2021 CVEs (page 162)
Page 162 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-35514 | Critical | 9.8 | 2021-06-28 | Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel. |
CVE-2021-32496 | Medium | 5.3 | 2021-06-28 | SICK Visionary-S CX up version 5.21.2.29154R are vulnerable to an Inadequate Encryption Strength vulnerability concerning the internal SSH interface solely use… |
CVE-2021-29157 | High | 7.5 | 2021-06-28 | Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation… |
CVE-2021-20100 | Medium | 6.7 | 2021-06-28 | Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities which could allow an authenticated, local… |
CVE-2021-20099 | Medium | 6.7 | 2021-06-28 | Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities which could allow an authenticated, local… |
CVE-2021-23399 | High | 7.3 | 2021-06-28 | This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function, it is possible for an attacker to execu… |
CVE-2021-20751 | Medium | 6.1 | 2021-06-28 | Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an… |
CVE-2021-20750 | Medium | 6.1 | 2021-06-28 | Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote at… |
CVE-2021-20749 | Medium | 5.4 | 2021-06-28 | Cross-site scripting vulnerability in Fudousan plugin ver5.7.0 and earlier, Fudousan Plugin Pro Single-User Type ver5.7.0 and earlier, and Fudousan Plugin Pro… |
CVE-2021-20746 | Medium | 5.4 | 2021-06-28 | Cross-site scripting vulnerability in WordPress Popular Posts 5.3.2 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspec… |
CVE-2021-20745 | High | 7.8 | 2021-06-28 | Inkdrop versions prior to v5.3.1 allows an attacker to execute arbitrary OS commands on the system where it runs by loading a file or code snippet containing a… |
CVE-2021-20740 | High | 8.8 | 2021-06-28 | Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a versions prior to FOS 5… |
CVE-2021-35513 | Medium | 6.1 | 2021-06-27 | Mermaid before 8.11.0 allows XSS when the antiscript feature is used. |
CVE-2021-35502 | Critical | 9.8 | 2021-06-25 | app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index. |
CVE-2021-25654 | Medium | 6.2 | 2021-06-25 | An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute specially crafted scr… |
CVE-2021-1073 | High | 8.3 | 2021-06-25 | NVIDIA GeForce Experience, all versions prior to 3.23, contains a vulnerability in the login flow when a user tries to log in by using a browser, while, at the… |
CVE-2021-34427 | Critical | 9.8 | 2021-06-25 | In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir)… |
CVE-2021-33542 | High | 7.8 | 2021-06-25 | Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or C… |
CVE-2021-33541 | High | 7.5 | 2021-06-25 | Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1 in all versions/variants are affected by a Denial-of-Service vulnerability. The communication protoc… |
CVE-2021-33540 | High | 7.3 | 2021-06-25 | In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists. |
CVE-2021-33539 | High | 7.2 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable authentication bypass vulnerability exists in the hostname processing. A specially c… |
CVE-2021-33538 | High | 8.8 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable improper access control vulnerability exists in the iw_webs account settings functio… |
CVE-2021-33537 | High | 8.8 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable remote code execution vulnerability exists in the iw_webs configuration parsing func… |
CVE-2021-33536 | High | 7.5 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable denial-of-service vulnerability exists in ServiceAgent functionality. A specially cr… |
CVE-2021-33535 | High | 8.8 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable format string vulnerability exists in the iw_console conio_writestr functionality. A… |
CVE-2021-33534 | High | 7.2 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the hostname functionality. A specially cr… |
CVE-2021-33533 | High | 8.8 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality. A specially cra… |
CVE-2021-33532 | High | 8.8 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality. A specially cra… |
CVE-2021-33531 | High | 8.8 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities. The d… |
CVE-2021-33530 | High | 8.8 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in encrypted diagnostic script functionality… |
CVE-2021-33529 | High | 7.5 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions the usage of hard-coded cryptographic keys within the service agent binary allows for the decryptio… |
CVE-2021-33528 | High | 8.8 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable privilege escalation vulnerability exists in the iw_console functionality. A special… |
CVE-2021-21005 | High | 7.5 | 2021-06-25 | In Phoenix Contact FL SWITCH SMCS series products in multiple versions if an attacker sends a hand-crafted TCP-Packet with the Urgent-Flag set and the Urgent-P… |
CVE-2021-21004 | High | 7.4 | 2021-06-25 | In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management whic… |
