2021 CVEs (page 177)
Page 177 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-27459 | Critical | 9.8 | 2021-05-20 | A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The webserver of the affected products allows unvalidated file… |
CVE-2021-27457 | High | 7.5 | 2021-05-20 | A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected products utilize a weak encryption algorithm for… |
CVE-2021-20721 | Critical | 9.8 | 2021-05-20 | KonaWiki2 versions prior to 2.2.4 allows a remote attacker to upload arbitrary files via unspecified vectors. If the file contains PHP scripts, arbitrary code… |
CVE-2021-20720 | Critical | 9.8 | 2021-05-20 | SQL injection vulnerability in the KonaWiki2 versions prior to 2.2.4 allows remote attackers to execute arbitrary SQL commands and to obtain/alter the informat… |
CVE-2021-20719 | Medium | 6.8 | 2021-05-20 | RFNTPS firmware versions System_01000004 and earlier, and Web_01000004 and earlier allow an attacker on the same network segment to execute arbitrary OS comman… |
CVE-2021-20718 | High | 7.5 | 2021-05-20 | mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors. |
CVE-2021-29625 | High | 7.5 | 2021-05-19 | Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, P… |
CVE-2021-29624 | Medium | 6.5 | 2021-05-19 | fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "doubl… |
CVE-2021-29622 | Medium | 6.5 | 2021-05-19 | Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless trans… |
CVE-2021-29503 | High | 8.1 | 2021-05-19 | HedgeDoc is a platform to write and share markdown. HedgeDoc before version 1.8.2 is vulnerable to a cross-site scripting attack using the YAML-metadata of a n… |
CVE-2021-27924 | Medium | 5.9 | 2021-05-19 | An issue was discovered in Couchbase Server 6.x through 6.6.1. The Couchbase Server UI is insecurely logging session cookies in the logs. This allows for the i… |
CVE-2021-20529 | Medium | 5.3 | 2021-05-19 | IBM Control Center 6.2.0.0 could allow a user to obtain sensitive version information that could be used in further attacks against the system. IBM X-Force ID… |
CVE-2021-20528 | Medium | 5.4 | 2021-05-19 | IBM Control Center 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2021-20374 | Medium | 5.4 | 2021-05-19 | IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2021-31158 | Medium | 6.5 | 2021-05-19 | In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allo… |
CVE-2021-27925 | Medium | 4.4 | 2021-05-19 | An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1. When using the View Engine and Auditing is enabled, a crash condition can (depending… |
CVE-2021-25644 | High | 7.5 | 2021-05-19 | An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication in… |
CVE-2021-33204 | Critical | 9.8 | 2021-05-19 | In the pg_partman (aka PG Partition Manager) extension before 4.5.1 for PostgreSQL, arbitrary code execution can be achieved via SECURITY DEFINER functions bec… |
CVE-2021-31930 | Medium | 6.1 | 2021-05-19 | Persistent cross-site scripting (XSS) in the web interface of Concerto through 2.3.6 allows an unauthenticated remote attacker to introduce arbitrary JavaScrip… |
CVE-2021-3517 | High | 8.6 | 2021-05-19 | There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed… |
CVE-2021-3445 | High | 7.5 | 2021-05-19 | A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can… |
CVE-2021-3421 | Medium | 5.5 | 2021-05-19 | A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package… |
CVE-2021-21733 | Medium | 4.9 | 2021-05-19 | The management system of ZXCDN is impacted by the information leak vulnerability. Attackers can make further analysis according to the information returned by… |
CVE-2021-21732 | High | 7.5 | 2021-05-19 | A mobile phone of ZTE is impacted by improper access control vulnerability. Due to improper permission settings, third-party applications can read some files i… |
CVE-2021-20589 | High | 7.5 | 2021-05-19 | Buffer access with incorrect length value vulnerability in GOT2000 series GT27 model communication driver versions 01.19.000 through 01.38.000, GT25 model comm… |
CVE-2021-31324 | Critical | 9.8 | 2021-05-18 | The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution. |
CVE-2021-31323 | Medium | 5.5 | 2021-05-18 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty fu… |
CVE-2021-31322 | Medium | 5.5 | 2021-05-18 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LOTGradient::populate function of thei… |
CVE-2021-31321 | High | 7.1 | 2021-05-18 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the gray_split_cubic function of their cus… |
CVE-2021-31320 | High | 7.1 | 2021-05-18 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the VGradientCache::generateGradientColorT… |
CVE-2021-31319 | Medium | 5.5 | 2021-05-18 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LOTGradient::populate function of their c… |
CVE-2021-31318 | Medium | 5.5 | 2021-05-18 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function… |
