2021 CVEs (page 17)
Page 17 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-45039 | Critical | 9.8 | 2023-05-31 | Multiple models of the Uniview IP Camera (e.g., IPC_G6103 B6103.16.10.B25.201218, IPC_G61, IPC21, IPC23, IPC32, IPC36, IPC62, and IPC_HCMN) offer an undocument… |
CVE-2021-31233 | High | 7.5 | 2023-05-31 | SQL Injection vulnerability found in Fighting Cock Information System v.1.0 allows a remote attacker to obtain sensitive information via the edit_breed.php par… |
CVE-2021-37845 | Low | 3.7 | 2023-05-29 | An issue was discovered in Citadel through webcit-932. A meddler-in-the-middle attacker can fixate their own session during the cleartext phase before a STARTT… |
CVE-2021-27825 | High | 7.5 | 2023-05-29 | A directory traversal vulnerability on Mercury MAC1200R devices allows attackers to read arbitrary files via a web-static/ URL. |
CVE-2021-4336 | Medium | 5.5 | 2023-05-28 | A vulnerability was found in ITRS Group monitor-ninja up to 2021.11.1. It has been rated as critical. Affected by this issue is some unknown functionality of t… |
CVE-2021-46887 | Critical | 9.8 | 2023-05-26 | Lack of length check vulnerability in the HW_KEYMASTER module. Successful exploitation of this vulnerability may cause out-of-bounds read. |
CVE-2021-46886 | High | 7.5 | 2023-05-26 | The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability. |
CVE-2021-46885 | High | 7.5 | 2023-05-26 | The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability. |
CVE-2021-46884 | High | 7.5 | 2023-05-26 | The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability. |
CVE-2021-46883 | High | 7.5 | 2023-05-26 | The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability. |
CVE-2021-46882 | High | 7.5 | 2023-05-26 | The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability. |
CVE-2021-46881 | High | 7.5 | 2023-05-26 | The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability. |
CVE-2021-25749 | High | 7.8 | 2023-05-24 | Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true. |
CVE-2021-25748 | High | 7.6 | 2023-05-24 | A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization… |
CVE-2021-46888 | Medium | 5.4 | 2023-05-21 | An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute… |
CVE-2021-27131 | Medium | 5.4 | 2023-05-16 | Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML Section" via "Header… |
CVE-2021-0877 | Critical | 9.8 | 2023-05-15 | Product: AndroidVersions: Android SoCAndroid ID: A-273754094 |
CVE-2021-39036 | Medium | 6.1 | 2023-05-12 | IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2021-34076 | High | 8.8 | 2023-05-11 | File Upload vulnerability in PHPOK 5.7.140 allows remote attackers to run arbitrary code and gain escalated privileges via crafted zip file upload. |
CVE-2021-45345 | High | 7.5 | 2023-05-10 | Buffer Overflow vulnerability found in En3rgy WebcamServer v.0.5.2 allows a remote attacker to cause a denial of service via the WebcamServer.exe file. |
CVE-2021-46794 | High | 7.5 | 2023-05-09 | Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox checksum calculatio… |
CVE-2021-46792 | Medium | 5.9 | 2023-05-09 | Time-of-check Time-of-use (TOCTOU) in the BIOS2PSP command may allow an attacker with a malicious BIOS to create a race condition causing the ASP bootloader to… |
CVE-2021-46773 | High | 8.8 | 2023-05-09 | Insufficient input validation in ABL may enable a privileged attacker to corrupt ASP memory, potentially resulting in a loss of integrity or code execution. … |
CVE-2021-46765 | High | 7.5 | 2023-05-09 | Insufficient input validation in ASP may allow an attacker with a compromised SMM to induce out-of-bounds memory reads within the ASP, potentially leading to a… |
CVE-2021-46760 | Critical | 9.8 | 2023-05-09 | A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory access that may potentia… |
CVE-2021-46759 | Medium | 6.1 | 2023-05-09 | Improper syscall input validation in AMD TEE (Trusted Execution Environment) may allow an attacker with physical access and control of a Uapp that runs under t… |
CVE-2021-46756 | Critical | 9.1 | 2023-05-09 | Insufficient validation of inputs in SVC_MAP_USER_STACK in the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious Uapp or ABL to send… |
CVE-2021-46755 | High | 7.5 | 2023-05-09 | Failure to unmap certain SysHub mappings in error paths of the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious bootloader to exhau… |
CVE-2021-46754 | Critical | 9.1 | 2023-05-09 | Insufficient input validation in the ASP (AMD Secure Processor) bootloader may allow an attacker with a compromised Uapp or ABL to coerce the bootloader into e… |
CVE-2021-46775 | Medium | 6.8 | 2023-05-09 | Improper input validation in ABL may enable an attacker with physical access, to perform arbitrary memory overwrites, potentially leading to a loss of integrit… |
CVE-2021-46769 | High | 8.8 | 2023-05-09 | Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to execute arbitrary DMA copies, which can lead to code execution… |