CVE-2021-21003 | Medium | 5.3 | 2021-06-25 | In Phoenix Contact FL SWITCH SMCS series products in multiple versions fragmented TCP-Packets may cause a Denial of Service of Web-, SNMP- and ICMP-Echo servic… |
CVE-2021-21002 | High | 7.5 | 2021-06-25 | In Phoenix Contact FL COMSERVER UNI in versions < 2.40 a invalid Modbus exception response can lead to a temporary denial of service. |
CVE-2021-29677 | Medium | 5.4 | 2021-06-25 | IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav… |
CVE-2021-29676 | Medium | 5.4 | 2021-06-25 | IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL l… |
CVE-2021-20583 | Medium | 4.9 | 2021-06-25 | IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) could disclose sensitive information through an HTTP GET request by a privileged user due to… |
CVE-2021-32702 | High | 8.0 | 2021-06-25 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including `1.4.1` are vulnerable to reflec… |
CVE-2021-3314 | Medium | 6.1 | 2021-06-25 | Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous con… |
CVE-2021-35501 | Medium | 5.4 | 2021-06-25 | PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console, the XSS pay… |
CVE-2021-34074 | Critical | 9.8 | 2021-06-25 | PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution via the File Manager. To bypass the built-in protection, a relative path… |
CVE-2021-34185 | High | 7.8 | 2021-06-25 | Miniaudio 0.10.35 has an integer-based buffer overflow caused by an out-of-bounds left shift in drwav_bytes_to_u32 in miniaudio.h |
CVE-2021-34184 | Critical | 9.8 | 2021-06-25 | Miniaudio 0.10.35 has a Double free vulnerability that could cause a buffer overflow in ma_default_vfs_close__stdio in miniaudio.h. |
CVE-2021-33895 | High | 8.1 | 2021-06-25 | ETINET BACKBOX E4.09 and H4.09 mismanages password access control. When a user uses the User ID of the process running BBSV to login to the Backbox UI applicat… |
CVE-2021-27043 | High | 7.8 | 2021-06-25 | An Arbitrary Address Write issue in the Autodesk DWG application can allow a malicious user to leverage the application to write in unexpected paths. In order… |
CVE-2021-27042 | High | 7.8 | 2021-06-25 | A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. The vulnerability exists because the application fails… |
CVE-2021-27041 | High | 7.8 | 2021-06-25 | A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. This vulnerability can be exploited to execute arbitra… |
CVE-2021-27040 | Low | 3.3 | 2021-06-25 | A maliciously crafted DWG file can be forced to read beyond allocated boundaries when parsing the DWG file. This vulnerability can be exploited to execute arbi… |
CVE-2021-35050 | Medium | 6.5 | 2021-06-25 | User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost… |
CVE-2021-35049 | Critical | 9.9 | 2021-06-25 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface. The vulnerability could allow a s… |
CVE-2021-35048 | Critical | 9.8 | 2021-06-25 | Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web interface. The vulnerability could lead to exp… |
CVE-2021-35047 | Critical | 9.9 | 2021-06-25 | Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with user level access to the CLI to in… |
CVE-2021-31615 | Medium | 5.3 | 2021-06-25 | Unencrypted Bluetooth Low Energy baseband links in Bluetooth Core Specifications 4.0 through 5.2 may permit an adjacent device to inject a crafted packet durin… |
CVE-2021-28958 | Critical | 9.8 | 2021-06-25 | Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password. |
CVE-2021-35475 | Medium | 5.4 | 2021-06-25 | SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when editing the Configuration Properties. |
CVE-2021-32717 | High | 7.5 | 2021-06-24 | Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL… |
CVE-2021-32716 | Medium | 4.4 | 2021-06-24 | Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been… |
CVE-2021-32713 | Medium | 4.8 | 2021-06-24 | Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are reco… |
CVE-2021-32712 | Medium | 5.3 | 2021-06-24 | Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to… |
CVE-2021-35448 | High | 7.8 | 2021-06-24 | Emote Interactive Remote Mouse 3.008 on Windows allows attackers to execute arbitrary programs as Administrator by using the Image Transfer Folder feature to n… |
CVE-2021-32711 | Critical | 9.1 | 2021-06-24 | Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only be fixed by changi… |
CVE-2021-32710 | Medium | 5.9 | 2021-06-24 | Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current… |
CVE-2021-3500 | High | 7.8 | 2021-06-24 | A flaw was found in djvulibre-3.5.28 and earlier. A Stack overflow in function DJVU::DjVuDocument::get_djvu_file() via crafted djvu file may lead to applicatio… |
CVE-2021-32709 | Medium | 4.9 | 2021-06-24 | Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current… |
CVE-2021-32493 | High | 7.8 | 2021-06-24 | A flaw was found in djvulibre-3.5.28 and earlier. A heap buffer overflow in function DJVU::GBitmap::decode() via crafted djvu file may lead to application cras… |