CVE-2021-31317 | Medium | 5.5 | 2021-05-18 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of their custom fork of… |
CVE-2021-31316 | Critical | 9.8 | 2021-05-18 | The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter. |
CVE-2021-31315 | Medium | 5.5 | 2021-05-18 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the blit function of their custom fork of… |
CVE-2021-3200 | Low | 3.3 | 2021-05-18 | Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **resultp, int… |
CVE-2021-32305 | Critical | 9.8 | 2021-05-18 | WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter. |
CVE-2021-32238 | High | 7.8 | 2021-05-18 | Epic Games / Psyonix Rocket League <=1.95 is affected by Buffer Overflow. Stack-based buffer overflow occurs when Rocket League handles UPK object files that c… |
CVE-2021-30145 | High | 7.8 | 2021-05-18 | A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file. |
CVE-2021-22117 | High | 7.8 | 2021-05-18 | RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing attackers with sufficient local filesys… |
CVE-2021-3531 | Medium | 5.3 | 2021-05-18 | A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for a swift URL that ends with two slashes it can ca… |
CVE-2021-3518 | High | 8.8 | 2021-05-18 | There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 cou… |
CVE-2021-31827 | High | 8.8 | 2021-05-18 | In Progress MOVEit Transfer before 2021.0 (13.0), a SQL injection vulnerability has been found in the MOVEit Transfer web app that could allow an authenticated… |
CVE-2021-3423 | High | 7.8 | 2021-05-18 | Uncontrolled Search Path Element vulnerability in the openssl component as used in Bitdefender GravityZone Business Security allows an attacker to load a third… |
CVE-2021-32622 | Medium | 4.2 | 2021-05-17 | Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file pre… |
CVE-2021-29024 | High | 7.5 | 2021-05-17 | In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and d… |
CVE-2021-29023 | Medium | 5.3 | 2021-05-17 | InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable. |
CVE-2021-32618 | Low | 3.1 | 2021-05-17 | The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flas… |
CVE-2021-32617 | Medium | 4.7 | 2021-05-17 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An inefficient algorithm (quadratic… |
CVE-2021-32456 | Medium | 6.5 | 2021-05-17 | SITEL CAP/PRX firmware version 5.2.01 allows an attacker with access to the local network of the device to obtain the authentication passwords by analysing the… |
CVE-2021-32454 | Critical | 9.6 | 2021-05-17 | SITEL CAP/PRX firmware version 5.2.01 makes use of a hardcoded password. An attacker with access to the device could modify these credentials, leaving the admi… |
CVE-2021-23384 | Medium | 5.4 | 2021-05-17 | The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulne… |
CVE-2021-3524 | Medium | 6.5 | 2021-05-17 | A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP he… |
CVE-2021-33041 | Medium | 6.1 | 2021-05-17 | vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as demonstrated by Electron remote code execution via require('child_process').execSync('calc.exe')… |
CVE-2021-32455 | Medium | 6.8 | 2021-05-17 | SITEL CAP/PRX firmware version 5.2.01, allows an attacker with access to the device´s network to cause a denial of service condition on the device. An attacker… |
CVE-2021-32453 | Medium | 6.5 | 2021-05-17 | SITEL CAP/PRX firmware version 5.2.01 allows an attacker with access to the local network, to access via HTTP to the internal configuration database of the dev… |
CVE-2021-29747 | High | 7.5 | 2021-05-17 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain highly sensitive information due to a vulnerability in the authentication mechan… |
CVE-2021-25264 | Medium | 6.7 | 2021-05-17 | In multiple versions of Sophos Endpoint products for MacOS, a local attacker could execute arbitrary code with administrator privileges. |
CVE-2021-24327 | Medium | 4.8 | 2021-05-17 | The SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 6.4 did not sanitise the Redirect From and Redirect To fields when creating a new red… |
CVE-2021-24326 | Medium | 5.4 | 2021-05-17 | The tab parameter of the settings page of the All 404 Redirect to Homepage WordPress plugin before 1.21 was vulnerable to an authenticated reflected Cross-Site… |
CVE-2021-24325 | Medium | 6.1 | 2021-05-17 | The tab parameter of the settings page of the 404 SEO Redirection WordPress plugin through 1.3 is vulnerable to a reflected Cross-Site Scripting (XSS) issue as… |
CVE-2021-24324 | Medium | 6.5 | 2021-05-17 | The 404 SEO Redirection WordPress plugin through 1.3 is lacking CSRF checks in all its settings, allowing attackers to make a logged in user change the plugin'… |
CVE-2021-24323 | Medium | 4.8 | 2021-05-17 | When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high… |
