2021 CVEs (page 176)
Page 176 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-24305 | Medium | 6.1 | 2021-05-24 | The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability. An attacker could… |
CVE-2021-24302 | Medium | 5.4 | 2021-05-24 | The Hana Flv Player WordPress plugin through 3.1.3 is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the 'Default Skin'… |
CVE-2021-24301 | Medium | 5.4 | 2021-05-24 | The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotjar script' textarea. The request did inc… |
CVE-2021-24300 | Medium | 6.1 | 2021-05-24 | The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET p… |
CVE-2021-24298 | Medium | 6.1 | 2021-05-24 | The method and share GET parameters of the Giveaway pages were not sanitised, validated or escaped before being output back in the pages, thus leading to refle… |
CVE-2021-24297 | Medium | 6.1 | 2021-05-24 | The Goto WordPress theme before 2.1 did not properly sanitize the formvalue JSON POST parameter in its tl_filter AJAX action, leading to an unauthenticated Ref… |
CVE-2021-24296 | Medium | 4.8 | 2021-05-24 | The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS pa… |
CVE-2021-24294 | Medium | 6.1 | 2021-05-24 | The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter submitted before o… |
CVE-2021-21001 | Critical | 9.1 | 2021-05-24 | On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file… |
CVE-2021-21000 | Medium | 5.3 | 2021-05-24 | On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause a denial of servic… |
CVE-2021-33497 | Critical | 9.1 | 2021-05-24 | Dutchcoders transfer.sh before 1.2.4 allows Directory Traversal for deleting files. |
CVE-2021-33496 | Medium | 6.1 | 2021-05-24 | Dutchcoders transfer.sh before 1.2.4 allows XSS via an inline view. |
CVE-2021-20726 | High | 7.8 | 2021-05-24 | Untrusted search path vulnerability in The Installer of Overwolf 2.168.0.n and earlier allows an attacker to gain privileges and execute arbitrary code with th… |
CVE-2021-20725 | Medium | 6.1 | 2021-05-24 | Reflected cross-site scripting vulnerability in the admin page of [Calendar01] free edition ver1.0.1 and earlier allows a remote attacker to inject an arbitrar… |
CVE-2021-20724 | Medium | 6.1 | 2021-05-24 | Reflected cross-site scripting vulnerability in the admin page of [Telop01] free edition ver1.0.1 and earlier allows a remote attacker to inject an arbitrary s… |
CVE-2021-20723 | Medium | 6.1 | 2021-05-24 | Reflected cross-site scripting vulnerability in [MailForm01] free edition (versions which the last updated date listed at the top of descriptions in the progra… |
CVE-2021-20722 | High | 7.8 | 2021-05-24 | Untrusted search path vulnerability in the installers of ScanSnap Manager prior to versions V7.0L20 and the Software Download Installer prior to WinSSInst2JP.e… |
CVE-2021-20713 | High | 7.8 | 2021-05-24 | Privilege escalation vulnerability in QND Advance/Premium/Standard Ver.11.0.4i and earlier allows an attacker who can log in to the PC where the product's Wind… |
CVE-2021-1560 | Medium | 6.5 | 2021-05-22 | Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, remote attacker to perform a command injection attack on an affected devic… |
CVE-2021-1559 | Medium | 6.5 | 2021-05-22 | Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, remote attacker to perform a command injection attack on an affected devic… |
CVE-2021-1558 | Medium | 6.0 | 2021-05-22 | Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the… |
CVE-2021-1557 | Medium | 6.0 | 2021-05-22 | Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the… |
CVE-2021-1555 | Medium | 4.7 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1554 | Medium | 4.7 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1553 | Medium | 4.7 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1552 | Medium | 4.7 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1551 | Medium | 4.7 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1550 | Medium | 4.7 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1549 | Medium | 4.7 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1548 | Medium | 4.7 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1547 | Medium | 4.7 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1531 | High | 8.8 | 2021-05-22 | A vulnerability in the web UI of Cisco Modeling Labs could allow an authenticated, remote attacker to execute arbitrary commands with the privileges of the web… |
CVE-2021-1487 | High | 8.8 | 2021-05-22 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Evolved Programmable Network (EPN) Manager could allow an authenticated… |
CVE-2021-1358 | Medium | 4.7 | 2021-05-22 | A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to redirect a user to an undesired web p… |
CVE-2021-1306 | Medium | 4.4 | 2021-05-22 | A vulnerability in the restricted shell of Cisco Evolved Programmable Network (EPN) Manager, Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructu… |
