2021 CVEs (page 165)
Page 165 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-28684 | Medium | 4.3 | 2021-06-21 | The XML parser used in ConeXware PowerArchiver before 20.10.02 allows processing of external entities, which might lead to exfiltration of local files over the… |
CVE-2021-33572 | Low | 3.5 | 2021-06-21 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Linux Security whereby the FSAVD component used in certain F-Secure products can crash while… |
CVE-2021-29337 | High | 7.8 | 2021-06-21 | MODAPI.sys in MSI Dragon Center 2.0.104.0 allows low-privileged users to access kernel memory and potentially escalate privileges via a crafted IOCTL 0x9c40610… |
CVE-2021-31769 | High | 8.8 | 2021-06-21 | MyQ Server in MyQ X Smart before 8.2 allows remote code execution by unprivileged users because administrative session data can be read in the %PROGRAMFILES%\M… |
CVE-2021-24368 | Medium | 6.1 | 2021-06-20 | The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displayin… |
CVE-2021-33186 | High | 7.5 | 2021-06-18 | SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information. |
CVE-2021-33185 | High | 7.5 | 2021-06-18 | SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could allow attackers to obtain sensitive information. |
CVE-2021-31664 | High | 7.5 | 2021-06-18 | RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information. |
CVE-2021-31663 | High | 7.5 | 2021-06-18 | RIOT-OS 2021.01 before commit bc59d60be60dfc0a05def57d74985371e4f22d79 contains a buffer overflow which could allow attackers to obtain sensitive information. |
CVE-2021-31662 | High | 7.5 | 2021-06-18 | RIOT-OS 2021.01 before commit 07f1254d8537497552e7dce80364aaead9266bbe contains a buffer overflow which could allow attackers to obtain sensitive information. |
CVE-2021-31661 | High | 7.5 | 2021-06-18 | RIOT-OS 2021.01 before commit 609c9ada34da5546cffb632a98b7ba157c112658 contains a buffer overflow that could allow attackers to obtain sensitive information. |
CVE-2021-31660 | High | 7.5 | 2021-06-18 | RIOT-OS 2021.01 before commit 85da504d2dc30188b89f44c3276fc5a25b31251f contains a buffer overflow which could allow attackers to obtain sensitive information. |
CVE-2021-31272 | Critical | 9.8 | 2021-06-18 | SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution… |
CVE-2021-21410 | High | 8.2 | 2021-06-18 | Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be triggered by 6LoWPAN packets sent t… |
CVE-2021-21281 | High | 7.0 | 2021-06-18 | Contiki-NG is an open-source, cross-platform operating system for internet of things devices. A buffer overflow vulnerability exists in Contiki-NG versions pri… |
CVE-2021-21280 | High | 8.6 | 2021-06-18 | Contiki-NG is an open-source, cross-platform operating system for internet of things devices. It is possible to cause an out-of-bounds write in versions of Con… |
CVE-2021-21279 | High | 7.5 | 2021-06-18 | Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In verions prior to 4.6, an attacker can perform a denial-of-serv… |
CVE-2021-21257 | High | 8.2 | 2021-06-18 | Contiki-NG is an open-source, cross-platform operating system for internet of things devices. The RPL-Classic and RPL-Lite implementations in the Contiki-NG op… |
CVE-2021-33824 | High | 7.5 | 2021-06-18 | An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make… |
CVE-2021-33823 | High | 7.5 | 2021-06-18 | An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attacker could send a huge amount of TCP SYN packet to make web service's resource exh… |
CVE-2021-32696 | Low | 3.7 | 2021-06-18 | The npm package "striptags" is an implementation of PHP's strip_tags in Typescript. In striptags before version 3.2.0, a type-confusion vulnerability can cause… |
CVE-2021-21282 | High | 8.6 | 2021-06-18 | Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In versions prior to 4.5, buffer overflow can be triggered by an… |
CVE-2021-33822 | High | 7.5 | 2021-06-18 | An issue was discovered on 4GEE ROUTER HH70VB Version HH70_E1_02.00_22. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make s… |
CVE-2021-33820 | High | 7.5 | 2021-06-18 | An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67.Attacker could send a huge amount of TCP SYN packet to make web service's resour… |
CVE-2021-33818 | High | 7.5 | 2021-06-18 | An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67. Attackers can use slowhttptest tool to send incomplete HTTP request, which coul… |
CVE-2021-3604 | Critical | 9.8 | 2021-06-18 | Secure 8 (Evalos) does not validate user input data correctly, allowing a remote attacker to perform a Blind SQL Injection. An attacker could exploit this vuln… |
CVE-2021-32956 | Medium | 6.1 | 2021-06-18 | Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to redirection, which may allow an attacker to send a maliciously crafted URL that could resul… |
CVE-2021-32954 | Medium | 6.5 | 2021-06-18 | Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to a directory traversal, which may allow an attacker to remotely read arbitrary files on the… |
CVE-2021-23846 | High | 8.8 | 2021-06-18 | When using http protocol, the user password is transmitted as a clear text parameter for which it is possible to be obtained by an attacker through a MITM atta… |
