2021 CVEs (page 173)
Page 173 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-24012 | Medium | 6.5 | 2021-06-02 | An improper following of a certificate's chain of trust vulnerability in FortiGate versions 6.4.0 to 6.4.4 may allow an LDAP user to connect to SSLVPN with any… |
CVE-2021-23895 | Critical | 9.0 | 2021-06-02 | Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to create a reverse s… |
CVE-2021-23894 | Critical | 9.6 | 2021-06-02 | Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote unauthenticated attacker to create a reverse… |
CVE-2021-29089 | Critical | 9.8 | 2021-06-02 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8… |
CVE-2021-29091 | High | 7.7 | 2021-06-02 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo Station before 6.8… |
CVE-2021-29090 | High | 7.2 | 2021-06-02 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Station before 6.8.14-350… |
CVE-2021-32657 | Medium | 4.3 | 2021-06-01 | Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a malicious user may… |
CVE-2021-32656 | High | 8.6 | 2021-06-01 | Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 20.0.10, and 21.0.2… |
CVE-2021-32655 | Low | 3.5 | 2021-06-01 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to convert a Files Dr… |
CVE-2021-32654 | High | 8.1 | 2021-06-01 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive write/read… |
CVE-2021-3425 | Medium | 4.4 | 2021-06-01 | A flaw was found in the AMQ Broker that discloses JDBC encrypted usernames and passwords when provided in the AMQ Broker application logfile when using the jdb… |
CVE-2021-32653 | Low | 2.7 | 2021-06-01 | Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server versions prior to 19.0.11, 20.0.10, or 21.0.2 send user IDs to the lookup s… |
CVE-2021-31684 | High | 7.5 | 2021-06-01 | A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a c… |
CVE-2021-26111 | Medium | 6.5 | 2021-06-01 | A missing release of memory after effective lifetime vulnerability in FortiSwitch 6.4.0 to 6.4.6, 6.2.0 to 6.2.6, 6.0.0 to 6.0.6, 3.6.11 and below may allow an… |
CVE-2021-22123 | High | 7.6 | 2021-06-01 | An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated… |
CVE-2021-3424 | Medium | 5.3 | 2021-06-01 | A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a na… |
CVE-2021-32652 | High | 8.8 | 2021-06-01 | Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1.8.2 allows another authenticated users… |
CVE-2021-32924 | High | 8.8 | 2021-06-01 | Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\_builder… |
CVE-2021-32651 | Low | 3.1 | 2021-06-01 | OneDev is a development operations platform. If the LDAP external authentication mechanism is enabled in OneDev versions 4.4.1 and prior, an attacker can manip… |
CVE-2021-31643 | Medium | 5.4 | 2021-06-01 | An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a lack of sanitization… |
CVE-2021-31642 | Medium | 6.5 | 2021-06-01 | A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630, BF-631, a… |
CVE-2021-31641 | Medium | 6.1 | 2021-06-01 | An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology, including BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass… |
CVE-2021-3543 | Medium | 6.7 | 2021-06-01 | A flaw null pointer dereference in the Nitro Enclaves kernel driver was found in the way that Enclaves VMs forces closures on the enclave file descriptor. A lo… |
CVE-2021-3516 | High | 7.8 | 2021-06-01 | There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-… |
CVE-2021-3515 | Medium | 6.7 | 2021-06-01 | A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26. An attacker with CREATEDB privileges on a PostgreSQL server can craft… |
CVE-2021-3495 | High | 8.8 | 2021-06-01 | An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw allows an attacker with a basic level o… |
CVE-2021-3412 | High | 7.3 | 2021-06-01 | It was found that all versions of 3Scale developer portal lacked brute force protections. An attacker could use this gap to bypass login controls, and access p… |
CVE-2021-33184 | High | 7.7 | 2021-06-01 | Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15-3563 allows remote authenticated users… |
CVE-2021-33183 | High | 7.9 | 2021-06-01 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability container volume management component in Synology Docker before 18… |
CVE-2021-33182 | Medium | 5.0 | 2021-06-01 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in PDF Viewer component in Synology DiskStation Manager (DSM) befo… |
CVE-2021-33181 | Medium | 6.6 | 2021-06-01 | Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arb… |
CVE-2021-33180 | High | 7.3 | 2021-06-01 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in Synology Media Server before 1.8.1-2876… |
CVE-2021-32647 | High | 8.0 | 2021-06-01 | Emissary is a P2P based data-driven workflow engine. Affected versions of Emissary are vulnerable to post-authentication Remote Code Execution (RCE). The [`Cre… |
CVE-2021-32027 | High | 8.8 | 2021-06-01 | A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, mi… |
