2021 CVEs (page 169)
Page 169 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21663 | Medium | 4.3 | 2021-06-10 | A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-spec… |
CVE-2021-21662 | Medium | 4.3 | 2021-06-10 | A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID o… |
CVE-2021-21661 | Medium | 4.3 | 2021-06-10 | Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission… |
CVE-2021-31929 | Medium | 4.3 | 2021-06-10 | Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to modify loyalty campaigns and settings, such as fraud prevention, coupo… |
CVE-2021-3041 | High | 7.8 | 2021-06-10 | A local privilege escalation vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows u… |
CVE-2021-3040 | Medium | 6.7 | 2021-06-10 | An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This… |
CVE-2021-3039 | Low | 3.8 | 2021-06-10 | An information exposure through log file vulnerability exists in the Palo Alto Networks Prisma Cloud Compute Console where a secret used to authorize the role… |
CVE-2021-31998 | Medium | 6.8 | 2021-06-10 | A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2… |
CVE-2021-31997 | Medium | 6.8 | 2021-06-10 | A UNIX Symbolic Link (Symlink) Following vulnerability in python-postorius of openSUSE Leap 15.2, Factory allows local attackers to escalate from users postori… |
CVE-2021-25949 | Critical | 9.8 | 2021-06-10 | Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution. |
CVE-2021-25948 | Critical | 9.8 | 2021-06-10 | Prototype pollution vulnerability in 'expand-hash' versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code exe… |
CVE-2021-25322 | Medium | 6.8 | 2021-06-10 | A UNIX Symbolic Link (Symlink) Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from t… |
CVE-2021-21736 | High | 7.2 | 2021-06-10 | A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end ap… |
CVE-2021-21735 | Medium | 6.5 | 2021-06-10 | A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could exploit this vulnera… |
CVE-2021-20293 | Medium | 6.1 | 2021-06-10 | A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding… |
CVE-2021-20081 | High | 7.2 | 2021-06-10 | Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execute arbitrary command… |
CVE-2021-34539 | High | 7.2 | 2021-06-10 | An issue was discovered in CubeCoders AMP before 2.1.1.8. A lack of validation of the Java Version setting means that an unintended executable path can be set… |
CVE-2021-34363 | Critical | 9.1 | 2021-06-10 | The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature. |
CVE-2021-30641 | Medium | 5.3 | 2021-06-10 | Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF' |
CVE-2021-26691 | Critical | 9.8 | 2021-06-10 | In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow |
CVE-2021-26690 | High | 7.5 | 2021-06-10 | Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to… |
CVE-2021-3588 | Low | 3.3 | 2021-06-10 | The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for re… |
CVE-2021-33393 | High | 8.8 | 2021-06-09 | lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged acco… |
CVE-2021-0134 | Medium | 4.9 | 2021-06-09 | Improper input validation in an API for the Intel(R) Security Library before version 3.3 may allow a privileged user to potentially enable denial of service vi… |
CVE-2021-0133 | High | 8.1 | 2021-06-09 | Key exchange without entity authentication in the Intel(R) Security Library before version 3.3 may allow an authenticated user to potentially enable escalation… |
CVE-2021-0132 | Medium | 4.9 | 2021-06-09 | Missing release of resource after effective lifetime in an API for the Intel(R) Security Library before version 3.3 may allow a privileged user to potentially… |
CVE-2021-0131 | Medium | 6.5 | 2021-06-09 | Use of cryptographically weak pseudo-random number generator (PRNG) in an API for the Intel(R) Security Library before version 3.3 may allow an authenticated u… |
CVE-2021-0129 | Medium | 5.7 | 2021-06-09 | Improper access control in BlueZ may allow an authenticated user to potentially enable information disclosure via adjacent access. |
CVE-2021-0112 | High | 7.3 | 2021-06-09 | Unquoted service path in the Intel Unite(R) Client for Windows before version 4.2.25031 may allow an authenticated user to potentially enable an escalation of… |
CVE-2021-0108 | High | 7.3 | 2021-06-09 | Uncontrolled search path in the Intel Unite(R) Client for Windows before version 4.2.25031 may allow an authenticated user to potentially enable an escalation… |
CVE-2021-0106 | High | 7.8 | 2021-06-09 | Incorrect default permissions in the Intel(R) Optane(TM) DC Persistent Memory for Windows software versions before 2.00.00.3842 or 1.00.00.3515 may allow an au… |
CVE-2021-0104 | High | 7.8 | 2021-06-09 | Uncontrolled search path element in the installer for the Intel(R) Rapid Storage Technology software, before versions 17.9.0.34, 18.0.0.640 and 18.1.0.24, may… |
CVE-2021-0102 | High | 7.8 | 2021-06-09 | Insecure inherited permissions in the Intel Unite(R) Client for Windows before version 4.2.25031 may allow an authenticated user to potentially enable an escal… |
CVE-2021-0100 | High | 7.8 | 2021-06-09 | Incorrect default permissions in the installer for the Intel(R) SSD Data Center Tool, versions downloaded before 12/31/2020, may allow an authenticated user to… |
