2021 CVEs (page 166)
Page 166 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-20483 | Medium | 6.5 | 2021-06-16 | IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, a remote authenticated attacke… |
CVE-2021-34803 | High | 7.8 | 2021-06-16 | TeamViewer before 14.7.48644 on Windows loads untrusted DLLs in certain situations. |
CVE-2021-34801 | Medium | 5.3 | 2021-06-16 | Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the produc… |
CVE-2021-27610 | Critical | 9.8 | 2021-06-16 | SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create information about internal… |
CVE-2021-22914 | High | 7.5 | 2021-06-16 | Citrix Cloud Connector before 6.31.0.62192 suffers from insecure storage of sensitive information due to sensitive information being stored in the Citrix Cloud… |
CVE-2021-21668 | Medium | 5.4 | 2021-06-16 | Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attacker… |
CVE-2021-21667 | Medium | 5.4 | 2021-06-16 | Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vul… |
CVE-2021-32928 | Critical | 9.8 | 2021-06-16 | The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License Manager” that allows incoming connections… |
CVE-2021-31857 | Medium | 5.9 | 2021-06-16 | In Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve credentials via a browser extension for non-website resource… |
CVE-2021-31159 | Medium | 5.3 | 2021-06-16 | Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password fun… |
CVE-2021-27485 | High | 7.5 | 2021-06-16 | ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable format, which could allow an attacker to re… |
CVE-2021-27483 | High | 7.8 | 2021-06-16 | ZOLL Defibrillator Dashboard, v prior to 2.2,The affected products contain insecure filesystem permissions that could allow a lower privilege user to escalate… |
CVE-2021-27479 | Medium | 5.4 | 2021-06-16 | ZOLL Defibrillator Dashboard, v prior to 2.2,The affected product’s web application could allow a low privilege user to inject parameters to contain malicious… |
CVE-2021-34683 | Medium | 5.3 | 2021-06-16 | An issue was discovered in EXCELLENT INFOTEK CORPORATION (EIC) E-document System 3.0. A remote attacker can use kw/auth/bbs/asp/get_user_email_info_bbs.asp to… |
CVE-2021-33813 | High | 7.5 | 2021-06-16 | An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. |
CVE-2021-32612 | High | 8.1 | 2021-06-16 | The VeryFitPro (com.veryfit2hr.second) application 3.2.8 for Android does all communication with the backend API over cleartext HTTP. This includes logins, reg… |
CVE-2021-32033 | Medium | 4.6 | 2021-06-16 | Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in certain situations. The time value used by… |
CVE-2021-30468 | High | 7.5 | 2021-06-16 | A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread gettin… |
CVE-2021-28979 | Medium | 6.5 | 2021-06-16 | SafeNet KeySecure Management Console 8.12.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using speciall… |
CVE-2021-27489 | High | 8.8 | 2021-06-16 | ZOLL Defibrillator Dashboard, v prior to 2.2, The web application allows a non-administrative user to upload a malicious file. This file could allow an attacke… |
CVE-2021-27487 | Medium | 5.5 | 2021-06-16 | ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. This could allow an attacker to gain access to sen… |
CVE-2021-27481 | Medium | 5.5 | 2021-06-16 | ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products utilize an encryption key in the data exchange process, which is hardcoded. This could allo… |
CVE-2021-20094 | High | 7.5 | 2021-06-16 | A denial of service vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to crash the Cod… |
CVE-2021-20093 | Critical | 9.1 | 2021-06-16 | A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap… |
CVE-2021-21441 | High | 7.5 | 2021-06-16 | There is a XSS vulnerability in the ticket overview screens. It's possible to collect various information by having an e-mail shown in the overview screen. Att… |
CVE-2021-28815 | Medium | 6.0 | 2021-06-16 | Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attacke… |
CVE-2021-3535 | Medium | 4.3 | 2021-06-16 | Rapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Filtered Asset Search feature. A specific… |
CVE-2021-32685 | Critical | 9.8 | 2021-06-16 | tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org… |
CVE-2021-32676 | Medium | 6.5 | 2021-06-16 | Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0.10, 10.0.8 and 11… |
CVE-2021-32623 | High | 8.1 | 2021-06-16 | Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable to the billion laugh… |
CVE-2021-30553 | High | 8.8 | 2021-06-15 | Use after free in Network service in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2021-30552 | High | 8.8 | 2021-06-15 | Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to install a malicious extension to potentially e… |
CVE-2021-30551 | High | 8.8 | 2021-06-15 | Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30550 | High | 8.8 | 2021-06-15 | Use after free in Accessibility in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to install a malicious extension to potentiall… |
CVE-2021-30549 | High | 8.8 | 2021-06-15 | Use after free in Spell check in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2021-30548 | High | 8.8 | 2021-06-15 | Use after free in Loader in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30547 | High | 8.8 | 2021-06-15 | Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted… |
CVE-2021-30546 | High | 8.8 | 2021-06-15 | Use after free in Autofill in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30545 | High | 8.8 | 2021-06-15 | Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed a remote attacker who had compromised the renderer process to potentially exploit… |
CVE-2021-30544 | High | 8.8 | 2021-06-15 | Use after free in BFCache in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-28858 | Medium | 5.5 | 2021-06-15 | TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 does not use SSL by default. Attacker on the local network can monitor traffic and capture the cookie and o… |
CVE-2021-28857 | High | 7.5 | 2021-06-15 | TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 username and password are sent via the cookie. |
CVE-2021-24037 | Critical | 9.8 | 2021-06-15 | A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially exe… |