CVE-2021-1254 | Medium | 4.8 | 2021-05-22 | Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an authenticated, remote attacker to conduct a cross-site scripting… |
CVE-2021-33514 | High | 8.8 | 2021-05-21 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker via the vulnerable /sqfs/lib/libsal.so.0.0 library used by a CGI appli… |
CVE-2021-33513 | Medium | 5.4 | 2021-05-21 | Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool. |
CVE-2021-33512 | Medium | 5.4 | 2021-05-21 | Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document. |
CVE-2021-33511 | High | 7.5 | 2021-05-21 | Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterit… |
CVE-2021-33510 | Medium | 4.3 | 2021-05-21 | Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file. |
CVE-2021-33509 | Critical | 9.9 | 2021-05-21 | Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script. |
CVE-2021-33508 | Medium | 5.4 | 2021-05-21 | Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item. |
CVE-2021-33507 | Medium | 6.1 | 2021-05-21 | Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS. |
CVE-2021-33500 | High | 7.5 | 2021-05-21 | PuTTY before 0.75 on Windows allows remote servers to cause a denial of service (Windows GUI hang) by telling the PuTTY window to change its title repeatedly a… |
CVE-2021-21552 | Medium | 5.2 | 2021-05-21 | Dell Wyse Windows Embedded System versions WIE10 LTSC 2019 and earlier contain an improper authorization vulnerability. A local authenticated malicious user wi… |
CVE-2021-21549 | High | 8.8 | 2021-05-21 | Dell EMC XtremIO Versions prior to 6.3.3-8, contain a Cross-Site Request Forgery Vulnerability in XMS. A non-privileged attacker could potentially exploit this… |
CVE-2021-32634 | High | 7.2 | 2021-05-21 | Emissary is a distributed, peer-to-peer, data-driven workflow framework. Emissary 6.4.0 is vulnerable to Unsafe Deserialization of post-authenticated requests… |
CVE-2021-29681 | Medium | 5.3 | 2021-05-21 | IBM InfoSphere Information Server 11.7 could allow an attacker to obtain sensitive information by injecting parameters into an HTML query. This information cou… |
CVE-2021-27811 | High | 7.2 | 2021-05-21 | A code injection vulnerability has been discovered in the Upgrade function of QibosoftX1 v1.0. An attacker is able execute arbitrary PHP code via exploitation… |
CVE-2021-31475 | High | 8.8 | 2021-05-21 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job Scheduler 2020.2.1 HF 2. Authentication… |
CVE-2021-31474 | Critical | 9.8 | 2021-05-21 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 2020.2.1. Authenticati… |
CVE-2021-31473 | High | 7.8 | 2021-05-21 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.3.37598. User interaction is required to ex… |
CVE-2021-31440 | High | 7.0 | 2021-05-21 | This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability t… |
CVE-2021-31439 | High | 8.8 | 2021-05-21 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation Manager. Authentication is not… |
CVE-2021-32633 | Medium | 6.8 | 2021-05-21 | Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that… |
CVE-2021-29415 | Medium | 5.5 | 2021-05-21 | The elliptic curve cryptography (ECC) hardware accelerator, part of the ARM® TrustZone® CryptoCell 310, contained in the NordicSemiconductor nRF52840 through 2… |
CVE-2021-29414 | Medium | 6.1 | 2021-05-21 | STMicroelectronics STM32L4 devices through 2021-03-29 have incorrect physical access control. |
CVE-2021-32032 | High | 7.5 | 2021-05-21 | In Trusted Firmware-M through 1.3.0, cleaning up the memory allocated for a multi-part cryptographic operation (in the event of a failure) can prevent the abor… |
CVE-2021-28798 | High | 8.8 | 2021-05-21 | A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to mo… |
CVE-2021-33477 | High | 8.8 | 2021-05-20 | rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences… |
CVE-2021-22409 | Medium | 5.3 | 2021-05-20 | There is a denial of service vulnerability in some versions of ManageOne. There is a logic error in the implementation of a function of a module. When the serv… |
CVE-2021-22339 | Medium | 6.5 | 2021-05-20 | There is a denial of service vulnerability in some versions of ManageOne. In specific scenarios, due to the insufficient verification of the parameter, an atta… |
CVE-2021-28906 | High | 7.5 | 2021-05-20 | In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to… |
CVE-2021-28905 | High | 7.5 | 2021-05-20 | In function lys_node_free() in libyang <= v1.0.225, it asserts that the value of node->module can't be NULL. But in some cases, node->module can be null, which… |
CVE-2021-28904 | High | 7.5 | 2021-05-20 | In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. If revision is NULL, the operation of strcmp(revis… |
