2021 CVEs (page 167)
Page 167 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-24355 | Medium | 4.3 | 2021-06-14 | In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, the lack of capability checks and insufficient nonce check on the AJAX actions, simpl… |
CVE-2021-24354 | High | 8.8 | 2021-06-14 | A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, made it p… |
CVE-2021-24353 | High | 8.8 | 2021-06-14 | The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unau… |
CVE-2021-24352 | High | 8.8 | 2021-06-14 | The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unau… |
CVE-2021-24351 | Medium | 6.1 | 2021-06-14 | The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, le… |
CVE-2021-24350 | Medium | 6.1 | 2021-06-14 | The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The plugin would display the user'… |
CVE-2021-24349 | Medium | 6.1 | 2021-06-14 | This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized befo… |
CVE-2021-24348 | High | 7.2 | 2021-06-14 | The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET param… |
CVE-2021-24347 | High | 8.8 | 2021-06-14 | The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar file… |
CVE-2021-24346 | Medium | 5.4 | 2021-06-14 | The Stock in & out WordPress plugin through 1.0.4 has a search functionality, the lowest accessible level to it being contributor. The srch POST parameter is n… |
CVE-2021-24345 | Medium | 6.6 | 2021-06-14 | The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or e… |
CVE-2021-24341 | High | 8.8 | 2021-06-14 | When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitise… |
CVE-2021-21439 | Medium | 6.5 | 2021-06-14 | DoS attack can be performed when an email contains specially designed URL in the body. It can lead to the high CPU usage and cause low quality of service, or i… |
CVE-2021-23394 | High | 8.1 | 2021-06-13 | The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies i… |
CVE-2021-34682 | Low | 3.7 | 2021-06-12 | Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature. |
CVE-2021-31812 | Medium | 5.5 | 2021-06-12 | In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2… |
CVE-2021-31811 | Medium | 5.5 | 2021-06-12 | In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and… |
CVE-2021-32557 | Medium | 5.2 | 2021-06-12 | It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks. |
CVE-2021-32556 | Low | 3.8 | 2021-06-12 | It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would… |
CVE-2021-32555 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg-hwe-18.04 package a… |
CVE-2021-32554 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hook… |
CVE-2021-32553 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package appor… |
CVE-2021-32552 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package appor… |
CVE-2021-32551 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package appor… |
CVE-2021-32550 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package appor… |
CVE-2021-32549 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package appor… |
CVE-2021-32548 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-8 package apport… |
CVE-2021-32547 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-lts package appo… |
CVE-2021-34679 | Critical | 10.0 | 2021-06-11 | Thycotic Password Reset Server before 5.3.0 allows credential disclosure. |
CVE-2021-21382 | High | 8.6 | 2021-06-11 | Restund is an open source NAT traversal server. The restund TURN server can be instructed to open a relay to the loopback address range. This allows you to rea… |
CVE-2021-3256 | Medium | 6.5 | 2021-06-11 | KuaiFanCMS V5.x contains an arbitrary file read vulnerability in the html_url parameter of the chakanhtml.module.php file. |
CVE-2021-27200 | Critical | 9.8 | 2021-06-11 | In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted fr… |
CVE-2021-32932 | High | 7.5 | 2021-06-11 | The affected product is vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose information on the iView (versions prior to v5.7.03… |
CVE-2021-32930 | Critical | 9.8 | 2021-06-11 | The affected product’s configuration is vulnerable due to missing authentication, which may allow an attacker to change configurations and execute arbitrary co… |
CVE-2021-27410 | Critical | 9.8 | 2021-06-11 | The affected product is vulnerable to an out-of-bounds write, which may result in corruption of data or code execution on the Welch Allyn medical device manage… |
CVE-2021-27408 | High | 7.5 | 2021-06-11 | The affected product is vulnerable to an out-of-bounds read, which can cause information leakage leading to arbitrary code execution if chained to the out-of-b… |