CVE-2021-0098 | High | 7.8 | 2021-06-09 | Improper access control in the Intel Unite(R) Client for Windows before version 4.2.25031 may allow an authenticated user to potentially enable an escalation o… |
CVE-2021-0094 | High | 7.8 | 2021-06-09 | Improper link resolution before file access in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable an escalation of pr… |
CVE-2021-0090 | High | 7.3 | 2021-06-09 | Uncontrolled search path element in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable an escalation of privilege via… |
CVE-2021-0089 | Medium | 6.5 | 2021-06-09 | Observable response discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. |
CVE-2021-0086 | Medium | 6.5 | 2021-06-09 | Observable response discrepancy in floating-point operations for some Intel(R) Processors may allow an authorized user to potentially enable information disclo… |
CVE-2021-0077 | High | 7.8 | 2021-06-09 | Insecure inherited permissions in the installer for the Intel(R) VTune(TM) Profiler before version 2021.1.1 may allow an authenticated user to potentially enab… |
CVE-2021-0074 | High | 7.8 | 2021-06-09 | Improper permissions in the installer for the Intel(R) Computing Improvement Program software before version 2.4.5982 may allow an authenticated user to potent… |
CVE-2021-0073 | High | 7.8 | 2021-06-09 | Insufficient control flow management in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable escalation of privilege vi… |
CVE-2021-0067 | Medium | 6.7 | 2021-06-09 | Improper access control in system firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local acc… |
CVE-2021-0058 | High | 7.8 | 2021-06-09 | Incorrect default permissions in the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potentially… |
CVE-2021-0057 | High | 7.8 | 2021-06-09 | Uncontrolled search path in the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potentially enab… |
CVE-2021-0056 | High | 7.8 | 2021-06-09 | Insecure inherited permissions for the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potential… |
CVE-2021-0055 | High | 7.8 | 2021-06-09 | Insecure inherited permissions for some Intel(R) NUC 9 Extreme Laptop Kit LAN Drivers before version 10.42 may allow an authenticated user to potentially enabl… |
CVE-2021-0054 | Medium | 6.7 | 2021-06-09 | Improper buffer restrictions in system firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local acce… |
CVE-2021-0052 | High | 7.8 | 2021-06-09 | Incorrect default privileges in the Intel(R) Computing Improvement Program before version 2.4.6522 may allow an authenticated user to potentially enable an esc… |
CVE-2021-0051 | Medium | 4.4 | 2021-06-09 | Improper input validation in the Intel(R) SPS versions before SPS_E5_04.04.04.023.0, SPS_E5_04.04.03.228.0 or SPS_SoC-A_05.00.03.098.0 may allow a privileged u… |
CVE-2021-0001 | Medium | 4.7 | 2021-06-09 | Observable timing discrepancy in Intel(R) IPP before version 2020 update 1 may allow authorized user to potentially enable information disclosure via local acc… |
CVE-2021-33894 | High | 8.8 | 2021-06-09 | In Progress MOVEit Transfer before 2019.0.6 (11.0.6), 2019.1.x before 2019.1.5 (11.1.5), 2019.2.x before 2019.2.2 (11.2.2), 2020.x before 2020.0.5 (12.0.5), 20… |
CVE-2021-29049 | Medium | 6.1 | 2021-06-09 | Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 b… |
CVE-2021-0113 | Medium | 6.5 | 2021-06-09 | Out of bounds write in the BMC firmware for Intel(R) Server Board M10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to p… |
CVE-2021-0105 | High | 7.3 | 2021-06-09 | Insecure inherited permissions in some Intel(R) ProSet/Wireless WiFi drivers may allow an authenticated user to potentially enable information disclosure and d… |
CVE-2021-0101 | High | 8.8 | 2021-06-09 | Buffer overflow in the BMC firmware for Intel(R) Server BoardM10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potent… |
CVE-2021-0097 | Medium | 6.5 | 2021-06-09 | Path traversal in the BMC firmware for Intel(R) Server Board M10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potent… |
CVE-2021-0095 | Medium | 4.4 | 2021-06-09 | Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a denial of service via local access. |
CVE-2021-0070 | High | 8.8 | 2021-06-09 | Improper input validation in the BMC firmware for Intel(R) Server Board M10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated use… |
CVE-2021-33833 | Critical | 9.8 | 2021-06-09 | ConnMan (aka Connection Manager) 1.30 through 1.39 has a stack-based buffer overflow in uncompress in dnsproxy.c via NAME, RDATA, or RDLENGTH (for A or AAAA). |
CVE-2021-33359 | High | 7.5 | 2021-06-09 | A vulnerability exists in gowitness < 2.3.6 that allows an unauthenticated attacker to perform an arbitrary file read using the file:// scheme in the url param… |
CVE-2021-33358 | High | 8.8 | 2021-06-09 | Multiple vulnerabilities exist in RaspAP 2.3 to 2.6.5 in the "interface", "ssid" and "wpa_passphrase" POST parameters in /hostapd, when the parameter values co… |
CVE-2021-33357 | Critical | 9.8 | 2021-06-09 | A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/get_netcfg.php, when the "iface" parameter value contains specia… |
