2021 CVEs (page 170)
Page 170 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-27627 | Medium | 5.9 | 2021-06-09 | SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value c… |
CVE-2021-27626 | Medium | 5.9 | 2021-06-09 | SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value c… |
CVE-2021-27625 | Medium | 5.9 | 2021-06-09 | SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value c… |
CVE-2021-27624 | Medium | 5.9 | 2021-06-09 | SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value c… |
CVE-2021-27623 | Medium | 5.9 | 2021-06-09 | SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value c… |
CVE-2021-27622 | Medium | 5.9 | 2021-06-09 | SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value c… |
CVE-2021-27621 | Medium | 4.9 | 2021-06-09 | Information Disclosure vulnerability in UserAdmin application in SAP NetWeaver Application Server for Java, versions - 7.11,7.20,7.30,7.31,7.40 and 7.50 allows… |
CVE-2021-27620 | Medium | 5.9 | 2021-06-09 | SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value c… |
CVE-2021-27615 | Medium | 5.4 | 2021-06-09 | SAP Manufacturing Execution versions - 15.1, 1.5.2, 15.3, 15.4, does not contain some HTTP security headers in their HTTP response. The lack of these headers i… |
CVE-2021-27607 | High | 7.5 | 2021-06-09 | SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher), versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC… |
CVE-2021-27606 | High | 7.5 | 2021-06-09 | SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT… |
CVE-2021-27597 | High | 7.5 | 2021-06-09 | SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNE… |
CVE-2021-21490 | Medium | 6.1 | 2021-06-09 | SAP NetWeaver AS for ABAP (Web Survey), versions - 700, 702, 710, 711, 730, 731, 750, 750, 752, 75A, 75F, does not sufficiently encode input and output paramet… |
CVE-2021-21473 | Medium | 6.3 | 2021-06-09 | SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function module SRM_RFC_SUBMIT_RE… |
CVE-2021-33668 | High | 7.5 | 2021-06-09 | Due to improper input sanitization, specially crafted LDAP queries can be injected by an unauthenticated user. This could partially impact the confidentiality… |
CVE-2021-34370 | Medium | 6.1 | 2021-06-09 | Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS. NOTE: the vendor states "there are configurable security flags and we are… |
CVE-2021-34369 | Medium | 6.5 | 2021-06-09 | portlets/contact/ref/refContactDetail.do in Accela Civic Platform through 20.1 allows remote attackers to obtain sensitive information via a modified contactSe… |
CVE-2021-33842 | High | 8.8 | 2021-06-09 | Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an au… |
CVE-2021-33841 | Critical | 10.0 | 2021-06-09 | SGE-PLC1000 device, in its 0.9.2b firmware version, does not handle some requests correctly, allowing a remote attacker to inject code into the operating syste… |
CVE-2021-33829 | Medium | 6.1 | 2021-06-09 | A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject execu… |
CVE-2021-26314 | Medium | 5.5 | 2021-06-09 | Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with inc… |
CVE-2021-26313 | Medium | 5.5 | 2021-06-09 | Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution of overwr… |
CVE-2021-34364 | Medium | 6.1 | 2021-06-09 | The Refined GitHub browser extension before 21.6.8 might allow XSS via a link in a document. NOTE: github.com sends Content-Security-Policy headers to, in gene… |
CVE-2021-1937 | High | 7.5 | 2021-06-09 | Reachable assertion is possible while processing peer association WLAN message from host and nonstandard incoming packet in Snapdragon Auto, Snapdragon Compute… |
CVE-2021-1900 | High | 8.4 | 2021-06-09 | Possible use after free in Display due to race condition while creating an external display in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sn… |
CVE-2021-28169 | Medium | 5.3 | 2021-06-09 | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected res… |
CVE-2021-20732 | Medium | 5.9 | 2021-06-09 | The ATOM (ATOM - Smart life App for Android versions prior to 1.8.1 and ATOM - Smart life App for iOS versions prior to 1.8.2) does not verify server certifica… |
