2021 CVEs (page 168)
Page 168 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-22755 | High | 7.8 | 2021-06-11 | A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or remot… |
CVE-2021-22754 | High | 7.8 | 2021-06-11 | A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execut… |
CVE-2021-22753 | High | 7.8 | 2021-06-11 | A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code executi… |
CVE-2021-22752 | High | 7.8 | 2021-06-11 | A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execut… |
CVE-2021-22751 | High | 7.8 | 2021-06-11 | A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or execu… |
CVE-2021-22750 | High | 7.8 | 2021-06-11 | A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21041 and prior that could result in loss of data or remote code execut… |
CVE-2021-22749 | Medium | 5.3 | 2021-06-11 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon X80 BMXNOR0200H RTU SV1.70 IR22 and prior that could caus… |
CVE-2021-22181 | High | 7.7 | 2021-06-11 | A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relationship and exhaust… |
CVE-2021-22175 | Medium | 6.8 | 2021-06-11 | When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5… |
CVE-2021-20591 | High | 7.5 | 2021-06-11 | Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R00/01/02CPU all versions, R04/08/16/32/120(EN)CPU all v… |
CVE-2021-29754 | High | 8.8 | 2021-06-11 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a privilege escalation vulnerability when using the SAML Web Inbound Trust Association… |
CVE-2021-28689 | Medium | 5.5 | 2021-06-11 | x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area… |
CVE-2021-28687 | Medium | 5.5 | 2021-06-11 | HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards… |
CVE-2021-25425 | Medium | 5.3 | 2021-06-11 | Improper check vulnerability in Samsung Health prior to version 6.17 allows attacker to read internal cache data via exported component. |
CVE-2021-25424 | High | 8.8 | 2021-06-11 | Improper authentication vulnerability in Tizen bluetooth-frwk prior to Firmware update JUN-2021 Release allows bluetooth attacker to take over the user's bluet… |
CVE-2021-25423 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Watch Active2 PlugIn prior to 2.2.08.21033151 version allows attacker with log permissions to leak Wi-Fi password conn… |
CVE-2021-25422 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Watch Active PlugIn prior to version 2.2.07.21033151 allows attacker with log permissions to leak Wi-Fi password conne… |
CVE-2021-25421 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Galaxy Watch3 PlugIn prior to version 2.2.09.21033151 allows attacker with log permissions to leak Wi-Fi password conn… |
CVE-2021-25420 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Galaxy Watch PlugIn prior to version 2.2.05.21033151 allows attacker with log permissions to leak Wi-Fi password conne… |
CVE-2021-25419 | Medium | 6.5 | 2021-06-11 | Non-compliance of recommended secure coding scheme in Samsung Internet prior to version 14.0.1.62 allows attackers to display fake URL in address bar via phisi… |
CVE-2021-25418 | High | 7.8 | 2021-06-11 | Improper component protection vulnerability in Samsung Internet prior to version 14.0.1.62 allows untrusted applications to execute arbitrary activity in speci… |
CVE-2021-25417 | High | 7.5 | 2021-06-11 | Improper authorization in SDP SDK prior to SMR JUN-2021 Release 1 allows access to internal storage. |
CVE-2021-25416 | Medium | 6.5 | 2021-06-11 | Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to create executable kernel page outs… |
CVE-2021-25415 | Medium | 5.5 | 2021-06-11 | Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to remap EL2 memory as writable. |
CVE-2021-25414 | High | 7.8 | 2021-06-11 | Improper sanitization of incoming intent in Samsung Contacts prior to SMR JUN-2021 Release 1 allows local attackers to copy or overwrite arbitrary files with S… |