CVE-2021-33356 | High | 8.8 | 2021-06-09 | Multiple privilege escalation vulnerabilities in RaspAP 1.5 to 2.6.5 could allow an authenticated remote attacker to inject arbitrary commands to /installers/c… |
CVE-2021-32677 | High | 8.2 | 2021-06-09 | FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for aut… |
CVE-2021-32942 | Medium | 6.6 | 2021-06-09 | The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user… |
CVE-2021-3196 | High | 8.8 | 2021-06-09 | An issue was discovered in Hitachi ID Bravura Security Fabric 11.0.0 through 11.1.3, 12.0.0 through 12.0.2, and 12.1.0. When using federated identity managemen… |
CVE-2021-30133 | Medium | 6.1 | 2021-06-09 | A cross-site scripting (XSS) vulnerability in CloverDX Server 5.9.0, CloverDX 5.8.1, CloverDX 5.7.0, and earlier allows remote attackers to inject arbitrary we… |
CVE-2021-29995 | High | 8.8 | 2021-06-09 | A Cross Site Request Forgery (CSRF) issue in Server Console in CloverDX through 5.9.0 allows remote attackers to execute any action as the logged-in user (incl… |
CVE-2021-23854 | High | 8.3 | 2021-06-09 | An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only… |
CVE-2021-23853 | High | 8.3 | 2021-06-09 | In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs. |
CVE-2021-23852 | Medium | 4.9 | 2021-06-09 | An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to become unresponsive fo… |
CVE-2021-23848 | High | 8.3 | 2021-06-09 | An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the c… |
CVE-2021-23847 | Critical | 9.8 | 2021-06-09 | A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings… |
CVE-2021-33669 | High | 7.8 | 2021-06-09 | Under certain conditions, SAP Mobile SDK Certificate Provider allows a local unprivileged attacker to exploit an insecure temporary file storage. For a success… |
CVE-2021-33666 | Medium | 6.1 | 2021-06-09 | When SAP Commerce Cloud version 100, hosts a JavaScript storefront, it is vulnerable to MIME sniffing, which, in certain circumstances, could be used to facili… |
CVE-2021-33665 | Medium | 5.4 | 2021-06-09 | SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML), versions - KRNL64NUC - 7.49, KRNL64UC - 7.49,7.53, KERNEL - 7.49,7.53,7.77,7.81… |
CVE-2021-33664 | Medium | 5.4 | 2021-06-09 | SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP), versions - SAP_UI - 750,752,753,754,755, SAP_BASIS - 702, 731 does not sufficien… |
CVE-2021-33663 | Medium | 5.3 | 2021-06-09 | SAP NetWeaver AS ABAP, versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73… |
CVE-2021-33662 | Medium | 4.4 | 2021-06-09 | Under certain conditions, the installation of SAP Business One, version - 10.0, discloses sensitive information on the file system allowing an attacker to acce… |
CVE-2021-33661 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the appli… |
CVE-2021-33660 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FLI file received from untrusted sources which results in crashing of the appli… |
CVE-2021-33659 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-31837 | High | 8.8 | 2021-06-09 | Memory corruption vulnerability in the driver file component in McAfee GetSusp prior to 4.0.0 could allow a program being investigated on the local machine to… |
CVE-2021-31832 | Medium | 5.2 | 2021-06-09 | Improper Neutralization of Input in the ePO administrator extension for McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a remot… |
CVE-2021-27643 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-27642 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the appli… |
CVE-2021-27641 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TIF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-27640 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crashing of the appli… |
CVE-2021-27639 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the applic… |
CVE-2021-27638 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the applic… |
CVE-2021-27637 | Medium | 4.6 | 2021-06-09 | Under certain conditions SAP Enable Now (SAP Workforce Performance Builder - Manager), versions - 1.0, 10 allows an attacker to access information which would… |
CVE-2021-27635 | Medium | 6.5 | 2021-06-09 | SAP NetWeaver AS for JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker authenticated as an administrator to connect over a network and submit a… |
CVE-2021-27634 | Medium | 5.9 | 2021-06-09 | SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNE… |
CVE-2021-27633 | High | 7.5 | 2021-06-09 | SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNE… |
CVE-2021-27632 | High | 7.5 | 2021-06-09 | SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT… |
CVE-2021-27631 | High | 7.5 | 2021-06-09 | SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT… |
CVE-2021-27630 | High | 7.5 | 2021-06-09 | SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT… |
CVE-2021-27629 | High | 7.5 | 2021-06-09 | SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT… |
CVE-2021-27628 | High | 7.5 | 2021-06-09 | SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher), versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC… |