2021 CVEs (page 161)
Page 161 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-29481 | Medium | 6.5 | 2021-06-29 | Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in unencrypted, but s… |
CVE-2021-29480 | Medium | 4.4 | 2021-06-29 | Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup time as the signing… |
CVE-2021-22439 | High | 8.1 | 2021-06-29 | There is a deserialization vulnerability in Huawei AnyOffice V200R006C10. An attacker can construct a specific request to exploit this vulnerability. Successfu… |
CVE-2021-22340 | Medium | 4.1 | 2021-06-29 | There is a multiple threads race condition vulnerability in Huawei product. A race condition exists for concurrent I/O read by multiple threads. An attacker wi… |
CVE-2021-22338 | Medium | 5.3 | 2021-06-29 | There is an XXE injection vulnerability in eCNS280 V100R005C00 and V100R005C10. A module does not perform the strict operation to the input XML message. Attack… |
CVE-2021-20079 | Medium | 6.7 | 2021-06-29 | Nessus versions 8.13.2 and earlier were found to contain a privilege escalation vulnerability which could allow a Nessus administrator user to upload a special… |
CVE-2021-28830 | High | 8.8 | 2021-06-29 | The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterpr… |
CVE-2021-23275 | High | 8.8 | 2021-06-29 | The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, T… |
CVE-2021-22119 | High | 7.5 | 2021-06-29 | Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (Do… |
CVE-2021-21871 | High | 7.8 | 2021-06-29 | A memory corruption vulnerability exists in the DMG File Format Handler functionality of PowerISO 7.9. A specially crafted DMG file can lead to an out-of-bound… |
CVE-2021-20580 | Medium | 4.3 | 2021-06-29 | IBM Planning Analytics 2.0 could be vulnerable to cross-site request forgery (CSRF) which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2021-20490 | Medium | 5.5 | 2021-06-29 | IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a local user to cause a denial of service due to insecure file permission settings. IBM X-Force ID… |
CVE-2021-20477 | Medium | 5.4 | 2021-06-29 | IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2021-20105 | Medium | 6.1 | 2021-06-29 | Machform prior to version 16 is vulnerable to an open redirect in Safari_init.php due to an improperly sanitized 'ref' parameter. |
CVE-2021-20104 | High | 8.1 | 2021-06-29 | Machform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of file attachments uploaded with forms th… |
CVE-2021-20103 | Medium | 6.1 | 2021-06-29 | Machform prior to version 16 is vulnerable to stored cross-site scripting due to insufficient sanitization of file attachments uploaded with forms through uplo… |
CVE-2021-20102 | High | 8.8 | 2021-06-29 | Machform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place. |
CVE-2021-20101 | Medium | 6.1 | 2021-06-29 | Machform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers. This could cause a victim to receive malform… |
CVE-2021-32992 | Critical | 9.8 | 2021-06-29 | FATEK Automation WinProladder Versions 3.30 and prior do not properly restrict operations within the bounds of a memory buffer, which may allow an attacker to… |
CVE-2021-32990 | Critical | 9.8 | 2021-06-29 | FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code. |
CVE-2021-32988 | Critical | 9.8 | 2021-06-29 | FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code. |
CVE-2021-31516 | High | 7.8 | 2021-06-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID 88f343c3). User int… |
CVE-2021-31515 | High | 7.8 | 2021-06-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID 88f343c3). User int… |
CVE-2021-31514 | High | 7.8 | 2021-06-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is… |
CVE-2021-31513 | High | 7.8 | 2021-06-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is… |
CVE-2021-31512 | High | 7.8 | 2021-06-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is… |
CVE-2021-31511 | High | 7.8 | 2021-06-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is… |
CVE-2021-31510 | High | 7.8 | 2021-06-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is… |
CVE-2021-31509 | High | 7.8 | 2021-06-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31508 | High | 7.8 | 2021-06-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31507 | High | 7.8 | 2021-06-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31506 | Low | 3.3 | 2021-06-29 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interac… |
CVE-2021-31505 | Medium | 6.8 | 2021-06-29 | This vulnerability allows attackers with physical access to escalate privileges on affected installations of Arlo Q Plus 1.9.0.3_278. Authentication is not req… |
