2021 CVEs (page 171)
Page 171 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-33203 | Medium | 4.9 | 2021-06-08 | Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the T… |
CVE-2021-32674 | High | 8.8 | 2021-06-08 | Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5… |
CVE-2021-28293 | Critical | 9.8 | 2021-06-08 | Seceon aiSIEM before 6.3.2 (build 585) is prone to an unauthenticated account takeover vulnerability in the Forgot Password feature. The lack of correct config… |
CVE-2021-21559 | High | 7.1 | 2021-06-08 | Dell EMC NetWorker, versions 18.x, 19.1.x, 19.2.x 19.3.x, 19.4, and 19.4.0.1 contain an Improper Certificate Validation vulnerability in the client (NetWorker… |
CVE-2021-21558 | High | 8.2 | 2021-06-08 | Dell EMC NetWorker, 18.x, 19.1.x, 19.2.x 19.3.x, 19.4 and 19.4.0.1, contains an Information Disclosure vulnerability. A local administrator of the gstd system… |
CVE-2021-32673 | High | 8.8 | 2021-06-08 | reg-keygen-git-hash-plugin is a reg-suit plugin to detect the snapshot key to be compare with using Git commit hash. reg-keygen-git-hash-plugin through and inc… |
CVE-2021-32015 | Medium | 6.0 | 2021-06-08 | In Nuvoton NPCT75x TPM 1.2 firmware 7.4.0.0, a local authenticated malicious user with high privileges could potentially gain unauthorized access to TPM non-vo… |
CVE-2021-22218 | Low | 2.6 | 2021-06-08 | All versions of GitLab CE/EE starting from 12.8 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13… |
CVE-2021-22215 | High | 7.5 | 2021-06-08 | An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members' on-call rotations… |
CVE-2021-34280 | High | 7.8 | 2021-06-08 | Polaris Office v9.103.83.44230 is affected by a Uninitialized Pointer Vulnerability in PolarisOffice.exe and EngineDLL.dll that may cause a Remote Code Executi… |
CVE-2021-33190 | Medium | 5.3 | 2021-06-08 | In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network acces… |
CVE-2021-33176 | High | 7.5 | 2021-06-08 | VerneMQ MQTT Broker versions prior to 1.12.0 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of un… |
CVE-2021-33175 | High | 7.5 | 2021-06-08 | EMQ X Broker versions prior to 4.2.8 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of untrusted… |
CVE-2021-22214 | Medium | 6.8 | 2021-06-08 | When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting fro… |
CVE-2021-30357 | Medium | 5.3 | 2021-06-08 | SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing… |
CVE-2021-22550 | Medium | 6.5 | 2021-06-08 | An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave. It is recommended to update past 0.6.3… |
CVE-2021-22549 | Medium | 6.5 | 2021-06-08 | An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory. It is recommended to update past 0.6.2 or git commit https… |
CVE-2021-22548 | Medium | 6.5 | 2021-06-08 | An attacker can change the pointer to untrusted memory to point to trusted memory region which causes copying trusted memory to trusted memory, if the latter i… |
CVE-2021-32106 | Medium | 5.4 | 2021-06-08 | In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET['replace'] va… |
CVE-2021-22212 | Medium | 4.0 | 2021-06-08 | ntpkeygen can generate keys that ntpd fails to parse. NTPsec 1.2.0 allows ntpkeygen to generate keys with '#' characters. ntpd then either pads, shortens the k… |
CVE-2021-3564 | Medium | 5.5 | 2021-06-08 | A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth devic… |
CVE-2021-26945 | Medium | 5.5 | 2021-06-08 | An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application co… |
CVE-2021-26260 | Medium | 5.5 | 2021-06-08 | An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to cr… |
CVE-2021-23215 | Medium | 5.5 | 2021-06-08 | An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to cr… |
CVE-2021-23169 | High | 8.8 | 2021-06-08 | A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw to execute arbitrary… |
CVE-2021-22116 | High | 7.5 | 2021-06-08 | RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A… |
CVE-2021-33560 | High | 7.5 | 2021-06-08 | Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_pow… |
CVE-2021-31738 | Medium | 6.1 | 2021-06-08 | Adiscon LogAnalyzer 4.1.10 and 4.1.11 allow login.php XSS. |
CVE-2021-23392 | Medium | 5.3 | 2021-06-08 | The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function. |
CVE-2021-28811 | High | 7.2 | 2021-06-08 | If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. Roon Labs has already fixed this vulnerability in th… |
CVE-2021-28810 | High | 7.5 | 2021-06-08 | If exploited, this vulnerability allows an attacker to access resources which are not otherwise accessible without proper authentication. Roon Labs has already… |
CVE-2021-26080 | Medium | 6.1 | 2021-06-07 | EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8.14.0 before 8.16.1… |