CVE-2021-30181 | Critical | 9.8 | 2021-06-01 | Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by th… |
CVE-2021-30180 | Critical | 9.8 | 2021-06-01 | Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers wh… |
CVE-2021-30179 | Critical | 9.8 | 2021-06-01 | Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by t… |
CVE-2021-29740 | High | 7.8 | 2021-06-01 | IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.3 system core component is affected by a format string security vulnerability. An attacker cou… |
CVE-2021-29665 | High | 7.8 | 2021-06-01 | IBM Security Verify Access 20.07 is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow a local attacker to execu… |
CVE-2021-29092 | High | 8.8 | 2021-06-01 | Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authentic… |
CVE-2021-29088 | High | 7.8 | 2021-06-01 | Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows… |
CVE-2021-25641 | Critical | 9.8 | 2021-06-01 | Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or… |
CVE-2021-25640 | Medium | 6.1 | 2021-06-01 | In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulner… |
CVE-2021-24335 | Medium | 6.1 | 2021-06-01 | The Car Repair Services & Auto Mechanic WordPress theme before 4.0 did not properly sanitise its serviceestimatekey search parameter before outputting it back… |
CVE-2021-24334 | Medium | 5.4 | 2021-06-01 | The Instant Images – One Click Unsplash Uploads WordPress plugin before 4.4.0.1 did not properly validate and sanitise its unsplash_download_w and unsplash_dow… |
CVE-2021-24333 | Medium | 6.5 | 2021-06-01 | The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and… |
CVE-2021-24331 | Medium | 4.8 | 2021-06-01 | The Smooth Scroll Page Up/Down Buttons WordPress plugin before 1.4 did not properly sanitise and validate its settings, such as psb_distance, psb_buttonsize, p… |
CVE-2021-24330 | Medium | 4.8 | 2021-06-01 | The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin before 1.6.13 did not sanitise its facebook_pixel_id and google_ana… |
CVE-2021-24329 | Medium | 5.4 | 2021-06-01 | The WP Super Cache WordPress plugin before 1.7.3 did not properly sanitise its wp_cache_location parameter in its settings, which could lead to a Stored Cross-… |
CVE-2021-24328 | Medium | 6.2 | 2021-06-01 | The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. Th… |
CVE-2021-24322 | Medium | 5.4 | 2021-06-01 | The Database Backup for WordPress plugin before 2.4 did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tag… |
CVE-2021-24321 | Critical | 9.8 | 2021-06-01 | The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_now_open, bt_bb_listi… |
CVE-2021-24320 | Medium | 6.1 | 2021-06-01 | The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field_my_lat, bt_bb_list… |
CVE-2021-24319 | Medium | 5.4 | 2021-06-01 | The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-acco… |
CVE-2021-24318 | Medium | 6.5 | 2021-06-01 | The Listeo WordPress theme before 1.6.11 did not ensure that the Post/Page and Booking to delete belong to the user making the request, allowing any authentica… |
CVE-2021-24317 | Medium | 6.1 | 2021-06-01 | The Listeo WordPress theme before 1.6.11 did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to C… |
CVE-2021-24316 | Medium | 6.1 | 2021-06-01 | The search feature of the Mediumish WordPress theme through 1.0.47 does not properly sanitise it's 's' GET parameter before output it back the page, leading to… |
CVE-2021-24313 | Medium | 5.4 | 2021-06-01 | The WP Prayer WordPress plugin before 1.6.2 provides the functionality to store requested prayers/praises and list them on a WordPress website. These stored pr… |
CVE-2021-24312 | High | 7.2 | 2021-06-01 | The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super C… |
CVE-2021-24311 | High | 8.8 | 2021-06-01 | The wp_ajax_upload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitrary file uploads via any authenticated… |
CVE-2021-24310 | Medium | 4.8 | 2021-06-01 | The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the gallery title, allowing high privilege… |
CVE-2021-24309 | Medium | 5.4 | 2021-06-01 | The "Schedule Name" input in the Weekly Schedule WordPress plugin before 3.4.3 general options did not properly sanitize input, allowing a user to inject javas… |
CVE-2021-23388 | Medium | 5.3 | 2021-06-01 | The package forms before 1.2.1, from 1.3.0 and before 1.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via email validation. |
CVE-2021-20585 | Medium | 5.3 | 2021-06-01 | IBM Security Verify Access 20.07 could disclose sensitive information in HTTP server headers that could be used in further attacks against the system. IBM X-Fo… |
CVE-2021-20576 | High | 7.5 | 2021-06-01 | IBM Security Verify Access 20.07 could allow a remote attacker to send a specially crafted HTTP GET request that could cause the application to crash. |
CVE-2021-20575 | Low | 3.3 | 2021-06-01 | IBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by another user on the system. X-Force ID: 199278. |
CVE-2021-20306 | Medium | 4.3 | 2021-06-01 | A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projec… |