CVE-2021-23845 | High | 8.0 | 2021-06-18 | This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. This vulnerability was discovered by a sec… |
CVE-2021-21997 | Medium | 5.5 | 2021-06-18 | VMware Tools for Windows (11.x.y prior to 11.3.0) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with local user privileges… |
CVE-2021-34815 | Medium | 4.8 | 2021-06-18 | CheckSec Canopy before 3.5.2 allows XSS attacks against the login page via the LOGIN_PAGE_DISCLAIMER parameter. |
CVE-2021-26835 | Medium | 6.1 | 2021-06-18 | No filtering of cross-site scripting (XSS) payloads in the markdown-editor in Zettlr 1.8.7 allows attackers to perform remote code execution via a crafted file. |
CVE-2021-26834 | Medium | 5.4 | 2021-06-18 | A cross-site scripting (XSS) vulnerability exists in Znote 0.5.2. An attacker can insert payloads, and the code execution will happen immediately on markdown v… |
CVE-2021-33577 | Medium | 5.3 | 2021-06-18 | An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves (via encryption and signing of the mes… |
CVE-2021-33576 | Critical | 9.8 | 2021-06-18 | An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filename can include path-traversal characters… |
CVE-2021-33347 | Medium | 5.4 | 2021-06-18 | An issue was discovered in JPress v3.3.0 and below. There are XSS vulnerabilities in the template module and tag management module. If you log in to the backgr… |
CVE-2021-32536 | Medium | 6.1 | 2021-06-18 | The login page in the MCUsystem does not filter with special characters, which allows remote attackers can inject JavaScript without privilege and thus perform… |
CVE-2021-21669 | Critical | 9.8 | 2021-06-18 | Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-34812 | Medium | 5.8 | 2021-06-18 | Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via… |
CVE-2021-34811 | Medium | 5.0 | 2021-06-18 | Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users… |
CVE-2021-34810 | Critical | 9.9 | 2021-06-18 | Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbit… |
CVE-2021-34809 | Critical | 9.9 | 2021-06-18 | Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station bef… |
CVE-2021-34808 | Medium | 5.8 | 2021-06-18 | Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resourc… |
CVE-2021-34553 | Medium | 4.3 | 2021-06-18 | Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via… |
CVE-2021-32693 | Medium | 6.8 | 2021-06-17 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symf… |
CVE-2021-32694 | Medium | 4.1 | 2021-06-17 | Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nex… |
CVE-2021-32426 | Medium | 6.1 | 2021-06-17 | In TrendNet TW100-S4W1CA 2.3.32, it is possible to inject arbitrary JavaScript into the router's web interface via the "echo" command. |
CVE-2021-32424 | High | 8.8 | 2021-06-17 | In TrendNet TW100-S4W1CA 2.3.32, due to a lack of proper session controls, a threat actor could make unauthorized changes to an affected router via a specially… |
CVE-2021-32695 | Low | 3.9 | 2021-06-17 | Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.16.1, a malicious app on the same device could have gotten access to the shar… |
CVE-2021-33557 | Medium | 6.1 | 2021-06-17 | An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inje… |
CVE-2021-32575 | Medium | 6.5 | 2021-06-17 | HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12… |
CVE-2021-32681 | Medium | 5.4 | 2021-06-17 | Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4… |
CVE-2021-23396 | Medium | 5.6 | 2021-06-17 | All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function. |
CVE-2021-29706 | High | 7.1 | 2021-06-17 | IBM AIX 7.1 could allow a non-privileged local user to exploit a vulnerability in the trace facility to expose sensitive information or cause a denial of servi… |
CVE-2021-32078 | High | 7.1 | 2021-06-17 | An Out-of-Bounds Read was discovered in arch/arm/mach-footbridge/personal-pci.c in the Linux kernel through 5.12.11 because of the lack of a check for a value… |
CVE-2021-34825 | High | 7.5 | 2021-06-17 | Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the local system. |
CVE-2021-31818 | Medium | 4.3 | 2021-06-17 | Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API requ… |
CVE-2021-32952 | High | 7.8 | 2021-06-17 | An out-of-bounds write issue exists in the DGN file-reading procedure in the Drawings SDK (Version 2022.4 and prior) resulting from the lack of proper validati… |
CVE-2021-32950 | High | 7.1 | 2021-06-17 | An out-of-bounds read issue exists within the parsing of DXF files in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validat… |
CVE-2021-32948 | High | 7.8 | 2021-06-17 | An out-of-bounds write issue exists in the DWG file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper vali… |
CVE-2021-32944 | High | 7.8 | 2021-06-17 | A use-after-free issue exists in the DGN file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation… |
CVE-2021-32940 | High | 7.1 | 2021-06-17 | An out-of-bounds read issue exists in the DWG file-recovering procedure in the Drawings SDK (All versions prior to 2022.5) resulting from the lack of proper va… |
CVE-2021-32938 | High | 7.1 | 2021-06-17 | Drawings SDK (All versions prior to 2022.4) are vulnerable to an out-of-bounds read due to parsing of DWG files resulting from the lack of proper validation of… |