CVE-2021-26079 | Medium | 6.1 | 2021-06-07 | The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, and from version 8… |
CVE-2021-26078 | Medium | 6.1 | 2021-06-07 | The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14… |
CVE-2021-3277 | High | 7.2 | 2021-06-07 | Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes com… |
CVE-2021-32671 | Critical | 10.0 | 2021-06-07 | Flarum is a forum software for building communities. Flarum's translation system allowed for string inputs to be converted into HTML DOM nodes when rendered. T… |
CVE-2021-32670 | High | 7.2 | 2021-06-07 | Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HT… |
CVE-2021-29504 | Critical | 9.1 | 2021-06-07 | WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote at… |
CVE-2021-23391 | High | 7.3 | 2021-06-07 | This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install f… |
CVE-2021-20259 | High | 7.8 | 2021-06-07 | A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with view_hosts p… |
CVE-2021-30543 | High | 8.8 | 2021-06-07 | Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exp… |
CVE-2021-30542 | High | 8.8 | 2021-06-07 | Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exp… |
CVE-2021-30540 | Medium | 6.5 | 2021-06-07 | Incorrect security UI in payments in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform domain spoofing via a crafted HTML pag… |
CVE-2021-30539 | Medium | 5.4 | 2021-06-07 | Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy v… |
CVE-2021-30538 | Medium | 4.3 | 2021-06-07 | Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy v… |
CVE-2021-30537 | Medium | 4.3 | 2021-06-07 | Insufficient policy enforcement in cookies in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass cookie policy via a crafted HTML page. |
CVE-2021-30536 | High | 8.1 | 2021-06-07 | Out of bounds read in V8 in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. |
CVE-2021-30535 | High | 8.8 | 2021-06-07 | Double free in ICU in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30534 | Medium | 6.5 | 2021-06-07 | Insufficient policy enforcement in iFrameSandbox in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a craft… |
CVE-2021-30533 | Medium | 6.5 | 2021-06-07 | Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafte… |
CVE-2021-30532 | Medium | 4.3 | 2021-06-07 | Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy v… |
CVE-2021-30531 | Medium | 6.5 | 2021-06-07 | Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy v… |
CVE-2021-30530 | High | 8.8 | 2021-06-07 | Out of bounds memory access in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted H… |
CVE-2021-30529 | High | 8.8 | 2021-06-07 | Use after free in Bookmarks in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exp… |
CVE-2021-30528 | High | 8.8 | 2021-06-07 | Use after free in WebAuthentication in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker who had compromised the renderer process of a u… |
CVE-2021-30527 | High | 8.8 | 2021-06-07 | Use after free in WebUI in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit… |
CVE-2021-30526 | High | 8.8 | 2021-06-07 | Out of bounds write in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to perform an… |
CVE-2021-30525 | High | 8.8 | 2021-06-07 | Use after free in TabGroups in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exp… |
CVE-2021-30524 | High | 8.8 | 2021-06-07 | Use after free in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially expl… |
CVE-2021-30523 | High | 8.8 | 2021-06-07 | Use after free in WebRTC in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet. |
CVE-2021-30522 | High | 8.8 | 2021-06-07 | Use after free in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30521 | High | 8.8 | 2021-06-07 | Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a craft… |
CVE-2021-33896 | Medium | 5.3 | 2021-06-07 | Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via URI-encoded path separators. |
CVE-2021-29621 | Medium | 5.3 | 2021-06-07 | Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non… |
CVE-2021-20699 | Critical | 9.8 | 2021-06-07 | Sharp NEC Displays ((UN462A R1.300 and prior to it, UN462VA R1.300 and prior to it, UN492S R1.300 and prior to it, UN492VS R1.300 and prior to it, UN552A R1.30… |
CVE-2021-20698 | Critical | 9.8 | 2021-06-07 | Sharp NEC Displays (UN462A R1.300 and prior to it, UN462VA R1.300 and prior to it, UN492S R1.300 and prior to it, UN492VS R1.300 and prior to it, UN552A R1.300… |
CVE-2021-20517 | High | 8.8 | 2021-06-07 | IBM WebSphere Application Server Network Deployment 8.5 and 9.0 could allow a remote authenticated attacker to traverse directories. An attacker could send a s… |