CVE-2021-32492 | High | 7.8 | 2021-06-24 | A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds read in function DJVU::DataPool::has_data() via crafted djvu file may lead to application cr… |
CVE-2021-32491 | High | 7.8 | 2021-06-24 | A flaw was found in djvulibre-3.5.28 and earlier. An integer overflow in function render() in tools/ddjvu via crafted djvu file may lead to application crash a… |
CVE-2021-32490 | High | 7.8 | 2021-06-24 | A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds write in function DJVU::filter_bv() via crafted djvu file may lead to application crash and… |
CVE-2021-29777 | Medium | 6.5 | 2021-06-24 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circumstance of a table being dropped while b… |
CVE-2021-29703 | High | 7.5 | 2021-06-24 | Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server terminates abnormally when executing a special… |
CVE-2021-20579 | Medium | 6.5 | 2021-06-24 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user who can create a view or inline SQL functi… |
CVE-2021-33004 | High | 7.8 | 2021-06-24 | The affected product is vulnerable to memory corruption condition due to lack of proper validation of user supplied files, which may allow an attacker to execu… |
CVE-2021-33002 | High | 7.8 | 2021-06-24 | Opening a maliciously crafted project file may cause an out-of-bounds write, which may allow an attacker to execute arbitrary code. User interaction is require… |
CVE-2021-33000 | High | 7.8 | 2021-06-24 | Parsing a maliciously crafted project file may cause a heap-based buffer overflow, which may allow an attacker to perform arbitrary code execution. User intera… |
CVE-2021-32708 | Critical | 9.8 | 2021-06-24 | Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain speci… |
CVE-2021-21574 | High | 7.2 | 2021-06-24 | Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local access to the system may potentially exploi… |
CVE-2021-21573 | High | 7.2 | 2021-06-24 | Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local access to the system may potentially exploi… |
CVE-2021-21572 | High | 7.2 | 2021-06-24 | Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local access to the system may potentially exploi… |
CVE-2021-21571 | Medium | 5.9 | 2021-06-24 | Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper certificate validation vulnerability. A r… |
CVE-2021-33346 | Critical | 9.8 | 2021-06-24 | There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this vulnerability to modify the password o… |
CVE-2021-32704 | High | 8.5 | 2021-06-24 | DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability has been found in… |
CVE-2021-31649 | Critical | 9.8 | 2021-06-24 | In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code execute |
CVE-2021-33348 | Medium | 6.1 | 2021-06-24 | An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which w… |
CVE-2021-23398 | Medium | 6.1 | 2021-06-24 | All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an inval… |
CVE-2021-29968 | High | 8.1 | 2021-06-24 | When drawing text onto a canvas with WebRender disabled, an out of bounds read could occur. *This bug only affects Firefox on Windows. Other operating systems… |
CVE-2021-29967 | High | 8.8 | 2021-06-24 | Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory corruption and we pres… |
CVE-2021-29966 | High | 8.8 | 2021-06-24 | Mozilla developers reported memory safety bugs present in Firefox 88. Some of these bugs showed evidence of memory corruption and we presume that with enough e… |
CVE-2021-29965 | Medium | 5.3 | 2021-06-24 | A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently ac… |
CVE-2021-29964 | High | 7.1 | 2021-06-24 | A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read. *This bug only… |
CVE-2021-29963 | Medium | 4.3 | 2021-06-24 | Address bar search suggestions in private browsing mode were re-using session data from normal mode. *This bug only affects Firefox for Android. Other operatin… |
CVE-2021-29962 | Medium | 4.3 | 2021-06-24 | Firefox for Android would become unstable and hard-to-recover when a website opened too many popups. *This bug only affects Firefox for Android. Other operatin… |
CVE-2021-29961 | Medium | 4.3 | 2021-06-24 | When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping which allowed an attacker to paint over the user interface… |
CVE-2021-29960 | Medium | 4.3 | 2021-06-24 | Firefox used to cache the last filename used for printing a file. When generating a filename for printing, Firefox usually suggests the web page title. The cac… |
CVE-2021-29959 | Medium | 4.3 | 2021-06-24 | When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website from re-enabling it wit… |
CVE-2021-29958 | Medium | 4.3 | 2021-06-24 | When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to private mode cookies being shared in no… |
CVE-2021-29957 | Medium | 4.3 | 2021-06-24 | If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indi… |
CVE-2021-29956 | Medium | 4.3 | 2021-06-24 | OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master pass… |
CVE-2021-29955 | Medium | 5.3 | 2021-06-24 | A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and may have also enabl… |