2021 CVEs (page 179)
Page 179 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-29517 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. A malicious user could trigger a division by 0 in `Conv3D` implementation. The implement… |
CVE-2021-29516 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. Calling `tf.raw_ops.RaggedTensorToVariant` with arguments specifying an invalid ragged t… |
CVE-2021-29515 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. The implementation of `MatrixDiag*` operations(https://github.com/tensorflow/tensorflow/… |
CVE-2021-29514 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. If the `splits` argument of `RaggedBincount` does not specify a valid `SparseTensor`(htt… |
CVE-2021-29513 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. Calling TF operations with tensors of non-numeric types when the operations expect numer… |
CVE-2021-32820 | High | 8.6 | 2021-05-14 | Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express r… |
CVE-2021-32819 | High | 8.0 | 2021-05-14 | Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configurati… |
CVE-2021-32818 | High | 7.7 | 2021-05-14 | haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More sp… |
CVE-2021-32817 | Medium | 5.4 | 2021-05-14 | express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. Mo… |
CVE-2021-29554 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.DenseCo… |
CVE-2021-29512 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. If the `splits` argument of `RaggedBincount` does not specify a valid `SparseTensor`(htt… |
CVE-2021-32816 | Medium | 6.5 | 2021-05-14 | ProtonMail Web Client is the official AngularJS web client for the ProtonMail secure email service. ProtonMail Web Client before version 3.16.60 has a regular… |
CVE-2021-20565 | Medium | 5.3 | 2021-05-14 | IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 uses a protection mechanism that relies on the existence or values of an inpu… |
CVE-2021-20564 | Medium | 5.9 | 2021-05-14 | IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a remote attacker to obtain sensitive information, caused by the… |
CVE-2021-20429 | Medium | 5.3 | 2021-05-14 | IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could disclose sensitive information due an overly permissive cross-domain policy. IBM X-Force ID: 19633… |
CVE-2021-20393 | High | 7.5 | 2021-05-14 | IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is… |
CVE-2021-20392 | Medium | 6.1 | 2021-05-14 | IBM QRadar User Behavior Analytics 1.0.0 through 4.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript cod… |
CVE-2021-20391 | Low | 3.3 | 2021-05-14 | IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 1… |
CVE-2021-25943 | Critical | 9.8 | 2021-05-14 | Prototype pollution vulnerability in '101' versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remote code execution. |
CVE-2021-25941 | Critical | 9.8 | 2021-05-14 | Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code e… |
CVE-2021-32613 | Medium | 5.5 | 2021-05-14 | In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS. |
CVE-2021-24291 | Medium | 6.1 | 2021-05-14 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the… |
CVE-2021-24287 | Medium | 6.1 | 2021-05-14 | The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab… |
CVE-2021-24286 | Medium | 6.1 | 2021-05-14 | The settings page of the Redirect 404 to parent WordPress plugin before 1.3.1 did not properly sanitise the tab parameter before outputting it back, leading to… |
CVE-2021-24285 | Critical | 9.8 | 2021-05-14 | The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthentica… |
CVE-2021-24284 | Critical | 9.8 | 2021-05-14 | The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zip… |
CVE-2021-24283 | Medium | 5.4 | 2021-05-14 | The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue. |
CVE-2021-24282 | Medium | 6.3 | 2021-05-14 | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the pl… |
CVE-2021-24281 | Medium | 4.3 | 2021-05-14 | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the delete_action_post AJAX action… |
CVE-2021-24280 | High | 8.8 | 2021-05-14 | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the import_from_debug AJAX action… |
CVE-2021-24279 | Medium | 6.5 | 2021-05-14 | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug AJAX action to insta… |
CVE-2021-24278 | High | 7.5 | 2021-05-14 | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce f… |
CVE-2021-24277 | Medium | 5.4 | 2021-05-14 | The RSS for Yandex Turbo WordPress plugin before 1.30 did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in t… |
CVE-2021-24195 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin befor… |
CVE-2021-24194 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin b… |
CVE-2021-24193 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12… |
CVE-2021-24192 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (… |
CVE-2021-24191 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction WordPress plugin be… |
CVE-2021-24190 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before… |
CVE-2021-24189 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress plugi… |
CVE-2021-24188 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin befo… |
CVE-2021-30183 | High | 7.5 | 2021-05-14 | Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the pass… |
