conflict use-after-free during a strpbrk call. |
CVE-2021-36080 | High | 8.8 | 2021-07-01 | GNU LibreDWG 0.12.3.4163 through 0.12.3.4191 has a double-free in bit_chain_free (called from dwg_encode_MTEXT and dwg_encode_add_object). |
CVE-2021-28804 | Critical | 9.8 | 2021-07-01 | A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary comm… |
CVE-2021-28803 | Medium | 5.4 | 2021-07-01 | This issue affects: QNAP Systems Inc. Q'center versions prior to 1.11.1004. |
CVE-2021-28802 | Critical | 9.8 | 2021-07-01 | A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary comm… |
CVE-2021-22345 | Critical | 9.8 | 2021-06-30 | There is an Input Verification Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause out-of-bounds memory write. |
CVE-2021-22352 | High | 7.8 | 2021-06-30 | There is a Configuration Defect Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may allow attackers to hijack the device and… |
CVE-2021-22351 | High | 8.1 | 2021-06-30 | There is a Credentials Management Errors Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may induce users to grant permission… |
CVE-2021-22350 | High | 7.5 | 2021-06-30 | There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause the device to cra… |
CVE-2021-22349 | High | 7.5 | 2021-06-30 | There is an Input Verification Vulnerability in Huawei Smartphone. Successful exploitation of insufficient input verification may cause the system to restart. |
CVE-2021-22348 | Critical | 9.8 | 2021-06-30 | There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause code to execute. |
CVE-2021-22346 | Medium | 5.3 | 2021-06-30 | There is an Improper Permission Management Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may lead to the disclosure of user… |
CVE-2021-34075 | Medium | 5.9 | 2021-06-30 | In Artica Pandora FMS <=754 in the File Manager component, there is sensitive information exposed on the client side which attackers can access. |
CVE-2021-32736 | High | 7.5 | 2021-06-30 | think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an upstream component… |
CVE-2021-22368 | High | 7.5 | 2021-06-30 | There is a Permission Control Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect normal use of the device. |
CVE-2021-22367 | Critical | 9.8 | 2021-06-30 | There is a Key Management Errors Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may lead to authentication bypass. |
CVE-2021-22354 | Critical | 9.1 | 2021-06-30 | There is an Information Disclosure Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause out-of-bounds read. |
CVE-2021-22353 | High | 7.5 | 2021-06-30 | There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause the kernel to res… |
CVE-2021-21676 | Medium | 4.3 | 2021-06-30 | Jenkins requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to se… |
CVE-2021-21675 | Medium | 6.5 | 2021-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins requests-plugin Plugin 2.2.12 and earlier allows attackers to create requests and/or have administ… |
CVE-2021-21674 | Medium | 4.3 | 2021-06-30 | A missing permission check in Jenkins requests-plugin Plugin 2.2.6 and earlier allows attackers with Overall/Read permission to view the list of pending reques… |
CVE-2021-21673 | Medium | 6.1 | 2021-06-30 | Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform p… |
CVE-2021-21672 | Medium | 4.3 | 2021-06-30 | Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21671 | High | 7.5 | 2021-06-30 | Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login. |
CVE-2021-21670 | Medium | 4.3 | 2021-06-30 | Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even… |
CVE-2021-35973 | Critical | 9.8 | 2021-06-30 | NETGEAR WAC104 devices before 1.0.4.15 are affected by an authentication bypass vulnerability in /usr/sbin/mini_httpd, allowing an unauthenticated attacker to… |
CVE-2021-35971 | Critical | 9.8 | 2021-06-30 | Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft .NET remoting. |
CVE-2021-35970 | High | 7.5 | 2021-06-30 | Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permission checks use an… |
CVE-2021-22374 | High | 7.5 | 2021-06-30 | There is an Improper Validation of Array Index Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause stability risks. |
CVE-2021-22373 | Critical | 9.1 | 2021-06-30 | There is a Defects Introduced in the Design Process Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service integr… |
CVE-2021-22371 | High | 7.5 | 2021-06-30 | There is an Improper Permission Management Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-22369 | High | 8.1 | 2021-06-30 | There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Huawei Smartphone. Successful exploitation of these vulnerabilities may escalate… |
CVE-2021-22323 | Critical | 9.8 | 2021-06-30 | There is an Integer Overflow Vulnerability in Huawei Smartphone. Successful exploitation of these vulnerabilities may escalate the permission to that of the ro… |
CVE-2021-3630 | Medium | 5.5 | 2021-06-30 | An out-of-bounds write vulnerability was found in DjVuLibre in DJVU::DjVuTXT::decode() in DjVuText.cpp via a crafted djvu file which may lead to crash and segm… |
CVE-2021-22380 | Critical | 9.1 | 2021-06-30 | There is a Cleartext Transmission of Sensitive Information Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service… |
CVE-2021-22376 | High | 8.4 | 2021-06-30 | A component of the HarmonyOS has a Improper Privilege Management vulnerability. Local attackers may exploit this vulnerability to bypass user restrictions. |
CVE-2021-22375 | Critical | 9.8 | 2021-06-30 | There is a Key Management Errors Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service confidentiality,availabil… |
CVE-2021-22372 | High | 7.5 | 2021-06-30 | There is a Security Features Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-22370 | High | 7.5 | 2021-06-30 | There is a Credentials Management Errors Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-22326 | High | 7.1 | 2021-06-30 | A component of the HarmonyOS has a Privilege Dropping / Lowering Errors vulnerability. Local attackers may exploit this vulnerability to obtain Kernel space re… |