CVE-2021-29479 | High | 7.0 | 2021-06-29 | Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to perform cache poisonin… |
CVE-2021-34824 | High | 8.8 | 2021-06-29 | Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule crede… |
CVE-2021-31531 | Critical | 9.8 | 2021-06-29 | Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF). |
CVE-2021-31530 | High | 7.5 | 2021-06-29 | Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure. |
CVE-2021-31160 | High | 7.5 | 2021-06-29 | Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data. |
CVE-2021-34550 | High | 7.5 | 2021-06-29 | An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client cra… |
CVE-2021-34549 | High | 7.5 | 2021-06-29 | An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can t… |
CVE-2021-32565 | High | 7.5 | 2021-06-29 | Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 7.0… |
CVE-2021-28691 | High | 7.8 | 2021-06-29 | Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the… |
CVE-2021-28690 | Medium | 6.5 | 2021-06-29 | x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security vulnerability. Please see https://xenbits… |
CVE-2021-27577 | High | 7.5 | 2021-06-29 | Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0… |
CVE-2021-23400 | Medium | 6.3 | 2021-06-29 | The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed… |
CVE-2021-22545 | High | 7.5 | 2021-06-29 | An attacker can craft a specific IdaPro *.i64 file that will cause the BinDiff plugin to load an invalid memory offset. This can allow the attacker to control… |
CVE-2021-34548 | High | 7.5 | 2021-06-29 | An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for… |
CVE-2021-33503 | High | 7.5 | 2021-06-29 | An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expre… |
CVE-2021-31838 | High | 8.4 | 2021-06-29 | A command injection vulnerability in MVISION EDR (MVEDR) prior to 3.4.0 allows an authenticated MVEDR administrator to trigger the EDR client to execute arbitr… |
CVE-2021-1134 | High | 7.4 | 2021-06-29 | A vulnerability in the Cisco Identity Services Engine (ISE) integration feature of the Cisco DNA Center Software could allow an unauthenticated, remote attacke… |
CVE-2021-35303 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute. |
CVE-2021-35302 | Medium | 5.3 | 2021-06-28 | Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information. |
CVE-2021-35301 | Medium | 5.3 | 2021-06-28 | Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view. |
CVE-2021-35300 | Medium | 4.3 | 2021-06-28 | Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page. |
CVE-2021-35299 | High | 7.5 | 2021-06-28 | Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing. |
CVE-2021-35298 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note… |
CVE-2021-32723 | High | 7.4 | 2021-06-28 | Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to high… |
CVE-2021-32722 | Medium | 6.5 | 2021-06-28 | GlobalNewFiles is a mediawiki extension. Versions prior to 48be7adb70568e20e961ea1cb70904454a671b1d are affected by an uncontrolled resource consumption vulner… |
CVE-2021-32720 | Medium | 5.3 | 2021-06-28 | Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details (order ID, order numbe… |
CVE-2021-35525 | Medium | 5.3 | 2021-06-28 | PostSRSd before 1.11 allows a denial of service (subprocess hang) if Postfix sends certain long data fields such as multiple concatenated email addresses. NOTE… |
CVE-2021-35523 | High | 7.8 | 2021-06-28 | Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-… |
CVE-2021-34254 | Medium | 6.1 | 2021-06-28 | Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx. |
CVE-2021-34187 | Critical | 9.8 | 2021-06-28 | main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter. |
CVE-2021-32719 | Low | 3.1 | 2021-06-28 | RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI v… |
CVE-2021-29775 | Medium | 5.4 | 2021-06-28 | IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scripting. This vulnera… |
CVE-2021-29751 | Medium | 4.3 | 2021-06-28 | IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive inform… |
CVE-2021-29693 | Medium | 4.4 | 2021-06-28 | IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user that is in the with elevated group privileges to cause a denial of service due to a vulnerability in th… |
CVE-2021-20574 | High | 8.8 | 2021-06-28 | IBM Security Identity Manager Adapters 6.0 and 7.0 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted reque… |
CVE-2021-20573 | Medium | 6.5 | 2021-06-28 | IBM Security Identity Manager Adapters 6.0 and 7.0 are vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote authenticated a… |