CVE-2021-23021 | Medium | 5.5 | 2021-06-01 | The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission bits set to 644. |
CVE-2021-23020 | Medium | 5.5 | 2021-06-01 | The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which could lead to predictable keys. |
CVE-2021-23019 | High | 7.8 | 2021-06-01 | The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support… |
CVE-2021-23017 | High | 7.7 | 2021-06-01 | A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory ov… |
CVE-2021-27828 | Critical | 9.1 | 2021-06-01 | SQL injection in In4Suite ERP 3.2.74.1370 allows attackers to modify or delete data, causing persistent changes to the application's content or behavior by usi… |
CVE-2021-25932 | Medium | 5.4 | 2021-06-01 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation… |
CVE-2021-23018 | High | 7.4 | 2021-06-01 | Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protocols inside the clus… |
CVE-2021-33790 | Critical | 9.8 | 2021-05-31 | The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of reborncore.c… |
CVE-2021-33564 | Critical | 9.8 | 2021-05-29 | An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL w… |
CVE-2021-31703 | Critical | 9.8 | 2021-05-29 | Frontier ichris through 5.18 allows users to upload malicious executable files that might later be downloaded and run by any client user. |
CVE-2021-31702 | High | 7.5 | 2021-05-29 | Frontier ichris through 5.18 mishandles making a DNS request for the hostname in the HTTP Host header, as demonstrated by submitting 127.0.0.1 multiple times f… |
CVE-2021-30461 | Critical | 9.8 | 2021-05-29 | A remote code execution issue was discovered in the web UI of VoIPmonitor before 24.61. When the recheck option is used, the user-supplied SPOOLDIR value (whic… |
CVE-2021-32635 | Medium | 6.3 | 2021-05-28 | Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, `singularity` action commands (`run`/`shel… |
CVE-2021-32621 | High | 8.8 | 2021-05-28 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 12.6.7 and 12.10.3, a user withou… |
CVE-2021-32620 | High | 8.8 | 2021-05-28 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a… |
CVE-2021-32619 | Critical | 9.8 | 2021-05-28 | Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, modules that are dynamically imported thro… |
CVE-2021-32616 | High | 8.1 | 2021-05-28 | 1CDN is open-source file sharing software. In 1CDN before commit f88a2730fa50fc2c2aeab09011f6f142fd90ec25, there is a basic cross-site scripting vulnerability… |
CVE-2021-29507 | Medium | 5.7 | 2021-05-28 | GENIVI Diagnostic Log and Trace (DLT) provides a log and trace interface. In versions of GENIVI DLT between 2.10.0 and 2.18.6, a configuration file containing… |
CVE-2021-29505 | High | 7.5 | 2021-05-28 | XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has suf… |
CVE-2021-29492 | High | 8.1 | 2021-05-28 | Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP URL paths in versions 1.18.2 and befor… |
CVE-2021-33587 | High | 7.5 | 2021-05-28 | The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input. |
CVE-2021-22519 | Critical | 9.8 | 2021-05-28 | Execute arbitrary code vulnerability in Micro Focus SiteScope product, affecting versions 11.40,11.41 , 2018.05(11.50), 2018.08(11.51), 2018.11(11.60), 2019.02… |
CVE-2021-20267 | High | 7.1 | 2021-05-28 | A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance conne… |
CVE-2021-33623 | High | 7.5 | 2021-05-28 | The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() met… |
CVE-2021-32646 | Medium | 5.3 | 2021-05-28 | Roomer is a discord bot cog (extension) which provides automatic voice channel generation as well as private voice and text channels. A vulnerability has been… |
CVE-2021-32642 | High | 7.0 | 2021-05-28 | radsecproxy is a generic RADIUS proxy that supports both UDP and TLS (RadSec) RADIUS transports. Missing input validation in radsecproxy's `naptr-eduroam.sh` a… |
CVE-2021-32637 | Critical | 10.0 | 2021-05-28 | Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngx_http_auth_request_module with Authelia, it allows a… |
CVE-2021-3514 | Medium | 6.5 | 2021-05-28 | When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query, causing a crash. |
CVE-2021-29629 | High | 7.5 | 2021-05-28 | In FreeBSD 13.0-STABLE before n245765-bec0d2c9c841, 12.2-STABLE before r369859, 11.4-STABLE before r369866, 13.0-RELEASE before p1, 12.2-RELEASE before p7, and… |
CVE-2021-29628 | High | 7.5 | 2021-05-28 | In FreeBSD 13.0-STABLE before n245764-876ffe28796c, 12.2-STABLE before r369857, 13.0-RELEASE before p1, and 12.2-RELEASE before p7, a system call triggering a… |
CVE-2021-33620 | Medium | 6.5 | 2021-05-28 | Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. The iss… |
CVE-2021-27032 | High | 7.8 | 2021-05-28 | Autodesk Licensing Installer was found to be vulnerable to privilege escalation issues. A malicious user with limited privileges could run any number of tools… |
CVE-2021-21734 | Medium | 6.5 | 2021-05-28 | Some PON MDU devices of ZTE stored sensitive information in plaintext, and users with login authority can obtain it by inputing command. This affects: ZTE PON… |