CVE-2021-25413 | Medium | 5.5 | 2021-06-11 | Improper sanitization of incoming intent in Samsung Contacts prior to SMR JUN-2021 Release 1 allows local attackers to get permissions to access arbitrary data… |
CVE-2021-25412 | High | 7.8 | 2021-06-11 | An improper access control vulnerability in genericssoservice prior to SMR JUN-2021 Release 1 allows local attackers to execute protected activity with system… |
CVE-2021-25411 | Medium | 4.4 | 2021-06-11 | Improper address validation vulnerability in RKP api prior to SMR JUN-2021 Release 1 allows root privileged local attackers to write read-only kernel memory. |
CVE-2021-25410 | High | 7.1 | 2021-06-11 | Improper access control of a component in CallBGProvider prior to SMR JUN-2021 Release 1 allows local attackers to access arbitrary files with an escalated pri… |
CVE-2021-25409 | Low | 2.4 | 2021-06-11 | Improper access in Notification setting prior to SMR JUN-2021 Release 1 allows physically proximate attackers to set arbitrary notification via physically conf… |
CVE-2021-25408 | High | 7.8 | 2021-06-11 | A possible buffer overflow vulnerability in NPU driver prior to SMR JUN-2021 Release 1 allows arbitrary memory write and code execution. |
CVE-2021-25407 | High | 7.8 | 2021-06-11 | A possible out of bounds write vulnerability in NPU driver prior to SMR JUN-2021 Release 1 allows arbitrary memory write. |
CVE-2021-25406 | Medium | 6.5 | 2021-06-11 | Information exposure vulnerability in Gear S Plugin prior to version 2.2.05.20122441 allows unstrusted applications to access connected BT device information. |
CVE-2021-25405 | Medium | 5.5 | 2021-06-11 | An improper access control vulnerability in ScreenOffActivity in Samsung Notes prior to version 4.2.04.27 allows untrusted applications to access local files. |
CVE-2021-25404 | Low | 3.3 | 2021-06-11 | Information Exposure vulnerability in SmartThings prior to version 1.7.64.21 allows attacker to access user information via log. |
CVE-2021-25403 | Low | 3.3 | 2021-06-11 | Intent redirection vulnerability in Samsung Account prior to version 10.8.0.4 in Android P(9.0) and below, and 12.2.0.9 in Android Q(10.0) and above allows att… |
CVE-2021-25402 | Low | 3.3 | 2021-06-11 | Information Exposure vulnerability in Samsung Notes prior to version 4.2.04.27 allows attacker to access s pen latency information. |
CVE-2021-25401 | High | 7.8 | 2021-06-11 | Intent redirection vulnerability in Samsung Health prior to version 6.16 allows attacker to execute privileged action. |
CVE-2021-25400 | High | 7.8 | 2021-06-11 | Intent redirection vulnerability in Samsung Internet prior to version 14.0.1.20 allows attacker to execute privileged action. |
CVE-2021-25399 | High | 7.1 | 2021-06-11 | Improper configuration in Smart Manager prior to version 11.0.05.0 allows attacker to access the file with system privilege. |
CVE-2021-25398 | Low | 3.3 | 2021-06-11 | Intent redirection vulnerability in Bixby Voice prior to version 3.1.12 allows attacker to access contacts. |
CVE-2021-25397 | Medium | 6.8 | 2021-06-11 | An improper access control vulnerability in TelephonyUI prior to SMR MAY-2021 Release 1 allows local attackers to write arbitrary files of telephony process vi… |
CVE-2021-25396 | Medium | 6.7 | 2021-06-11 | An improper input validation vulnerability in NPU firmware prior to SMR MAY-2021 Release 1 allows arbitrary memory write and code execution. |
CVE-2021-25395 | Medium | 6.4 | 2021-06-11 | A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised. |
CVE-2021-25394 | Medium | 6.4 | 2021-06-11 | A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is compr… |
CVE-2021-25393 | Medium | 6.6 | 2021-06-11 | Improper sanitization of incoming intent in SecSettings prior to SMR MAY-2021 Release 1 allows local attackers to get permissions to access system uid data. |
CVE-2021-25392 | Medium | 4.0 | 2021-06-11 | Improper protection of backup path configuration in Samsung Dex prior to SMR MAY-2021 Release 1 allows local attackers to get sensitive information via changin… |
