2021 CVEs (page 172)
Page 172 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-30510 | High | 8.8 | 2021-06-04 | Use after free in Aura in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-30509 | High | 8.8 | 2021-06-04 | Out of bounds write in Tab Strip in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to perform a… |
CVE-2021-30508 | High | 8.8 | 2021-06-04 | Heap buffer overflow in Media Feeds in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to enable certain features in Chrome to po… |
CVE-2021-30507 | High | 8.8 | 2021-06-04 | Inappropriate implementation in Offline in Google Chrome on Android prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process t… |
CVE-2021-30506 | High | 8.8 | 2021-06-04 | Incorrect security UI in Web App Installs in Google Chrome on Android prior to 90.0.4430.212 allowed an attacker who convinced a user to install a web applicat… |
CVE-2021-1564 | Medium | 6.5 | 2021-06-04 | Multiple vulnerabilities in the implementation of the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) for Cisco Video Surveillance 7000 Serie… |
CVE-2021-1563 | Medium | 6.5 | 2021-06-04 | Multiple vulnerabilities in the implementation of the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) for Cisco Video Surveillance 7000 Serie… |
CVE-2021-1544 | Medium | 5.5 | 2021-06-04 | A vulnerability in logging mechanisms of Cisco Webex Meetings client software could allow an authenticated, local attacker to gain access to sensitive informat… |
CVE-2021-1540 | High | 8.1 | 2021-06-04 | Multiple vulnerabilities in the authorization process of Cisco ASR 5000 Series Software (StarOS) could allow an authenticated, remote attacker to bypass author… |
CVE-2021-1539 | High | 8.1 | 2021-06-04 | Multiple vulnerabilities in the authorization process of Cisco ASR 5000 Series Software (StarOS) could allow an authenticated, remote attacker to bypass author… |
CVE-2021-1538 | Medium | 4.7 | 2021-06-04 | A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to execute arbi… |
CVE-2021-1537 | Medium | 6.2 | 2021-06-04 | A vulnerability in the installer software of Cisco ThousandEyes Recorder could allow an unauthenticated, local attacker to access sensitive information that is… |
CVE-2021-1536 | Medium | 4.8 | 2021-06-04 | A vulnerability in Cisco Webex Meetings Desktop App for Windows, Cisco Webex Meetings Server, Cisco Webex Network Recording Player for Windows, and Cisco Webex… |
CVE-2021-1528 | High | 7.8 | 2021-06-04 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges on an affected system. This vulner… |
CVE-2021-1527 | Medium | 5.3 | 2021-06-04 | A vulnerability in Cisco Webex Player for Windows and MacOS could allow an attacker to cause the affected software to terminate or to gain access to memory sta… |
CVE-2021-1526 | High | 7.8 | 2021-06-04 | A vulnerability in Cisco Webex Player for Windows and MacOS could allow an attacker to execute arbitrary code on an affected system. This vulnerability is due… |
CVE-2021-1525 | Medium | 4.7 | 2021-06-04 | A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to redirect users to a malicious file… |
CVE-2021-1517 | Medium | 5.0 | 2021-06-04 | A vulnerability in the multimedia viewer feature of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an authenticated, remote attacker to bypas… |
CVE-2021-1503 | High | 7.8 | 2021-06-04 | A vulnerability in Cisco Webex Network Recording Player for Windows and MacOS and Cisco Webex Player for Windows and MacOS could allow an attacker to execute a… |
CVE-2021-1502 | High | 7.8 | 2021-06-04 | A vulnerability in Cisco Webex Network Recording Player for Windows and MacOS and Cisco Webex Player for Windows and MacOS could allow an attacker to execute a… |
CVE-2021-33054 | High | 7.5 | 2021-06-04 | SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to th… |
CVE-2021-28091 | High | 7.5 | 2021-06-04 | Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. |
CVE-2021-27657 | High | 8.8 | 2021-06-04 | Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them t… |
CVE-2021-30475 | Critical | 9.8 | 2021-06-04 | aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow. |
CVE-2021-22516 | High | 7.5 | 2021-06-04 | Insertion of Sensitive Information into Log File vulnerability in Micro Focus Secure API Manager (SAPIM) product, affecting version 2.0.0. The vulnerability co… |
CVE-2021-3565 | Medium | 5.9 | 2021-06-04 | A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM a… |
CVE-2021-26994 | Medium | 6.5 | 2021-06-04 | Clustered Data ONTAP versions prior to 9.7P13 and 9.8P3 are susceptible to a vulnerability which could allow single workloads to cause a Denial of Service (DoS… |
CVE-2021-3491 | High | 7.8 | 2021-06-04 | The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being u… |
CVE-2021-3490 | High | 7.8 | 2021-06-04 | The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of b… |
CVE-2021-3489 | High | 7.8 | 2021-06-04 | The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attack… |