CVE-2021-20572 | Medium | 6.5 | 2021-06-28 | IBM Security Identity Manager Adapters 6.0 and 7.0 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A remote authenticated… |
CVE-2021-20494 | Medium | 6.5 | 2021-06-28 | IBM Security Identity Manager Adapters 6.0 and 7.0 are vulnerable to a heap based buffer overflow, caused by improper bounds. An authenticared user could overf… |
CVE-2021-20413 | Medium | 4.3 | 2021-06-28 | IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in… |
CVE-2021-35456 | Critical | 9.8 | 2021-06-28 | Online Pet Shop We App 1.0 is vulnerable to remote SQL injection and shell upload |
CVE-2021-32718 | Low | 3.1 | 2021-06-28 | RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's ba… |
CVE-2021-28623 | Medium | 5.5 | 2021-06-28 | Adobe Premiere Elements version 5.2 (and earlier) is affected by an insecure temporary file creation vulnerability. An unauthenticated attacker could leverage… |
CVE-2021-28597 | Medium | 5.5 | 2021-06-28 | Adobe Photoshop Elements version 5.2 (and earlier) is affected by an insecure temporary file creation vulnerability. An unauthenticated attacker could leverage… |
CVE-2021-28588 | High | 8.8 | 2021-06-28 | Adobe RoboHelp Server version 2019.0.9 (and earlier) is affected by a Path Traversal vulnerability when parsing a crafted HTTP POST request. An authenticated a… |
CVE-2021-28579 | Medium | 4.3 | 2021-06-28 | Adobe Connect version 11.2.1 (and earlier) is affected by an Improper access control vulnerability that can lead to the elevation of privileges. An attacker wi… |
CVE-2021-28587 | Low | 3.3 | 2021-06-28 | After Effects versions 18.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker co… |
CVE-2021-28586 | High | 7.8 | 2021-06-28 | After Effects version 18.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of t… |
CVE-2021-28585 | Medium | 5.3 | 2021-06-28 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper input validation vulnerability in the New c… |
CVE-2021-28584 | Medium | 5.4 | 2021-06-28 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store wi… |
CVE-2021-28583 | High | 7.5 | 2021-06-28 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Violation of Secure Design Principles vulnerability i… |
CVE-2021-28576 | Medium | 4.3 | 2021-06-28 | Adobe Animate version 21.0.5 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacke… |
CVE-2021-28575 | Medium | 4.3 | 2021-06-28 | Adobe Animate version 21.0.5 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacke… |
CVE-2021-28574 | Medium | 4.3 | 2021-06-28 | Adobe Animate version 21.0.5 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacke… |
CVE-2021-28573 | Medium | 4.3 | 2021-06-28 | Adobe Animate version 21.0.5 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacke… |
CVE-2021-28570 | High | 8.3 | 2021-06-28 | Adobe After Effects version 18.1 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An unauthenticated attacker could exploit this… |
CVE-2021-28563 | Medium | 6.5 | 2021-06-28 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create… |
CVE-2021-28562 | High | 8.8 | 2021-06-28 | Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Fre… |
CVE-2021-28556 | Medium | 6.9 | 2021-06-28 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-… |
CVE-2021-21102 | High | 8.8 | 2021-06-28 | Adobe Illustrator version 25.2 (and earlier) is affected by a Path Traversal vulnerability when parsing a specially crafted file. An unauthenticated attacker c… |
CVE-2021-21101 | High | 8.8 | 2021-06-28 | Adobe Illustrator version 25.2 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated atta… |
CVE-2021-21099 | High | 8.8 | 2021-06-28 | Adobe InDesign version 16.0 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could le… |
CVE-2021-21098 | High | 8.8 | 2021-06-28 | Adobe InDesign version 16.0 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could le… |
CVE-2021-21090 | High | 8.8 | 2021-06-28 | Adobe InCopy version 16.0 (and earlier) is affected by an path traversal vulnerability when parsing a crafted file. An unauthenticated attacker could leverage… |
CVE-2021-21084 | High | 7.3 | 2021-06-28 | AEM's Cloud Service offering, as well as versions 6.5.7.0 (and below), 6.4.8.3 (and below) and 6.3.3.8 (and below) are affected by a stored Cross-Site Scriptin… |
CVE-2021-21083 | High | 7.5 | 2021-06-28 | AEM's Cloud Service offering, as well as versions 6.5.7.0 (and below), 6.4.8.3 (and below) and 6.3.3.8 (and below) are affected by an Improper Access Control v… |
CVE-2021-33515 | Medium | 4.8 | 2021-06-28 | The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlle… |
CVE-2021-31337 | Critical | 9.8 | 2021-06-28 | The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow a remote attacker t… |