CVE-2021-21833 | Critical | 9.8 | 2021-06-11 | An improper array index validation vulnerability exists in the TIF IP_planar_raster_unpack functionality of Accusoft ImageGear 19.9. A specially crafted malfor… |
CVE-2021-21824 | Critical | 9.8 | 2021-06-11 | An out-of-bounds write vulnerability exists in the JPG Handle_JPEG420 functionality of Accusoft ImageGear 19.9. A specially crafted malformed file can lead to… |
CVE-2021-21808 | High | 8.8 | 2021-06-11 | A memory corruption vulnerability exists in the PNG png_palette_process functionality of Accusoft ImageGear 19.9. A specially crafted malformed file can lead t… |
CVE-2021-21795 | Critical | 9.8 | 2021-06-11 | A heap-based buffer overflow vulnerability exists in the PSD read_icc_icCurve_data functionality of Accusoft ImageGear 19.9. A specially crafted malformed file… |
CVE-2021-0498 | High | 7.8 | 2021-06-11 | In memory management driver, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with no additional ex… |
CVE-2021-0497 | High | 7.8 | 2021-06-11 | In memory management driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional… |
CVE-2021-0496 | High | 7.8 | 2021-06-11 | In memory management driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional… |
CVE-2021-0495 | High | 7.8 | 2021-06-11 | In memory management driver, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with no additi… |
CVE-2021-0494 | High | 7.8 | 2021-06-11 | In memory management driver, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no addit… |
CVE-2021-0493 | High | 7.8 | 2021-06-11 | In memory management driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no ad… |
CVE-2021-0492 | High | 7.8 | 2021-06-11 | In memory management driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no ad… |
CVE-2021-0491 | High | 7.8 | 2021-06-11 | In memory management driver, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege wi… |
CVE-2021-0490 | High | 7.8 | 2021-06-11 | In memory management driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no ad… |
CVE-2021-0489 | High | 7.8 | 2021-06-11 | In memory management driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no ad… |
CVE-2021-0487 | High | 7.8 | 2021-06-11 | In onCreate of CalendarDebugActivity.java, there is a possible way to export calendar data to the sdcard without user consent due to a tapjacking/overlay attac… |
CVE-2021-0485 | High | 7.8 | 2021-06-11 | In getMinimalSize of PipBoundsAlgorithm.java, there is a possible bypass of restrictions on background processes due to a permissions bypass. This could lead t… |
CVE-2021-0484 | Medium | 5.5 | 2021-06-11 | In readVector of IMediaPlayer.cpp, there is a possible read of uninitialized heap data due to a missing bounds check. This could lead to local information disc… |
CVE-2021-0482 | High | 7.0 | 2021-06-11 | In BinderDiedCallback of MediaCodec.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with n… |
CVE-2021-0481 | High | 7.8 | 2021-06-11 | In onActivityResult of EditUserPhotoController.java, there is a possible access of unauthorized files due to an unexpected URI handler. This could lead to loca… |
CVE-2021-0480 | Medium | 5.5 | 2021-06-11 | In createPendingIntent of SnoozeHelper.java, there is a possible broadcast intent containing a sensitive identifier. This could lead to local information discl… |
CVE-2021-0477 | High | 7.8 | 2021-06-11 | In notifyScreenshotError of ScreenshotNotificationsController.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to lo… |
CVE-2021-0476 | High | 7.0 | 2021-06-11 | In FindOrCreatePeer of btif_av.cc, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additio… |
CVE-2021-0475 | High | 8.8 | 2021-06-11 | In on_l2cap_data_ind of btif_sock_l2cap.cc, there is possible memory corruption due to a use after free. This could lead to remote code execution over Bluetoot… |
CVE-2021-0474 | Critical | 9.8 | 2021-06-11 | In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no addit… |
CVE-2021-0473 | High | 8.8 | 2021-06-11 | In rw_t3t_process_error of rw_t3t.cc, there is a possible double free due to uninitialized data. This could lead to remote code execution over NFC with no addi… |
CVE-2021-0472 | High | 7.8 | 2021-06-11 | In shouldLockKeyguard of LockTaskController.java, there is a possible way to exit App Pinning without a PIN due to a permissions bypass. This could lead to loc… |
CVE-2021-0466 | High | 7.5 | 2021-06-11 | In startIpClient of ClientModeImpl.java, there is a possible identifier which could be used to track a device. This could lead to remote information disclosure… |
CVE-2021-28213 | High | 7.5 | 2021-06-11 | Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks. |
CVE-2021-28211 | Medium | 6.7 | 2021-06-11 | A heap overflow in LzmaUefiDecompressGetInfo function in EDK II. |