CVE-2021-33840 | High | 7.5 | 2021-06-04 | The server in Luca through 1.1.14 allows remote attackers to cause a denial of service (insertion of many fake records related to COVID-19) because Phone Numbe… |
CVE-2021-33839 | High | 7.5 | 2021-06-04 | Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because the QR code of a Public Location can be i… |
CVE-2021-33838 | High | 7.5 | 2021-06-04 | Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because requests related to Check-In State occur… |
CVE-2021-32666 | Medium | 6.5 | 2021-06-03 | wire-ios is the iOS version of Wire, an open-source secure messaging app. In wire-ios versions 3.8.0 and prior, a vulnerability exists that can cause a denial… |
CVE-2021-32662 | Medium | 6.5 | 2021-06-03 | Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In `@backstage/tech… |
CVE-2021-32665 | High | 8.8 | 2021-06-03 | wire-ios is the iOS version of Wire, an open-source secure messaging app. wire-ios versions 3.8.0 and earlier have a bug in which a conversation could be incor… |
CVE-2021-3469 | Medium | 5.4 | 2021-06-03 | Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-pr… |
CVE-2021-25947 | Critical | 9.8 | 2021-06-03 | Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code executio… |
CVE-2021-22337 | Medium | 5.3 | 2021-06-03 | There is an Information Disclosure vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause leaking of user click data. |
CVE-2021-22335 | High | 7.8 | 2021-06-03 | There is a Memory Buffer Improper Operation Limit vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause exceptions in ima… |
CVE-2021-22334 | High | 7.4 | 2021-06-03 | There is an Improper Access Control vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause app redirections. |
CVE-2021-22333 | Critical | 9.8 | 2021-06-03 | There is an Improper Validation of Array Index vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause code to execute, thu… |
CVE-2021-32661 | Medium | 6.8 | 2021-06-03 | Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin (`@backstage/plugin-techdocs`) prior to 0.9.5, a malic… |
CVE-2021-33815 | High | 8.8 | 2021-06-03 | dwa_uncompress in libavcodec/exr.c in FFmpeg 4.4 allows an out-of-bounds array access because dc_count is not strictly checked. |
CVE-2021-32660 | Medium | 6.8 | 2021-06-03 | Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of `@ba… |
CVE-2021-22336 | High | 7.5 | 2021-06-03 | There is an Improper Control of Generation of Code vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause denial of securi… |
CVE-2021-22325 | Medium | 5.3 | 2021-06-03 | There is an Information Disclosure vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may result in video streams being intercep… |
CVE-2021-22324 | High | 7.5 | 2021-06-03 | There is a Credentials Management Errors vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may impair data confidentiality. |
CVE-2021-22322 | High | 7.5 | 2021-06-03 | There is a Missing Authentication for Critical Function vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may impair data confi… |
CVE-2021-22317 | High | 7.5 | 2021-06-03 | There is an Information Disclosure vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may impair data confidentiality. |
CVE-2021-22316 | Medium | 6.8 | 2021-06-03 | There is a Missing Authentication for Critical Function vulnerability in Huawei Smartphone. Attackers with physical access to the device can thereby exploit th… |
CVE-2021-22313 | High | 7.5 | 2021-06-03 | There is a Security Function vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may impair data confidentiality. |
CVE-2021-22308 | Low | 3.3 | 2021-06-03 | There is a Business Logic Errors vulnerability in Huawei Smartphone. The malicious apps installed on the device can keep taking screenshots in the background… |
CVE-2021-32460 | High | 7.8 | 2021-06-03 | The Trend Micro Maximum Security 2021 (v17) consumer product is vulnerable to an improper access control vulnerability in the installer which could allow a loc… |
CVE-2021-24023 | High | 7.8 | 2021-06-03 | An improper input validation in FortiAI v1.4.0 and earlier may allow an authenticated user to gain system shell access via a malicious payload in the "diagnose… |
CVE-2021-20380 | High | 7.5 | 2021-06-03 | IBM QRadar Advisor With Watson App 1.1 through 2.5 as used on IBM QRadar SIEM 7.4 could allow a remote user to obtain sensitive information from HTTP requests… |
CVE-2021-32926 | High | 7.5 | 2021-06-03 | When an authenticated password change request takes place, this vulnerability could allow the attacker to intercept the message that includes the legitimate, n… |
CVE-2021-3569 | Medium | 5.5 | 2021-06-03 | A stack corruption bug was found in libtpms in versions before 0.7.2 and before 0.8.0 while decrypting data using RSA. This flaw could result in a SIGBUS (bad… |
CVE-2021-33806 | Critical | 9.8 | 2021-06-03 | The BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as par… |
CVE-2021-28848 | High | 7.5 | 2021-06-03 | Mintty before 3.4.5 allows remote servers to cause a denial of service (Windows GUI hang) by telling the Mintty window to change its title repeatedly at high s… |