CVE-2021-25391 | Medium | 4.0 | 2021-06-11 | Intent redirection vulnerability in Secure Folder prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action. |
CVE-2021-25390 | Medium | 4.0 | 2021-06-11 | Intent redirection vulnerability in PhotoTable prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action. |
CVE-2021-25389 | Low | 2.3 | 2021-06-11 | Improper running task check in S Secure prior to SMR MAY-2021 Release 1 allows attackers to use locked app without authentication. |
CVE-2021-25388 | High | 7.1 | 2021-06-11 | Improper caller check vulnerability in Knox Core prior to SMR MAY-2021 Release 1 allows attackers to install arbitrary app. |
CVE-2021-25387 | Critical | 9.0 | 2021-06-11 | An improper input validation vulnerability in sflacfd_get_frm() in libsflacextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute arbitr… |
CVE-2021-25386 | Critical | 9.0 | 2021-06-11 | An improper input validation vulnerability in sdfffd_parse_chunk_FVER() in libsdffextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute… |
CVE-2021-25385 | Critical | 9.0 | 2021-06-11 | An improper input validation vulnerability in sdfffd_parse_chunk_PROP() in libsdffextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute… |
CVE-2021-25384 | Critical | 9.0 | 2021-06-11 | An improper input validation vulnerability in sdfffd_parse_chunk_PROP() with Sample Rate Chunk in libsdffextractor library prior to SMR MAY-2021 Release 1 allo… |
CVE-2021-25383 | Critical | 9.0 | 2021-06-11 | An improper input validation vulnerability in scmn_mfal_read() in libsapeextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute arbitrar… |
CVE-2021-20396 | Low | 3.3 | 2021-06-11 | IBM QRadar Analyst Workflow App 1.0 through 1.18.0 for IBM QRadar SIEM allows web pages to be stored locally which can be read by another user on the system. I… |
CVE-2021-26996 | High | 7.5 | 2021-06-11 | E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a re… |
CVE-2021-26995 | High | 8.8 | 2021-06-11 | E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow priv… |
CVE-2021-26993 | Medium | 5.3 | 2021-06-11 | E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a re… |
CVE-2021-26997 | Medium | 6.5 | 2021-06-11 | E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a re… |
CVE-2021-3013 | Critical | 9.8 | 2021-06-11 | ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre fl… |
CVE-2021-34540 | Medium | 6.1 | 2021-06-11 | Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard. |
CVE-2021-33205 | High | 8.8 | 2021-06-11 | Western Digital EdgeRover before 0.25 has an escalation of privileges vulnerability where a low privileged user could load malicious content into directories w… |
CVE-2021-26829 | Medium | 5.4 | 2021-06-11 | OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm. |
CVE-2021-26828 | High | 8.8 | 2021-06-11 | OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit… |
CVE-2021-28814 | High | 8.8 | 2021-06-11 | An improper access control vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows remote attackers to compromise the secur… |
CVE-2021-28805 | High | 7.8 | 2021-06-11 | Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows at… |
CVE-2021-28801 | Low | 3.1 | 2021-06-11 | An out-of-bounds read vulnerability has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read se… |
CVE-2021-24035 | Critical | 9.1 | 2021-06-11 | A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed… |
CVE-2021-25684 | High | 8.8 | 2021-06-11 | It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO. |
CVE-2021-25683 | High | 8.8 | 2021-06-11 | It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel. |
CVE-2021-25682 | High | 8.8 | 2021-06-11 | It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel. |
CVE-2021-23393 | Medium | 5.4 | 2021-06-11 | This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect… |
