2021 CVEs (page 175)
Page 175 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-22733 | High | 7.8 | 2021-05-26 | Improper Privilege Management vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause shell access when unauthorized c… |
CVE-2021-22732 | High | 7.8 | 2021-05-26 | Improper Privilege Management vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause a code execution issue when an a… |
CVE-2021-22731 | Critical | 9.8 | 2021-05-26 | Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior which could cause an… |
CVE-2021-22705 | High | 7.8 | 2021-05-26 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service or unauthorized access to syste… |
CVE-2021-22699 | High | 7.5 | 2021-05-26 | Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that could cause denial of service when specif… |
CVE-2021-33470 | Critical | 9.8 | 2021-05-26 | COVID19 Testing Management System 1.0 is vulnerable to SQL Injection via the admin panel. |
CVE-2021-33469 | Medium | 4.8 | 2021-05-26 | COVID19 Testing Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the "Admin name" parameter. |
CVE-2021-20492 | High | 8.2 | 2021-05-26 | IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data… |
CVE-2021-20487 | Critical | 9.1 | 2021-05-26 | IBM Power9 Self Boot Engine(SBE) could allow a privileged user to inject malicious code and compromise the integrity of the host firmware bypassing the host fi… |
CVE-2021-20486 | Medium | 6.5 | 2021-05-26 | IBM Cloud Pak for Data 3.0 could allow an authenticated user to obtain sensitive information when installed with additional plugins. IBM X-Force ID: 197668. |
CVE-2021-33506 | High | 7.5 | 2021-05-26 | jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrict_room_creation is set by default. This can allow an attacker to circumvent conf… |
CVE-2021-33194 | High | 7.5 | 2021-05-26 | golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input. |
CVE-2021-25945 | Critical | 9.8 | 2021-05-26 | Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code executio… |
CVE-2021-21986 | Critical | 9.8 | 2021-05-26 | The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Ma… |
CVE-2021-21985 | Critical | 9.8 | 2021-05-26 | The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enab… |
CVE-2021-33038 | High | 7.5 | 2021-05-26 | An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty through 1.3.4. When importing a private mailing list's archives, these archiv… |
CVE-2021-32457 | High | 7.8 | 2021-05-26 | Trend Micro Home Network Security version 6.6.604 and earlier is vulnerable to an iotcl stack-based buffer overflow vulnerability which could allow an attacker… |
CVE-2021-22160 | Critical | 9.8 | 2021-05-26 | If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorith… |
CVE-2021-20178 | Medium | 5.5 | 2021-05-26 | A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbu… |
CVE-2021-27676 | Medium | 5.4 | 2021-05-26 | Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name)… |
CVE-2021-26034 | Medium | 6.5 | 2021-05-26 | An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in com_banners and com_sy… |
CVE-2021-26033 | Medium | 6.5 | 2021-05-26 | An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint. |
CVE-2021-26032 | Medium | 6.1 | 2021-05-26 | An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors. |
CVE-2021-22543 | High | 7.8 | 2021-05-26 | An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while sti… |
CVE-2021-29253 | Medium | 5.1 | 2021-05-26 | The Tableau integration in RSA Archer 6.4 P1 (6.4.0.1) through 6.9 P2 (6.9.0.2) is affected by an insecure credential storage vulnerability. An malicious attac… |
CVE-2021-29252 | Medium | 5.4 | 2021-05-26 | RSA Archer before 6.9 SP1 P1 (6.9.1.1) contains a stored XSS vulnerability. A remote authenticated malicious Archer user with access to modify link name fields… |
CVE-2021-31924 | Medium | 6.8 | 2021-05-26 | Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This iss… |
CVE-2021-33575 | Critical | 9.8 | 2021-05-25 | The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load duri… |
CVE-2021-33574 | Critical | 9.8 | 2021-05-25 | The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (pass… |
CVE-2021-33570 | Medium | 5.4 | 2021-05-25 | Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vecto… |
CVE-2021-20209 | High | 7.5 | 2021-05-25 | A memory leak vulnerability was found in Privoxy before 3.0.29 in the show-status CGI handler when no action files are configured. |