CVE-2021-22222 | High | 7.5 | 2021-06-07 | Infinite loop in DVB-S2-BB dissector in Wireshark 3.4.0 to 3.4.5 allows denial of service via packet injection or crafted capture file |
CVE-2021-33904 | Medium | 6.1 | 2021-06-07 | In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. NOTE: The vendor states "there are configurable… |
CVE-2021-29099 | Medium | 5.3 | 2021-06-07 | A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information… |
CVE-2021-24344 | Medium | 4.8 | 2021-06-07 | The Easy Preloader WordPress plugin through 1.0.0 does not sanitise its setting fields, leading to authenticated (admin+) Stored Cross-Site scripting issues |
CVE-2021-24343 | Medium | 4.8 | 2021-06-07 | The iFlyChat WordPress plugin before 4.7.0 does not sanitise its APP ID setting before outputting it back in the page, leading to an authenticated Stored Cross… |
CVE-2021-24342 | Medium | 6.1 | 2021-06-07 | The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*)… |
CVE-2021-24340 | High | 7.5 | 2021-06-07 | The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare… |
CVE-2021-24337 | High | 8.8 | 2021-06-07 | The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped befor… |
CVE-2021-24336 | High | 7.2 | 2021-06-07 | The FlightLog WordPress plugin through 3.0.2 does not sanitise, validate or escape various POST parameters before using them a SQL statement, leading to SQL in… |
CVE-2021-28382 | Medium | 5.4 | 2021-06-07 | Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD. |
CVE-2021-33898 | High | 8.1 | 2021-06-06 | In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deseriali… |
CVE-2021-33879 | High | 8.1 | 2021-06-06 | Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an… |
CVE-2021-33881 | Medium | 4.2 | 2021-06-06 | On NXP MIFARE Ultralight and NTAG cards, an attacker can interrupt a write operation (aka conduct a "tear off" attack) over RFID to bypass a Monotonic Counter… |
CVE-2021-33880 | Medium | 5.9 | 2021-06-06 | The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_aut… |
CVE-2021-32198 | Critical | 9.8 | 2021-06-06 | EmTec ZOC through 8.02.4 allows remote servers to cause a denial of service (Windows GUI hang) by telling the ZOC window to change its title repeatedly at high… |
CVE-2021-31701 | High | 7.5 | 2021-06-06 | Mintty before 3.4.7 mishandles Bracketed Paste Mode. |
CVE-2021-32641 | High | 8.1 | 2021-06-04 | auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including `11.30.0` are vulnerable to reflected XSS. An attacker can execute arbitrar… |
CVE-2021-31252 | Medium | 6.1 | 2021-06-04 | An open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices from CHIYU Technology that can be exploi… |
CVE-2021-31251 | Critical | 9.8 | 2021-06-04 | An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows obtaining a privileg… |
CVE-2021-31250 | Medium | 5.4 | 2021-06-04 | Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of sanitiza… |
CVE-2021-31249 | Medium | 6.5 | 2021-06-04 | A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the p… |
CVE-2021-26928 | Medium | 6.8 | 2021-06-04 | BIRD through 2.0.7 does not provide functionality for password authentication of BGP peers. Because of this, products that use BIRD (which may, for example, in… |
CVE-2021-29500 | High | 7.5 | 2021-06-04 | bubble fireworks is an open source java package relating to Spring Framework. In bubble fireworks before version 2021.BUILD-SNAPSHOT there is a vulnerability i… |
CVE-2021-30520 | High | 8.8 | 2021-06-04 | Use after free in Tab Strip in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to potentially ex… |
CVE-2021-30519 | High | 8.8 | 2021-06-04 | Use after free in Payments in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious payments app to potentially… |
CVE-2021-30518 | High | 8.8 | 2021-06-04 | Heap buffer overflow in Reader Mode in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2021-30517 | High | 8.8 | 2021-06-04 | Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30516 | High | 8.8 | 2021-06-04 | Heap buffer overflow in History in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially explo… |
CVE-2021-30515 | High | 8.8 | 2021-06-04 | Use after free in File API in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30514 | High | 8.8 | 2021-06-04 | Use after free in Autofill in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit he… |
CVE-2021-30513 | High | 8.8 | 2021-06-04 | Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30512 | High | 8.8 | 2021-06-04 | Use after free in Notifications in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially explo… |
CVE-2021-30511 | High | 8.1 | 2021-06-04 | Out of bounds read in Tab Groups in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to perform a… |