CVE-2021-28210 | High | 7.8 | 2021-06-11 | An unlimited recursion in DxeCore in EDK II. |
CVE-2021-23230 | Critical | 9.9 | 2021-06-11 | A SQL Injection vulnerability in the OPCUA interface of Gallagher Command Centre allows a remote unprivileged Command Centre Operator to modify Command Centre… |
CVE-2021-23211 | Medium | 6.0 | 2021-06-11 | Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows Cloud end-to-end encryption key to be discoverable… |
CVE-2021-23205 | High | 8.1 | 2021-06-11 | Improper Encoding or Escaping in Gallagher Command Centre Server allows a Command Centre Operator to alter the configuration of Controllers and other hardware… |
CVE-2021-23204 | High | 8.1 | 2021-06-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gallagher Command Centre Server allows OSDP key material to be exposed to Command C… |
CVE-2021-23182 | Medium | 6.0 | 2021-06-11 | Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows OSDP reader master keys to be discoverable in serv… |
CVE-2021-23140 | Critical | 9.9 | 2021-06-11 | Improper Authorization vulnerability in Gallagher Command Centre Server allows command line macros to be modified by an unauthorised Command Centre Operator. T… |
CVE-2021-23136 | Medium | 6.5 | 2021-06-11 | Improper Authorization vulnerability in Gallagher Command Centre Server allows macro overrides to be performed by an unprivileged Command Centre Operator. This… |
CVE-2021-22915 | Critical | 9.8 | 2021-06-11 | Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations… |
CVE-2021-22913 | Medium | 6.5 | 2021-06-11 | Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead… |
CVE-2021-22912 | Medium | 6.5 | 2021-06-11 | Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only… |
CVE-2021-22906 | Medium | 6.5 | 2021-06-11 | Nextcloud End-to-End Encryption before 1.5.3, 1.6.3 and 1.7.1 suffers from a denial of service vulnerability due to permitting any authenticated users to lock… |
CVE-2021-22905 | Medium | 6.5 | 2021-06-11 | Nextcloud Android App (com.nextcloud.client) before v3.16.0 is vulnerable to information disclosure due to searches for sharees being performed by default on t… |
CVE-2021-22904 | High | 7.5 | 2021-06-11 | The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Ac… |
CVE-2021-22903 | Medium | 6.1 | 2021-06-11 | The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed… |
CVE-2021-22902 | High | 7.5 | 2021-06-11 | The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vu… |
CVE-2021-22901 | High | 8.1 | 2021-06-11 | curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over… |
CVE-2021-22898 | Low | 3.1 | 2021-06-11 | curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send… |
CVE-2021-22897 | Medium | 5.3 | 2021-06-11 | curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is buil… |
CVE-2021-22896 | Medium | 4.3 | 2021-06-11 | Nextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authenticated users to create mail aliases fo… |
CVE-2021-22895 | Medium | 5.9 | 2021-06-11 | Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register wit… |
CVE-2021-22769 | Medium | 4.3 | 2021-06-11 | A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Easergy T300 with firmware V2.7.1 and older that could expose files or d… |
CVE-2021-22768 | Critical | 9.8 | 2021-06-11 | A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause… |
CVE-2021-22767 | Critical | 9.8 | 2021-06-11 | A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause… |
CVE-2021-22766 | High | 7.5 | 2021-06-11 | A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause… |
CVE-2021-22765 | Critical | 9.8 | 2021-06-11 | A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause… |
CVE-2021-22764 | Medium | 5.3 | 2021-06-11 | A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notifica… |
CVE-2021-22763 | Critical | 9.8 | 2021-06-11 | A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLog… |
CVE-2021-22762 | High | 7.8 | 2021-06-11 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could resul… |
CVE-2021-22761 | High | 7.8 | 2021-06-11 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior tha… |
CVE-2021-22760 | High | 7.8 | 2021-06-11 | A CWE-763: Release of invalid pointer or reference vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data o… |
CVE-2021-22759 | High | 7.8 | 2021-06-11 | A CWE-416: Use after free vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution d… |
CVE-2021-22758 | High | 7.8 | 2021-06-11 | A CWE-824: Access of uninitialized pointer vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote… |
CVE-2021-22757 | High | 7.8 | 2021-06-11 | A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or remote… |
CVE-2021-22756 | High | 7.8 | 2021-06-11 | A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or remote… |