CVE-2021-32640 | Medium | 5.3 | 2021-05-25 | ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significa… |
CVE-2021-27562 | Medium | 5.5 | 2021-05-25 | In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling sec… |
CVE-2021-25946 | Critical | 9.8 | 2021-05-25 | Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead to remote code exec… |
CVE-2021-25944 | Critical | 9.8 | 2021-05-25 | Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code exec… |
CVE-2021-25935 | Medium | 5.4 | 2021-05-25 | In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2… |
CVE-2021-25934 | Medium | 5.4 | 2021-05-25 | In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2… |
CVE-2021-3320 | Medium | 5.9 | 2021-05-25 | Type Confusion in 802154 ACK Frames Handling. Zephyr versions >= v2.4.0 contain NULL Pointer Dereference (CWE-476). For more information, see https://github.co… |
CVE-2021-32638 | Medium | 4.4 | 2021-05-25 | Github's CodeQL action is provided to run CodeQL-based code scanning on non-GitHub CI/CD systems and requires a GitHub access token to connect to a GitHub repo… |
CVE-2021-29708 | Medium | 6.7 | 2021-05-25 | IBM Spectrum Scale 5.1.0.1 could allow a local with access to the GUI pod container to obtain sensitive cryptographic keys that could allow them to elevate the… |
CVE-2021-29695 | Medium | 6.5 | 2021-05-25 | IBM Host firmware for LC-class Systems could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL requ… |
CVE-2021-23937 | High | 7.5 | 2021-05-25 | A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the serv… |
CVE-2021-21660 | Medium | 5.4 | 2021-05-25 | Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2021-21659 | High | 8.1 | 2021-05-25 | Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21658 | Critical | 9.1 | 2021-05-25 | Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21657 | High | 8.8 | 2021-05-25 | Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-29211 | Medium | 4.8 | 2021-05-25 | A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Se… |
CVE-2021-29210 | Medium | 4.8 | 2021-05-25 | A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO… |
CVE-2021-29209 | Medium | 4.8 | 2021-05-25 | A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO… |
CVE-2021-29208 | Medium | 4.8 | 2021-05-25 | A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO… |
CVE-2021-33425 | Medium | 5.4 | 2021-05-25 | A stored cross-site scripting (XSS) vulnerability was discovered in the Web Interface for OpenWRT LuCI version 19.07 which allows attackers to inject arbitrary… |
CVE-2021-29207 | Medium | 4.8 | 2021-05-25 | A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Se… |
CVE-2021-29206 | Medium | 4.8 | 2021-05-25 | A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Se… |
CVE-2021-29205 | Medium | 4.8 | 2021-05-25 | A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Se… |
CVE-2021-29204 | Medium | 4.8 | 2021-05-25 | A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Se… |
CVE-2021-29202 | Medium | 6.7 | 2021-05-25 | A local buffer overflow vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for H… |
CVE-2021-29201 | Medium | 4.8 | 2021-05-25 | A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Se… |
CVE-2021-27823 | High | 7.5 | 2021-05-25 | An information disclosure vulnerability was discovered in /index.class.php (via port 8181) on NetWave System 1.0 which allows unauthenticated attackers to exfi… |
CVE-2021-27821 | Medium | 6.1 | 2021-05-25 | The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting vulnerability. |
CVE-2021-30195 | High | 7.5 | 2021-05-25 | CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation. |
CVE-2021-30194 | Critical | 9.1 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read. |
CVE-2021-30193 | Critical | 9.8 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write. |
CVE-2021-30192 | Critical | 9.8 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check. |
CVE-2021-30191 | High | 7.5 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has a a Buffer Copy without Checking the Size of the Input. |
CVE-2021-30190 | Critical | 9.8 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control. |
CVE-2021-30189 | Critical | 9.8 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow. |
CVE-2021-30188 | Critical | 9.8 | 2021-05-25 | CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow. |
CVE-2021-30186 | High | 7.5 | 2021-05-25 | CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow. |