CVE-2021-20731 | High | 8.8 | 2021-06-09 | WSR-1166DHP3 firmware Ver.1.16 and prior and WSR-1166DHP4 firmware Ver.1.02 and prior allow an attacker to execute arbitrary OS commands with root privileges v… |
CVE-2021-20730 | Medium | 4.3 | 2021-06-09 | Improper access control vulnerability in WSR-1166DHP3 firmware Ver.1.16 and prior and WSR-1166DHP4 firmware Ver.1.02 and prior allows an attacker to obtain con… |
CVE-2021-20728 | Medium | 5.3 | 2021-06-09 | Improper access control vulnerability in goo blog App for Android ver.1.2.25 and earlier and for iOS ver.1.3.3 and earlier allows a remote attacker to lead a u… |
CVE-2021-33742 | High | 7.5 | 2021-06-08 | Windows MSHTML Platform Remote Code Execution Vulnerability |
CVE-2021-33741 | High | 8.2 | 2021-06-08 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2021-33739 | High | 8.4 | 2021-06-08 | Microsoft DWM Core Library Elevation of Privilege Vulnerability |
CVE-2021-31985 | High | 7.8 | 2021-06-08 | Microsoft Defender Remote Code Execution Vulnerability |
CVE-2021-31983 | High | 7.8 | 2021-06-08 | Paint 3D Remote Code Execution Vulnerability |
CVE-2021-31980 | High | 8.1 | 2021-06-08 | Microsoft Intune Management Extension Remote Code Execution Vulnerability |
CVE-2021-31978 | Medium | 5.5 | 2021-06-08 | Microsoft Defender Denial of Service Vulnerability |
CVE-2021-31977 | High | 8.6 | 2021-06-08 | Windows Hyper-V Denial of Service Vulnerability |
CVE-2021-31976 | High | 7.5 | 2021-06-08 | Server for NFS Information Disclosure Vulnerability |
CVE-2021-31975 | High | 7.5 | 2021-06-08 | Server for NFS Information Disclosure Vulnerability |
CVE-2021-31974 | High | 7.5 | 2021-06-08 | Server for NFS Denial of Service Vulnerability |
CVE-2021-31973 | High | 7.8 | 2021-06-08 | Windows GPSVC Elevation of Privilege Vulnerability |
CVE-2021-31972 | Medium | 5.5 | 2021-06-08 | Event Tracing for Windows Information Disclosure Vulnerability |
CVE-2021-31971 | Medium | 6.8 | 2021-06-08 | Windows HTML Platforms Security Feature Bypass Vulnerability |
CVE-2021-31970 | Medium | 5.5 | 2021-06-08 | Windows TCP/IP Driver Security Feature Bypass Vulnerability |
CVE-2021-31969 | High | 7.8 | 2021-06-08 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
CVE-2021-31968 | High | 7.5 | 2021-06-08 | Windows Remote Desktop Services Denial of Service Vulnerability |
CVE-2021-31967 | High | 7.8 | 2021-06-08 | VP9 Video Extensions Remote Code Execution Vulnerability |
CVE-2021-31966 | High | 7.2 | 2021-06-08 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2021-31965 | Medium | 5.7 | 2021-06-08 | Microsoft SharePoint Server Information Disclosure Vulnerability |
CVE-2021-31964 | High | 7.6 | 2021-06-08 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2021-31963 | High | 7.1 | 2021-06-08 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2021-31962 | Critical | 9.4 | 2021-06-08 | Kerberos AppContainer Security Feature Bypass Vulnerability |
CVE-2021-31960 | Medium | 5.5 | 2021-06-08 | Windows Bind Filter Driver Information Disclosure Vulnerability |
CVE-2021-31959 | Medium | 6.4 | 2021-06-08 | Scripting Engine Memory Corruption Vulnerability |
CVE-2021-31958 | High | 7.5 | 2021-06-08 | Windows NTLM Elevation of Privilege Vulnerability |
CVE-2021-31957 | Medium | 5.9 | 2021-06-08 | ASP.NET Core Denial of Service Vulnerability |
CVE-2021-31956 | High | 7.8 | 2021-06-08 | Windows NTFS Elevation of Privilege Vulnerability |
CVE-2021-31955 | Medium | 5.5 | 2021-06-08 | Windows Kernel Information Disclosure Vulnerability |
CVE-2021-31954 | High | 7.8 | 2021-06-08 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2021-31953 | High | 7.8 | 2021-06-08 | Windows Filter Manager Elevation of Privilege Vulnerability |
CVE-2021-31952 | High | 7.8 | 2021-06-08 | Windows Kernel-Mode Driver Elevation of Privilege Vulnerability |
CVE-2021-31951 | High | 7.8 | 2021-06-08 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2021-31950 | High | 7.6 | 2021-06-08 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2021-31949 | High | 7.3 | 2021-06-08 | Microsoft Outlook Remote Code Execution Vulnerability |
CVE-2021-31948 | High | 7.6 | 2021-06-08 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2021-31946 | High | 7.8 | 2021-06-08 | Paint 3D Remote Code Execution Vulnerability |