CVE-2021-26199 | Medium | 6.5 | 2021-06-10 | An issue was discovered in JerryScript 2.4.0. There is a heap-use-after-free in ecma_bytecode_ref in ecma-helpers.c file. |
CVE-2021-26198 | Medium | 6.5 | 2021-06-10 | An issue was discovered in JerryScript 2.4.0. There is a SEVG in ecma_deref_bigint in ecma-helpers.c file. |
CVE-2021-26197 | Medium | 6.5 | 2021-06-10 | An issue was discovered in JerryScript 2.4.0. There is a SEGV in main_print_unhandled_exception in main-utils.c file. |
CVE-2021-26195 | High | 8.8 | 2021-06-10 | An issue was discovered in JerryScript 2.4.0. There is a heap-buffer-overflow in lexer_parse_number in js-lexer.c file. |
CVE-2021-26194 | Medium | 6.5 | 2021-06-10 | An issue was discovered in JerryScript 2.4.0. There is a heap-use-after-free in ecma_is_lexical_environment in the ecma-helpers.c file. |
CVE-2021-31840 | High | 7.3 | 2021-06-10 | A vulnerability in the preloading mechanism of specific dynamic link libraries in McAfee Agent for Windows prior to 5.7.3 could allow an authenticated, local a… |
CVE-2021-31839 | Medium | 4.8 | 2021-06-10 | Improper privilege management vulnerability in McAfee Agent for Windows prior to 5.7.3 allows a local user to modify event information in the MA event folder… |
CVE-2021-20329 | Medium | 6.8 | 2021-06-10 | Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object wi… |
CVE-2021-34557 | Medium | 4.6 | 2021-06-10 | XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker… |
CVE-2021-34546 | Medium | 6.8 | 2021-06-10 | An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed, that has the pre-logon profile switch button within the… |
CVE-2021-33031 | Low | 3.1 | 2021-06-10 | In LabCup before <v2_next_18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, af… |
CVE-2021-27347 | Medium | 5.5 | 2021-06-10 | Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted compressed file. |
CVE-2021-27345 | Medium | 5.5 | 2021-06-10 | A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows attackers to cause a denial of service (DOS) via a crafted com… |
CVE-2021-23022 | High | 7.8 | 2021-06-10 | On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, the BIG-IP Edge Client Windows Installer Service's temporary folder has weak file and fold… |
CVE-2021-34555 | High | 7.5 | 2021-06-10 | OpenDMARC 1.4.1 and 1.4.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a multi-value From header… |
CVE-2021-34547 | Medium | 4.3 | 2021-06-10 | PRTG Network Monitor 20.1.55.1775 allows /editsettings CSRF for user account creation. |
CVE-2021-31928 | High | 8.8 | 2021-06-10 | Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to escalate privileges to superadministrator. It was fixed in v2021.1.0.2. |
CVE-2021-31927 | Medium | 4.3 | 2021-06-10 | An Insecure Direct Object Reference (IDOR) vulnerability in Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to modify any… |
CVE-2021-31659 | High | 8.8 | 2021-06-10 | TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is vulnerable to Cross Site Request Forgery (CSRF). All configuration information is placed i… |
CVE-2021-31658 | High | 8.1 | 2021-06-10 | TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is affected by an Array index error. The interface that provides the "device description" fun… |
CVE-2021-31538 | High | 7.5 | 2021-06-10 | LANCOM R&S Unified Firewall (UF) devices running LCOS FX 10.5 allow Relative Path Traversal. |
CVE-2021-23024 | High | 7.2 | 2021-06-10 | On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in… |
CVE-2021-23023 | High | 7.8 | 2021-06-10 | On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, a DLL hijacking issue exists in cachecleaner.dll included in the BIG-IP Edge Client Window… |
CVE-2021-21666 | Medium | 6.1 | 2021-06-10 | Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-sit… |
CVE-2021-21665 | High | 8.8 | 2021-06-10 | A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified… |
CVE-2021-21664 | Medium | 6.5 | 2021-06-10 | An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacke… |