CVE-2021-46764 | High | 7.5 | 2023-05-09 | Improper validation of DRAM addresses in SMU may allow an attacker to overwrite sensitive memory locations within the ASP potentially resulting in a denial of… |
CVE-2021-46763 | High | 7.5 | 2023-05-09 | Insufficient input validation in the SMU may enable a privileged attacker to write beyond the intended bounds of a shared memory buffer potentially leading to… |
CVE-2021-46762 | Low | 3.9 | 2023-05-09 | Insufficient input validation in the SMU may allow an attacker to corrupt SMU SRAM potentially leading to a loss of integrity or denial of service. |
CVE-2021-46753 | Critical | 9.1 | 2023-05-09 | Failure to validate the length fields of the ASP (AMD Secure Processor) sensor fusion hub headers may allow an attacker with a malicious Uapp or ABL to map the… |
CVE-2021-46749 | High | 7.5 | 2023-05-09 | Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox checksum calculatio… |
CVE-2021-26406 | High | 7.5 | 2023-05-09 | Insufficient validation in parsing Owner's Certificate Authority (OCA) certificates in SEV (AMD Secure Encrypted Virtualization) and SEV-ES user application ca… |
CVE-2021-26397 | High | 7.1 | 2023-05-09 | Insufficient address validation, may allow an attacker with a compromised ABL and UApp to corrupt sensitive memory locations potentially resulting in a loss of… |
CVE-2021-26379 | Critical | 9.8 | 2023-05-09 | Insufficient input validation of mailbox data in the SMU may allow an attacker to coerce the SMU to corrupt SMRAM, potentially leading to a loss of integrity a… |
CVE-2021-26371 | Medium | 5.5 | 2023-05-09 | A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure of ASP memory to userspace, potentially… |
CVE-2021-26365 | High | 8.2 | 2023-05-09 | Certain size values in firmware binary headers could trigger out of bounds reads during signature validation, leading to denial of service or potentially limit… |
CVE-2021-26356 | High | 7.4 | 2023-05-09 | A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and infor… |
CVE-2021-26354 | Medium | 5.5 | 2023-05-09 | Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may cause arbitrary memory values to be initializ… |
CVE-2021-31711 | Medium | 5.4 | 2023-05-09 | Cross Site Scripting vulnerability found in Trippo ResponsiveFilemanager v.9.14.0 and before allows a remote attacker to execute arbitrary code via the sort_by… |
CVE-2021-31240 | High | 7.8 | 2023-05-09 | An issue found in libming v.0.4.8 allows a local attacker to execute arbitrary code via the parseSWF_IMPORTASSETS function in the parser.c file. |
CVE-2021-44283 | High | 7.5 | 2023-05-09 | A buffer overflow in the component /Enclave.cpp of Electronics and Telecommunications Research Institute ShieldStore commit 58d455617f99705f0ffd8a27616abdf77bd… |
CVE-2021-31239 | High | 7.5 | 2023-05-09 | An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function. |
CVE-2021-28999 | High | 8.8 | 2023-05-08 | SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameter to modules/News… |
CVE-2021-28998 | High | 7.2 | 2023-05-08 | File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file. |
CVE-2021-27280 | High | 7.8 | 2023-05-08 | OS Command injection vulnerability in mblog 3.5.0 allows attackers to execute arbitrary code via crafted theme when it gets selected. |
CVE-2021-40331 | High | 8.1 | 2023-05-05 | An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database… |
CVE-2021-45111 | High | 8.1 | 2023-04-25 | Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to trigger the creation of de… |
CVE-2021-45071 | Medium | 6.1 | 2023-04-25 | Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script i… |
CVE-2021-44775 | Medium | 6.1 | 2023-04-25 | Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbi… |
CVE-2021-44547 | Critical | 9.1 | 2023-04-25 | A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading to privilege escalat… |
CVE-2021-44476 | Medium | 6.8 | 2023-04-25 | A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read local files on the serve… |
CVE-2021-44465 | Medium | 4.3 | 2023-04-25 | Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future n… |
CVE-2021-44461 | Medium | 6.1 | 2023-04-25 | Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accoun… |
CVE-2021-44460 | Medium | 6.5 | 2023-04-25 | Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system wit… |
CVE-2021-26947 | Medium | 6.1 | 2023-04-25 | Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script i… |
CVE-2021-26263 | Medium | 6.1 | 2023-04-25 | Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject a… |
CVE-2021-23203 | High | 7.5 | 2023-04-25 | Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF… |
CVE-2021-23186 | High | 8.7 | 2023-04-25 | A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access and modify database co… |
CVE-2021-23178 | High | 7.5 | 2023-04-25 | Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized p… |
CVE-2021-23176 | Medium | 6.5 | 2023-04-25 | Improper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authent… |
CVE-2021-23166 | High | 8.7 | 2023-04-25 | A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on… |
CVE-2021-33589 | High | 7.5 | 2023-04-21 | Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of the algorithm. |