CVE-2021-32936 | High | 7.8 | 2021-06-17 | An out-of-bounds write issue exists in the DXF file-recovering procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper v… |
CVE-2021-3603 | High | 8.1 | 2021-06-17 | PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by o… |
CVE-2021-32946 | High | 7.8 | 2021-06-17 | An improper check for unusual or exceptional conditions issue exists within the parsing DGN files from Drawings SDK (Version 2022.4 and prior) resulting from t… |
CVE-2021-32582 | High | 7.5 | 2021-06-17 | An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable… |
CVE-2021-31521 | Medium | 5.4 | 2021-06-17 | Trend Micro InterScan Web Security Virtual Appliance version 6.5 was found to have a reflected cross-site scripting (XSS) vulnerability in the product's Captiv… |
CVE-2021-0143 | High | 7.8 | 2021-06-17 | Improper permissions in the installer for the Intel(R) Brand Verification Tool before version 11.0.0.1225 may allow an authenticated user to potentially enable… |
CVE-2021-21777 | Critical | 10.0 | 2021-06-17 | An information disclosure vulnerability exists in the Ethernet/IP UDP handler functionality of EIP Stack Group OpENer 2.3 and development commit 8c73bf3. A spe… |
CVE-2021-31477 | High | 7.3 | 2021-06-16 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is not required to exp… |
CVE-2021-31476 | High | 7.8 | 2021-06-16 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.3.37598. User interaction is required t… |
CVE-2021-32691 | High | 8.8 | 2021-06-16 | Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access… |
CVE-2021-32690 | Medium | 6.8 | 2021-06-16 | Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the user… |
CVE-2021-32245 | Medium | 5.4 | 2021-06-16 | In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploade… |
CVE-2021-32244 | Medium | 5.4 | 2021-06-16 | Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field. |
CVE-2021-32243 | High | 8.8 | 2021-06-16 | FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated). |
CVE-2021-34204 | Medium | 6.8 | 2021-06-16 | D-Link DIR-2640-US 1.01B04 is affected by Insufficiently Protected Credentials. D-Link AC2600(DIR-2640) stores the device system account password in plain text… |
CVE-2021-34203 | High | 8.1 | 2021-06-16 | D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 (dir-2640-us), when setting PPPoE, will start quagga process in the way of… |
CVE-2021-34201 | High | 7.1 | 2021-06-16 | D-Link DIR-2640-US 1.01B04 is vulnerable to Buffer Overflow. There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640). Loc… |
CVE-2021-34202 | High | 7.8 | 2021-06-16 | There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640) 1.01B04. Ordinary permissions can be elevated to administrator pe… |
CVE-2021-32659 | Medium | 6.5 | 2021-06-16 | Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier, if a bridge has ro… |
CVE-2021-34813 | Critical | 9.8 | 2021-06-16 | Matrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client (while it is attempting to retrieve an Olm encrypted room key backup from the… |
CVE-2021-34551 | High | 8.1 | 2021-06-16 | PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname. |
CVE-2021-1571 | High | 7.2 | 2021-06-16 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: H… |
CVE-2021-1570 | Medium | 6.5 | 2021-06-16 | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for Mac, and Cisco Jabber for mobile platforms could allow an attacker to access sensitive i… |
CVE-2021-1569 | Medium | 6.5 | 2021-06-16 | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for Mac, and Cisco Jabber for mobile platforms could allow an attacker to access sensitive i… |
CVE-2021-1568 | Medium | 5.5 | 2021-06-16 | A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to cause a denial of service (DoS) conditio… |
CVE-2021-1567 | High | 7.0 | 2021-06-16 | A vulnerability in the DLL loading mechanism of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a D… |
CVE-2021-1566 | High | 7.4 | 2021-06-16 | A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco We… |
CVE-2021-1543 | High | 7.2 | 2021-06-16 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: H… |
CVE-2021-1542 | High | 7.2 | 2021-06-16 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: H… |
CVE-2021-1541 | High | 7.2 | 2021-06-16 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: H… |
CVE-2021-1524 | Medium | 4.3 | 2021-06-16 | A vulnerability in the API of Cisco Meeting Server could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected de… |
CVE-2021-1395 | Medium | 4.7 | 2021-06-16 | A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a cross-s… |
CVE-2021-29702 | High | 7.5 | 2021-06-16 | Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1.4 and 11.5.5 is vulnerable to a denial of service as the server terminates abnormally when e… |
CVE-2021-20567 | Medium | 4.4 | 2021-06-16 | IBM Resilient SOAR V38.0 could allow a local privileged attacker to obtain sensitive information due to improper or nonexisting encryption.IBM X-Force ID: 1992… |
CVE-2021-20566 | High | 7.5 | 2021-06-16 | IBM Resilient SOAR V38.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force I… |
CVE-2021-20488 | Medium | 6.5 | 2021-06-16 | IBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the passwords of other users in the Windows AD environment when IBM S… |