CVE-2021-28903 | High | 7.5 | 2021-05-20 | A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem(). lyxml_parse_elem() function will be called recursivel… |
CVE-2021-28902 | High | 7.5 | 2021-05-20 | In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which lea… |
CVE-2021-27956 | Medium | 6.1 | 2021-05-20 | Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e-mail address field. |
CVE-2021-32630 | Critical | 9.6 | 2021-05-20 | Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an authenticated RCE… |
CVE-2021-29258 | High | 7.5 | 2021-05-20 | An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, because an empty METADATA map triggers a Reachable Assertion. |
CVE-2021-28683 | High | 7.5 | 2021-05-20 | An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable NULL pointer dereference and crash in TLS when an unknown TLS alert code is re… |
CVE-2021-28682 | High | 7.5 | 2021-05-20 | An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected… |
CVE-2021-23386 | High | 7.7 | 2021-05-20 | This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can ex… |
CVE-2021-3313 | Medium | 5.4 | 2021-05-20 | Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's… |
CVE-2021-32632 | Low | 2.4 | 2021-05-20 | Pajbot is a Twitch chat bot. Pajbot versions prior to 1.52 are vulnerable to cross-site request forgery (CSRF). Hosters of the bot should upgrade to `v1.52` or… |
CVE-2021-27432 | High | 7.5 | 2021-05-20 | OPC Foundation UA .NET Standard versions prior to 1.4.365.48 and OPC UA .NET Legacy are vulnerable to an uncontrolled recursion, which may allow an attacker to… |
CVE-2021-29692 | Medium | 5.9 | 2021-05-20 | IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transpo… |
CVE-2021-29691 | High | 7.5 | 2021-05-20 | IBM Security Identity Manager 7.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2021-29688 | High | 7.5 | 2021-05-20 | IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the br… |
CVE-2021-29687 | Medium | 5.3 | 2021-05-20 | IBM Security Identity Manager 7.0.2 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IB… |
CVE-2021-29686 | High | 8.8 | 2021-05-20 | IBM Security Identity Manager 7.0.2 could allow an authenticated user to bypass security and perform actions that they should not have access to. IBM X-Force I… |
CVE-2021-29683 | Medium | 6.5 | 2021-05-20 | IBM Security Identity Manager 7.0.2 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 199998. |
CVE-2021-29682 | Medium | 5.3 | 2021-05-20 | IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the br… |
CVE-2021-25933 | Medium | 4.8 | 2021-05-20 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation… |
CVE-2021-25931 | High | 8.8 | 2021-05-20 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation… |
CVE-2021-25929 | Medium | 4.8 | 2021-05-20 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation… |
CVE-2021-3438 | High | 7.8 | 2021-05-20 | A potential buffer overflow in the software drivers for certain HP LaserJet products and Samsung product printers could lead to an escalation of privilege. |
CVE-2021-28112 | High | 8.8 | 2021-05-20 | Draeger X-Dock Firmware before 03.00.13 has Active Debug Code on a debug port, leading to remote code execution by an authenticated attacker. |
CVE-2021-28111 | High | 8.8 | 2021-05-20 | Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Credentials, leading to remote code execution by an authenticated attacker. |
CVE-2021-27434 | High | 7.5 | 2021-05-20 | Products with Unified Automation .NET based OPC UA Client/Server SDK Bundle: Versions V3.0.7 and prior (.NET 4.5, 4.0, and 3.5 Framework versions only) are vul… |
CVE-2021-25930 | Medium | 4.3 | 2021-05-20 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation… |
CVE-2021-3536 | Medium | 4.8 | 2021-05-20 | A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in… |
CVE-2021-3480 | High | 7.5 | 2021-05-20 | A flaw was found in slapi-nis in versions before 0.56.7. A NULL pointer dereference during the parsing of the Binding DN could allow an unauthenticated attacke… |
CVE-2021-3426 | Medium | 5.7 | 2021-05-20 | There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server co… |
CVE-2021-29659 | Medium | 6.5 | 2021-05-20 | ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure. Due to a bug in the related API endpoint, the attacker c… |
CVE-2021-27467 | Medium | 6.1 | 2021-05-20 | A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected product’s web interface allows an attacker to rou… |
CVE-2021-27465 | Medium | 6.1 | 2021-05-20 | A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected applications do not validate webpage input, which… |
CVE-2021-27463 | Medium | 5.3 | 2021-05-20 | A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected applications utilize persistent cookies where the… |
CVE-2021-27461 | High | 7.5 | 2021-05-20 | A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected webserver applications allow access to stored dat… |