CVE-2021-36436 | Medium | 5.3 | 2023-04-20 | An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via submission to the forgo… |
CVE-2021-38364 | Medium | 6.5 | 2023-04-20 | An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new inten… |
CVE-2021-38363 | High | 7.5 | 2023-04-20 | An issue was discovered in ONOS 2.5.1. In IntentManager, the install-requested intent (which causes an exception) remains in pendingMap (in memory) forever. De… |
CVE-2021-3429 | Medium | 5.5 | 2023-04-19 | When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var… |
CVE-2021-33971 | High | 7.8 | 2023-04-19 | Qihoo 360 (https://www.360.cn/) Qihoo 360 Safeguard (https://www.360.cn/) Qihoo 360 Total Security (http://www.360totalsecurity.com/) is affected by: Buffer Ov… |
CVE-2021-33970 | Critical | 10.0 | 2023-04-19 | Buffer Overflow vulnerability in Qihoo 360 Chrome v13.0.2170.0 allows attacker to escalate priveleges. |
CVE-2021-33975 | Critical | 10.0 | 2023-04-19 | Buffer Overflow vulnerability in Qihoo 360 Total Security v10.8.0.1060 and v10.8.0.1213 allows attacker to escalate privileges. |
CVE-2021-33974 | High | 8.8 | 2023-04-19 | Qihoo 360 (https://www.360.cn/) Qihoo 360 Safeguard (https://www.360.cn/) Qihoo 360 Chrome (https://browser.360.cn/ee/) is affected by: Buffer Overflow. The im… |
CVE-2021-33973 | High | 7.8 | 2023-04-19 | Buffer Overflow vulnerability in Qihoo 360 Safe guard v12.1.0.1004, v12.1.0.1005, v13.1.0.1001 allows attacker to escalate priveleges. |
CVE-2021-33972 | Critical | 10.0 | 2023-04-19 | Buffer Overflow vulnerability in Qihoo 360 Safe Browser v13.0.2170.0 allows attacker to escalate priveleges. |
CVE-2021-0885 | High | 7.8 | 2023-04-19 | In PVRSRVBridgeSyncPrimOpTake of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap… |
CVE-2021-0884 | High | 7.8 | 2023-04-19 | In PVRSRVBridgePhysmemImportSparseDmaBuf of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-… |
CVE-2021-0883 | High | 7.8 | 2023-04-19 | In PVRSRVBridgeCacheOpQueue of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap a… |
CVE-2021-0882 | High | 7.8 | 2023-04-19 | In PVRSRVBridgeRGXKickSync of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap ac… |
CVE-2021-0881 | High | 7.8 | 2023-04-19 | In PVRSRVBridgeRGXKickCDM of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap acc… |
CVE-2021-0880 | High | 7.8 | 2023-04-19 | In PVRSRVBridgeRGXKickTA3D of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap ac… |
CVE-2021-0879 | High | 7.8 | 2023-04-19 | In PVRSRVBridgeRGXTDMSubmitTransfer of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bound… |
CVE-2021-0878 | High | 7.8 | 2023-04-19 | In PVRSRVBridgeServerSyncGetStatus of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds… |
CVE-2021-0876 | High | 7.8 | 2023-04-19 | In PVRSRVBridgePhysmemNewRamBackedLockedPMR of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-… |
CVE-2021-0875 | High | 7.8 | 2023-04-19 | In PVRSRVBridgeChangeSparseMem of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds hea… |
CVE-2021-0874 | High | 7.8 | 2023-04-19 | In PVRSRVBridgeDevicememHistorySparseChange of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-… |
CVE-2021-0873 | High | 7.8 | 2023-04-19 | In PVRSRVBridgeRGXKickRS of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap acce… |
CVE-2021-0872 | High | 7.8 | 2023-04-19 | In PVRSRVBridgeRGXKickVRDM of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap ac… |
CVE-2021-43819 | High | 7.5 | 2023-04-19 | Stargate-Bukkit is a mod for the minecraft video game which adds a portal focused environment. In affected versions Minecarts with chests will drop their items… |
CVE-2021-28254 | Critical | 9.8 | 2023-04-19 | A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands. |
CVE-2021-41614 | High | 7.8 | 2023-04-18 | An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write access permissions to the Exception Program Counter Register (E… |
CVE-2021-41613 | Medium | 4.3 | 2023-04-18 | An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The write logic of Exception Effective Address Register (EEAR) is not implemen… |
CVE-2021-41612 | High | 8.8 | 2023-04-18 | An issue was discovered in the ALU unit of the OpenRISC mor1kx processor. The carry flag is not being updated correctly for the subtract instruction, which res… |
CVE-2021-40507 | Critical | 9.8 | 2023-04-18 | An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not being updated corre… |
CVE-2021-40506 | Critical | 9.8 | 2023-04-18 | An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not being updated for t… |
CVE-2021-33797 | Critical | 9.8 | 2023-04-17 | Buffer-overflow in jsdtoa.c in Artifex MuJS in versions 1.0.1 to 1.1.1. An integer overflow happens when js_strtod() reads in floating point exponent, which le… |
CVE-2021-36520 | High | 7.5 | 2023-04-16 | A SQL injection vulnerability in I-Tech Trainsmart r1044 exists via a evaluation/assign-evaluation?id= URI. |
CVE-2021-33990 | Critical | 9.8 | 2023-04-16 | Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the… |