CVE-2021-30187 | Medium | 5.3 | 2021-05-25 | CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command. |
CVE-2021-20096 | High | 8.1 | 2021-05-25 | Cross-site request forgery in OpenOversight 0.6.4 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking… |
CVE-2021-33563 | High | 7.5 | 2021-05-24 | Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brut… |
CVE-2021-33562 | Medium | 4.8 | 2021-05-24 | A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref param… |
CVE-2021-33561 | Medium | 4.8 | 2021-05-24 | A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customer_name in… |
CVE-2021-33525 | High | 8.8 | 2021-05-24 | EyesOfNetwork eonweb through 5.3-11 allows Remote Command Execution (by authenticated users) via shell metacharacters in the nagios_path parameter to lilac/exp… |
CVE-2021-30108 | Critical | 9.1 | 2021-05-24 | Feehi CMS 2.1.1 is affected by a Server-side request forgery (SSRF) vulnerability. When the user modifies the HTTP Referer header to any url, the server can ma… |
CVE-2021-23387 | Medium | 5.4 | 2021-05-24 | The package trailing-slash before 2.0.1 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoin… |
CVE-2021-30083 | Medium | 6.1 | 2021-05-24 | An issue was discovered in Mediat 1.4.1. There is a Reflected XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML without au… |
CVE-2021-30082 | Medium | 6.1 | 2021-05-24 | An issue was discovered in Gris CMS v0.1. There is a Persistent XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML via admi… |
CVE-2021-30081 | High | 8.8 | 2021-05-24 | An issue was discovered in emlog 6.0.0stable. There is a SQL Injection vulnerability that can execute any SQL statement and query server sensitive data via adm… |
CVE-2021-29256 | High | 8.8 | 2021-05-24 | . The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation… |
CVE-2021-32624 | High | 7.5 | 2021-05-24 | Keystone 5 is an open source CMS platform to build Node.js applications. This security advisory relates to a newly discovered capability in our query infrastru… |
CVE-2021-33502 | High | 7.5 | 2021-05-24 | The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it… |
CVE-2021-32629 | High | 7.2 | 2021-05-24 | Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into executable mach… |
CVE-2021-29300 | Critical | 9.8 | 2021-05-24 | The @ronomon/opened library before 1.5.2 is vulnerable to a command injection vulnerability which would allow a remote attacker to execute commands on the syst… |
CVE-2021-33516 | High | 8.1 | 2021-05-24 | An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to… |
CVE-2021-3485 | Medium | 6.4 | 2021-05-24 | An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker t… |
CVE-2021-20557 | High | 7.2 | 2021-05-24 | IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM… |
CVE-2021-20428 | Medium | 5.3 | 2021-05-24 | IBM Security Guardium 11.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. Th… |
CVE-2021-20426 | Critical | 9.8 | 2021-05-24 | IBM Security Guardium 11.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound… |
CVE-2021-20419 | High | 7.5 | 2021-05-24 | IBM Security Guardium 11.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2021-20389 | High | 7.8 | 2021-05-24 | IBM Security Guardium 11.2 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 195770. |
CVE-2021-20386 | Medium | 6.1 | 2021-05-24 | IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2021-20385 | High | 7.2 | 2021-05-24 | IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an… |
CVE-2021-32075 | Critical | 9.8 | 2021-05-24 | Re-Logic Terraria before 1.4.2.3 performs Insecure Deserialization. |
CVE-2021-3559 | Medium | 6.5 | 2021-05-24 | A flaw was found in libvirt in the virConnectListAllNodeDevices API in versions before 7.0.0. It only affects hosts with a PCI device and driver that supports… |
CVE-2021-21989 | Medium | 6.5 | 2021-05-24 | VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in the Cortado ThinPrint… |
CVE-2021-21988 | Medium | 6.5 | 2021-05-24 | VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in the Cortado ThinPrint… |
CVE-2021-21987 | Medium | 6.5 | 2021-05-24 | VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in the Cortado ThinPrint… |
CVE-2021-25938 | Medium | 6.1 | 2021-05-24 | In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting (XSS), since there is no validation of the .zip file name and filtering o… |
CVE-2021-24332 | Medium | 4.8 | 2021-05-24 | The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS pa… |