CVE-2021-32923 | High | 7.4 | 2021-06-03 | HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their… |
CVE-2021-31830 | Medium | 5.9 | 2021-06-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows an… |
CVE-2021-28847 | High | 7.5 | 2021-06-03 | MobaXterm before 21.0 allows remote servers to cause a denial of service (Windows GUI hang) via tab title change requests that are sent repeatedly at high spee… |
CVE-2021-26584 | Medium | 6.1 | 2021-06-03 | A security vulnerability in HPE OneView for VMware vCenter (OV4VC) could be exploited remotely to allow Cross-Site Scripting. HPE has released the following so… |
CVE-2021-22130 | Medium | 6.7 | 2021-06-03 | A stack-based buffer overflow vulnerability in FortiProxy physical appliance CLI 2.0.0 to 2.0.1, 1.2.0 to 1.2.9, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 may allow an au… |
CVE-2021-31831 | Medium | 4.9 | 2021-06-03 | Incorrect access to deleted scripts vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to gain access to s… |
CVE-2021-28812 | High | 8.8 | 2021-06-03 | A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to ex… |
CVE-2021-28807 | High | 7.7 | 2021-06-03 | A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attacke… |
CVE-2021-28806 | Medium | 5.7 | 2021-06-03 | A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malic… |
CVE-2021-29670 | Medium | 5.4 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2021-29668 | Medium | 5.4 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2021-20371 | Medium | 6.5 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is returned in the browser… |
CVE-2021-20348 | Medium | 5.4 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unautho… |
CVE-2021-20347 | Medium | 5.4 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unautho… |
CVE-2021-20346 | Medium | 5.4 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unautho… |
CVE-2021-20345 | Medium | 5.4 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unautho… |
CVE-2021-20343 | Medium | 5.4 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unautho… |
CVE-2021-20338 | Medium | 5.4 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2021-32625 | High | 7.5 | 2021-06-02 | Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version… |
CVE-2021-3529 | High | 7.1 | 2021-06-02 | A flaw was found in noobaa-core in versions before 5.7.0. This flaw results in the name of an arbitrarily URL being copied into an HTML document as plain text… |
CVE-2021-30474 | Critical | 9.8 | 2021-06-02 | aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free. |
CVE-2021-3499 | Medium | 5.6 | 2021-06-02 | A vulnerability was found in OVN Kubernetes in versions up to and including 0.3.0 where the Egress Firewall does not reliably apply firewall rules when there i… |
CVE-2021-3468 | Medium | 5.5 | 2021-06-02 | A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socket is not correctl… |
CVE-2021-31921 | Critical | 9.8 | 2021-06-02 | Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster… |
CVE-2021-31855 | Medium | 6.5 | 2021-06-02 | KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations. Deleting an attachment of a decrypted encrypted message stored on a r… |
CVE-2021-28678 | Medium | 5.5 | 2021-06-02 | An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. T… |
CVE-2021-28677 | High | 7.5 | 2021-06-02 | An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as… |
CVE-2021-28676 | High | 7.5 | 2021-06-02 | An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an i… |
CVE-2021-25288 | Critical | 9.1 | 2021-06-02 | An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i. |
CVE-2021-25287 | Critical | 9.1 | 2021-06-02 | An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la. |
CVE-2021-3530 | High | 7.5 | 2021-06-02 | A flaw was discovered in GNU libiberty within demangle_path() in rust-demangle.c, as distributed in GNU Binutils version 2.36. A crafted symbol can cause stack… |
CVE-2021-3522 | Medium | 5.5 | 2021-06-02 | GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags. |
CVE-2021-28675 | Medium | 5.5 | 2021-06-02 | An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the dat… |
CVE-2021-26707 | Critical | 9.8 | 2021-06-02 | The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties… |
CVE-2021-3546 | High | 8.2 | 2021-06-02 | An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw occur… |
CVE-2021-3545 | Medium | 6.5 | 2021-06-02 | An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw ex… |
CVE-2021-3544 | Medium | 6.5 | 2021-06-02 | Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They exist in contrib/vhost-u… |
CVE-2021-3538 | Critical | 9.8 | 2021-06-02 | A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45. Due… |
CVE-2021-23896 | Low | 3.2 | 2021-06-02 | Cleartext Transmission of Sensitive Information vulnerability in the administrator interface of McAfee Database Security (DBSec) prior to 4.8.2 allows an admin… |
CVE-2021-3520 | Critical | 9.8 | 2021-06-02 | There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling… |