CVE-2021-24315 | Medium | 4.8 | 2021-05-17 | The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checko… |
CVE-2021-24314 | Critical | 9.8 | 2021-05-17 | The Goto WordPress theme before 2.1 did not sanitise, validate of escape the keywords GET parameter from its listing page before using it in a SQL statement, l… |
CVE-2021-24299 | Medium | 6.1 | 2021-05-17 | The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are st… |
CVE-2021-24295 | High | 7.5 | 2021-05-17 | It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Pl… |
CVE-2021-24292 | Medium | 5.4 | 2021-05-17 | The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.17.0 have a number of widgets that are… |
CVE-2021-24290 | Medium | 6.1 | 2021-05-17 | There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject mali… |
CVE-2021-24289 | High | 8.8 | 2021-05-17 | There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta da… |
CVE-2021-24288 | Medium | 6.1 | 2021-05-17 | When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized. Turning the request from POST to GET, an attacker can craft a link contai… |
CVE-2021-27734 | Critical | 9.8 | 2021-05-17 | Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers to change the credentials of existing… |
CVE-2021-32403 | High | 8.8 | 2021-05-17 | Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of security mechanisms for token protection and unsafe i… |
CVE-2021-32402 | High | 8.8 | 2021-05-17 | Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of validation and insecure configurations in inputs and… |
CVE-2021-31728 | High | 7.8 | 2021-05-17 | Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to \.\ZemanaAntiMalware… |
CVE-2021-31727 | High | 7.8 | 2021-05-17 | Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x80002018 expose unrestricted disk read/write… |
CVE-2021-27342 | Medium | 5.9 | 2021-05-17 | An authentication brute-force protection mechanism bypass in telnetd in D-Link Router model DIR-842 firmware version 3.0.2 allows a remote attacker to circumve… |
CVE-2021-3483 | High | 7.8 | 2021-05-17 | A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice into a doubly-linked list, leading to a use-after-free… |
CVE-2021-29052 | Medium | 4.3 | 2021-05-17 | The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.ge… |
CVE-2021-29051 | Medium | 6.1 | 2021-05-17 | Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 2… |
CVE-2021-29048 | Medium | 6.1 | 2021-05-17 | Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11… |
CVE-2021-29053 | High | 8.8 | 2021-05-17 | Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL… |
CVE-2021-29046 | Medium | 6.1 | 2021-05-17 | Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, all… |
CVE-2021-29045 | Medium | 6.1 | 2021-05-17 | Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 be… |
CVE-2021-29044 | Medium | 6.1 | 2021-05-17 | Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7… |
CVE-2021-29043 | Medium | 5.9 | 2021-05-17 | The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 b… |
CVE-2021-29047 | High | 7.5 | 2021-05-16 | The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, whi… |
CVE-2021-29041 | Medium | 6.5 | 2021-05-16 | Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to p… |
CVE-2021-29040 | Medium | 5.3 | 2021-05-16 | The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provid… |
CVE-2021-29039 | Medium | 6.1 | 2021-05-16 | Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitra… |
CVE-2021-22668 | Critical | 9.8 | 2021-05-16 | Delta Industrial Automation CNCSoft ScreenEditor Versions 1.01.28 (with ScreenEditor Version 1.01.2) and prior are vulnerable to an out-of-bounds read while pr… |
CVE-2021-32073 | High | 8.8 | 2021-05-15 | DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution. |
CVE-2021-33034 | High | 7.8 | 2021-05-14 | In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an a… |
CVE-2021-33033 | High | 7.8 | 2021-05-14 | The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definiti… |
CVE-2021-3402 | Critical | 9.1 | 2021-05-14 | An integer overflow and several buffer overflow reads in libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could allow an attacker to either cause denia… |
CVE-2021-32054 | Medium | 6.1 | 2021-05-14 | Firely/Incendi Spark before 1.5.5-r4 lacks Content-Disposition headers in certain situations, which may cause crafted files to be delivered to clients such tha… |
CVE-2021-27737 | High | 7.5 | 2021-05-14 | Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin. |
CVE-2021-22866 | High | 8.8 | 2021-05-14 | A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authoriz… |
CVE-2021-3537 | Medium | 5.9 | 2021-05-14 | A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference… |
CVE-2021-29619 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. Passing invalid arguments (e.g., discovered via fuzzing) to `tf.raw_ops.SparseCountSpars… |