CVE-2021-31945 | High | 7.8 | 2021-06-08 | Paint 3D Remote Code Execution Vulnerability |
CVE-2021-31944 | Medium | 5.0 | 2021-06-08 | 3D Viewer Information Disclosure Vulnerability |
CVE-2021-31943 | High | 7.8 | 2021-06-08 | 3D Viewer Remote Code Execution Vulnerability |
CVE-2021-31942 | High | 7.8 | 2021-06-08 | 3D Viewer Remote Code Execution Vulnerability |
CVE-2021-31941 | High | 7.8 | 2021-06-08 | Microsoft Office Graphics Remote Code Execution Vulnerability |
CVE-2021-31940 | High | 7.8 | 2021-06-08 | Microsoft Office Graphics Remote Code Execution Vulnerability |
CVE-2021-31939 | High | 7.8 | 2021-06-08 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2021-31938 | High | 7.3 | 2021-06-08 | Microsoft VsCode Kubernetes Tools Extension Elevation of Privilege Vulnerability |
CVE-2021-31201 | Medium | 5.2 | 2021-06-08 | Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability |
CVE-2021-31199 | Medium | 5.2 | 2021-06-08 | Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability |
CVE-2021-26420 | High | 7.1 | 2021-06-08 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2021-26414 | Medium | 4.8 | 2021-06-08 | Windows DCOM Server Security Feature Bypass |
CVE-2021-1675 | High | 7.8 | 2021-06-08 | Windows Print Spooler Remote Code Execution Vulnerability |
CVE-2021-33712 | High | 8.8 | 2021-06-08 | A vulnerability has been identified in Mendix SAML Module (All versions < V2.1.2). The configuration of the SAML module does not properly check various restric… |
CVE-2021-31807 | Medium | 6.5 | 2021-06-08 | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a remote server to achieve Denial of Service when deliver… |
CVE-2021-31343 | High | 8.8 | 2021-06-08 | The jutil.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before SE2021MP5 lack proper validation of use… |
CVE-2021-31342 | High | 8.8 | 2021-06-08 | The ugeom2d.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before SE2021MP5 lack proper validation of u… |
CVE-2021-31340 | High | 7.5 | 2021-06-08 | A vulnerability has been identified in SIMATIC RF166C (All versions > V1.1 and < V1.3.2), SIMATIC RF185C (All versions > V1.1 and < V1.3.2), SIMATIC RF186C (Al… |
CVE-2021-27399 | High | 7.8 | 2021-06-08 | A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.MP3). The femap.exe… |
CVE-2021-27390 | High | 7.8 | 2021-06-08 | A vulnerability has been identified in JT2Go (All versions < V13.1.0.3), Teamcenter Visualization (All versions < V13.1.0.3). The TIFF_loader.dll library in af… |
CVE-2021-27387 | High | 7.8 | 2021-06-08 | A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.MP3). The femap.exe… |
CVE-2021-22220 | Medium | 6.1 | 2021-06-08 | An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XSS in blob viewer of notebooks. |
CVE-2021-22216 | Medium | 6.5 | 2021-06-08 | A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumpt… |
CVE-2021-32658 | Medium | 4.7 | 2021-06-08 | Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all s… |
CVE-2021-26474 | High | 8.6 | 2021-06-08 | Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family m… |
CVE-2021-26473 | Critical | 9.8 | 2021-06-08 | In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitra… |
CVE-2021-26472 | Critical | 10.0 | 2021-06-08 | In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command… |
CVE-2021-26471 | Critical | 9.8 | 2021-06-08 | In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebservice_o.php accepts a command argument. Using this command argume… |
CVE-2021-22221 | Medium | 6.5 | 2021-06-08 | An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions starting from 13.11.0 before 13.11.5, all versi… |
CVE-2021-22219 | Medium | 4.4 | 2021-06-08 | All versions of GitLab CE/EE starting from 9.5 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13… |
CVE-2021-22217 | Medium | 6.5 | 2021-06-08 | A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumpt… |
CVE-2021-22213 | High | 8.8 | 2021-06-08 | A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to leak an OAuth access token by getting the v… |
CVE-2021-33571 | High | 7.5 | 2021-06-08 | In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading z… |