CVE-2021-3595 | Low | 3.8 | 2021-06-15 | An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur… |
CVE-2021-3594 | Low | 3.8 | 2021-06-15 | An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur w… |
CVE-2021-3593 | Low | 3.8 | 2021-06-15 | An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() function and could occur… |
CVE-2021-3592 | Low | 3.8 | 2021-06-15 | An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur… |
CVE-2021-34170 | Critical | 9.8 | 2021-06-15 | Bandai Namco FromSoftware Dark Souls III allows remote attackers to execute arbitrary code. |
CVE-2021-34129 | High | 8.1 | 2021-06-15 | LaikeTui 3.5.0 allows remote authenticated users to delete arbitrary files, as demonstrated by deleting install.lock in order to reinstall the product in an at… |
CVE-2021-34128 | High | 8.8 | 2021-06-15 | LaikeTui 3.5.0 allows remote authenticated users to execute arbitrary PHP code by using index.php?module=system&action=pay to upload a ZIP archive containing a… |
CVE-2021-33887 | Medium | 6.8 | 2021-06-15 | Insufficient verification of data authenticity in Peloton TTR01 up to and including PTV55G allows an attacker with physical access to boot into a modified kern… |
CVE-2021-33622 | Critical | 9.8 | 2021-06-15 | Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has an Incorrect Check of a Function's Return Value. |
CVE-2021-32683 | High | 8.8 | 2021-06-15 | wire-webapp is the web version of Wire, an open-source messenger. A cross-site scripting vulnerability exists in wire-webapp prior to version 2021-06-01-produc… |
CVE-2021-27388 | Critical | 9.8 | 2021-06-15 | SINAMICS medium voltage routable products are affected by a vulnerability in the Sm@rtServer component for remote access that could allow an unauthenticated at… |
CVE-2021-23395 | High | 7.3 | 2021-06-15 | This affects all versions of package nedb. The library could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructo… |
CVE-2021-31502 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is… |
CVE-2021-31501 | Low | 3.3 | 2021-06-15 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction i… |
CVE-2021-31500 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31499 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31498 | Low | 3.3 | 2021-06-15 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction i… |
CVE-2021-31497 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31496 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31495 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31494 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31493 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31492 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31491 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31490 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31489 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31488 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31487 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31486 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31485 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31484 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31483 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31482 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31481 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31480 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31479 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31478 | High | 7.8 | 2021-06-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is requir… |
CVE-2021-31618 | High | 7.5 | 2021-06-15 | Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used… |
CVE-2021-32684 | Medium | 6.2 | 2021-06-14 | magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In version… |
CVE-2021-20027 | High | 7.5 | 2021-06-14 | A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted request. This vulnerabili… |
CVE-2021-34693 | Medium | 5.5 | 2021-06-14 | net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure… |
CVE-2021-27887 | Medium | 6.3 | 2021-06-14 | Cross-site Scripting (XSS) vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject malicio… |
CVE-2021-27196 | High | 7.5 | 2021-06-14 | Improper Input Validation vulnerability in Hitachi ABB Power Grids Relion 670 Series, Relion 670/650 Series, Relion 670/650/SAM600-IO, Relion 650, REB500, RTU5… |
CVE-2021-26845 | High | 7.5 | 2021-06-14 | Information Exposure vulnerability in Hitachi ABB Power Grids eSOMS allows unauthorized user to gain access to report data if the URL used to access the report… |
CVE-2021-0467 | Medium | 6.8 | 2021-06-14 | In Chromecast bootROM, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege in the bootlo… |
CVE-2021-0324 | Critical | 9.8 | 2021-06-14 | Product: AndroidVersions: Android SoCAndroid ID: A-175402462 |
CVE-2021-21557 | High | 8.1 | 2021-06-14 | Dell PowerEdge Server BIOS and select Dell Precision Rack BIOS contain an out-of-bounds array access vulnerability. A local malicious user with high privileges… |
CVE-2021-21556 | Medium | 6.1 | 2021-06-14 | Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a stack-based buffer overflow vulnerability in systems with… |
CVE-2021-21555 | Medium | 6.1 | 2021-06-14 | Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a heap-based buffer overflow vulnerability in systems with… |
CVE-2021-21554 | Medium | 6.1 | 2021-06-14 | Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and, Dell Precision 7920 Rack Workstation BIOS contain a stack-based buffer overflow vul… |
CVE-2021-32682 | Critical | 9.8 | 2021-06-14 | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities c… |
CVE-2021-24382 | Medium | 5.4 | 2021-06-14 | The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored C… |
CVE-2021-24360 | Medium | 6.5 | 2021-06-14 | The Yes/No Chart WordPress plugin before 1.0.12 did not sanitise its sid shortcode parameter before using it in a SQL statement, allowing medium privilege user… |
CVE-2021-24359 | Medium | 5.3 | 2021-06-14 | The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate use… |
CVE-2021-24358 | Medium | 6.1 | 2021-06-14 | The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirectin… |
CVE-2021-24357 | Medium | 5.4 | 2021-06-14 | In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitise… |
CVE-2021-24356 | High | 8.8 | 2021-06-14 | In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJAX action, simple30… |