CVE-2021-20461 | Medium | 6.5 | 2021-06-30 | IBM Cognos Analytics 10.0 and 11.1 is susceptible to a weakness in the implementation of the System Appearance configuration setting. An attacker could potenti… |
CVE-2021-20107 | Medium | 5.4 | 2021-06-30 | There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers including SOLIS. The vuln… |
CVE-2021-28993 | High | 7.5 | 2021-06-30 | Plixer Scrutinizer 19.0.2 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). |
CVE-2021-35956 | Medium | 5.4 | 2021-06-30 | Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbit… |
CVE-2021-27903 | Critical | 9.8 | 2021-06-30 | An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restric… |
CVE-2021-27902 | Medium | 6.1 | 2021-06-30 | An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepte… |
CVE-2021-25951 | High | 7.5 | 2021-06-30 | XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service. |
CVE-2021-34385 | Medium | 6.3 | 2021-06-30 | Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the calculation of a length could lead to a heap overflow. |
CVE-2021-34384 | Medium | 6.3 | 2021-06-30 | Bootloader contains a vulnerability in NVIDIA MB2 where a potential heap overflow could cause memory corruption, which might lead to denial of service or code… |
CVE-2021-34383 | Medium | 6.4 | 2021-06-30 | Bootloader contains a vulnerability in NVIDIA MB2 where a potential heap overflow might lead to denial of service or escalation of privileges. |
CVE-2021-34382 | Medium | 6.7 | 2021-06-30 | Trusty TLK contains a vulnerability in the NVIDIA TLK kernel’s tz_map_shared_mem function where an integer overflow on the size parameter causes the request bu… |
CVE-2021-34381 | Medium | 6.7 | 2021-06-30 | Trusty TLK contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an integer overflow on the size paramet… |
CVE-2021-34380 | High | 7.0 | 2021-06-30 | Bootloader contains a vulnerability in NVIDIA MB2 where potential heap overflow might cause corruption of the heap metadata, which might lead to arbitrary code… |
CVE-2021-34379 | High | 7.7 | 2021-06-30 | Trusty contains a vulnerability in the HDCP service TA where bounds checking in command 10 is missing. The length of an I/O buffer parameter is not checked, wh… |
CVE-2021-34378 | High | 7.7 | 2021-06-30 | Trusty contains a vulnerability in the HDCP service TA where bounds checking in command 11 is missing. Improper restriction of operations within the bounds of… |
CVE-2021-34377 | High | 7.7 | 2021-06-30 | Trusty contains a vulnerability in the HDCP service TA where bounds checking in command 9 is missing. Improper restriction of operations within the bounds of a… |
CVE-2021-34376 | High | 7.7 | 2021-06-30 | Trusty contains a vulnerability in the HDCP service TA where bounds checking in command 5 is missing. Improper restriction of operations within the bounds of a… |
CVE-2021-34375 | High | 7.7 | 2021-06-30 | Trusty contains a vulnerability in all trusted applications (TAs) where the stack cookie was not randomized, which might result in stack-based buffer overflow… |
CVE-2021-34374 | High | 7.7 | 2021-06-30 | Trusty contains a vulnerability in command handlers where the length of input buffers is not verified. This vulnerability can cause memory corruption, which ma… |
CVE-2021-34373 | High | 7.9 | 2021-06-30 | Trusty trusted Linux kernel (TLK) contains a vulnerability in the NVIDIA TLK kernel where a lack of heap hardening could cause heap overflows, which might lead… |
CVE-2021-31721 | Medium | 6.1 | 2021-06-30 | Chevereto before 3.17.1 allows Cross Site Scripting (XSS) via an image title at the image upload stage. |
CVE-2021-30648 | Critical | 9.8 | 2021-06-30 | The Symantec Advanced Secure Gateway (ASG) and ProxySG web management consoles are susceptible to an authentication bypass vulnerability. An unauthenticated at… |
CVE-2021-28693 | Medium | 5.5 | 2021-06-30 | xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary area before they are copied by Xen to e… |
CVE-2021-28692 | High | 7.1 | 2021-06-30 | inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issuing such commands… |
CVE-2021-25321 | High | 7.8 | 2021-06-30 | A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud C… |
CVE-2021-35474 | Critical | 9.8 | 2021-06-30 | Stack-based Buffer Overflow vulnerability in cachekey plugin of Apache Traffic Server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1… |
CVE-2021-32567 | High | 7.5 | 2021-06-30 | Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server 7.0.0… |
CVE-2021-32566 | High | 7.5 | 2021-06-30 | Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server 7.0.0… |
CVE-2021-35959 | Medium | 5.4 | 2021-06-30 | In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the descripti… |
CVE-2021-35958 | Critical | 9.1 | 2021-06-30 | TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.get_file is used with extract=True. NOTE: the… |
CVE-2021-35941 | High | 7.5 | 2021-06-29 | Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all versions) have an administrator API that can perform a system factory restore with… |
CVE-2021-22341 | Medium | 4.9 | 2021-06-29 | There is a memory leak vulnerability in Huawei products. A resource management weakness exists in a module. Attackers with high privilege can exploit this vuln… |
CVE-2021-22329 | Medium | 4.9 | 2021-06-29 | There has a license management vulnerability in some Huawei products. An attacker with high privilege needs to perform specific operations to exploit the vulne… |
CVE-2021-32721 | Medium | 4.7 | 2021-06-29 | PowerMux is a drop-in replacement for Go's http.ServeMux. In PowerMux versions prior to 1.1.1, attackers may be able to craft phishing links and other open red… |
CVE-2021-29485 | Critical | 9.9 | 2021-06-29 | Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a malicious attacker can achieve Remote Code Execution (RCE) via a maliciously… |