CVE-2021-32051 | High | 7.5 | 2021-05-14 | Hexagon G!nius Auskunftsportal before 5.0.0.0 allows SQL injection via the GiPWorkflow/Service/DownloadPublicFile id parameter. |
CVE-2021-31922 | High | 7.5 | 2021-05-14 | An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/… |
CVE-2021-33026 | Critical | 9.8 | 2021-05-13 | The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation… |
CVE-2021-32615 | Critical | 9.8 | 2021-05-13 | Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection. |
CVE-2021-31876 | Medium | 6.5 | 2021-05-13 | Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes it easier for attackers to trigger a los… |
CVE-2021-29510 | Low | 3.3 | 2021-05-13 | Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either `'infinity'`, `'inf'` or `float('inf')` (o… |
CVE-2021-29506 | Medium | 6.5 | 2021-05-13 | GraphHopper is an open-source Java routing engine. In GrassHopper from version 2.0 and before version 2.4, there is a regular expression injection vulnerabilit… |
CVE-2021-27413 | High | 7.8 | 2021-05-13 | Omron CX-One Versions 4.60 and prior, including CX-Server Versions 5.0.29.0 and prior, are vulnerable to a stack-based buffer overflow, which may allow an atta… |
CVE-2021-23910 | Medium | 5.3 | 2021-05-13 | An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. There is an out-of-bounds array access in RemoteD… |
CVE-2021-23909 | Medium | 6.3 | 2021-05-13 | An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The SH2 MCU allows remote code execution. |
CVE-2021-23908 | Low | 2.9 | 2021-05-13 | An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A type confusion issue affects MultiSvSetA… |
CVE-2021-23907 | Low | 2.9 | 2021-05-13 | An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The count in MultiSvGet, GetAttributes, an… |
CVE-2021-23906 | Low | 1.8 | 2021-05-13 | An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A Message Length is not checked in the HiQ… |
CVE-2021-32925 | Medium | 6.5 | 2021-05-13 | admin/user_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities. |
CVE-2021-22140 | High | 7.5 | 2021-05-13 | Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature. Usi… |
CVE-2021-22139 | Medium | 6.5 | 2021-05-13 | Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request siz… |
CVE-2021-22138 | Low | 3.7 | 2021-05-13 | In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted… |
CVE-2021-22137 | Medium | 5.3 | 2021-05-13 | In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not pr… |
CVE-2021-22136 | Low | 3.5 | 2021-05-13 | In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout setting is not being resp… |
CVE-2021-22135 | Medium | 5.3 | 2021-05-13 | Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and F… |
CVE-2021-29623 | Low | 3.6 | 2021-05-13 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A read of uninitialized memory was… |
CVE-2021-32921 | Medium | 5.9 | 2021-05-13 | An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or… |
CVE-2021-32920 | High | 7.5 | 2021-05-13 | Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests. |
CVE-2021-32919 | High | 7.5 | 2021-05-13 | An issue was discovered in Prosody before 0.11.9. The undocumented dialback_without_dialback option in mod_dialback enables an experimental feature for server-… |
CVE-2021-32918 | High | 7.5 | 2021-05-13 | An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaust… |
CVE-2021-32917 | Medium | 5.3 | 2021-05-13 | An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the… |
CVE-2021-21424 | Medium | 5.3 | 2021-05-13 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant… |
CVE-2021-20535 | Medium | 5.4 | 2021-05-13 | IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send… |
CVE-2021-20221 | Medium | 6.0 | 2021-05-13 | An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform… |
CVE-2021-20181 | High | 7.5 | 2021-05-13 | A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-afte… |
CVE-2021-3528 | High | 8.8 | 2021-05-13 | A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log… |
CVE-2021-20025 | High | 7.8 | 2021-05-13 | SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at initial setup. An atta… |
CVE-2021-25693 | High | 7.5 | 2021-05-13 | An attacker may cause a Denial of Service (DoS) in multiple versions of Teradici PCoIP Agent via a null pointer dereference. |
CVE-2021-20999 | Critical | 9.4 | 2021-05-13 | In Weidmüller u-controls and IoT-Gateways in versions up to 1.12.1 a network port intended only for device-internal usage is accidentally accessible via extern… |
CVE-2021-20998 | Critical | 10.0 | 2021-05-13 | In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users. |
CVE-2021-20997 | High | 7.5 | 2021-05-13 | In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users. |
CVE-2021-20996 | Medium | 5.3 | 2021-05-13 | In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties. |
CVE-2021-20995 | Medium | 5.3 | 2021-05-13 | In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials. |
CVE-2021-20994 | High | 8.8 | 2021-05-13 | In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the W… |
CVE-2021-20993 | Medium | 5.3 | 2021-05-13 | In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside… |
CVE-2021-20988 | High | 8.6 | 2021-05-13 | In Hilscher rcX RTOS versions prios to V2.1.14.1 the actual UDP packet length is not verified against the length indicated by the packet. This may lead to a de… |
CVE-2021-20250 | Medium | 4.3 | 2021-05-13 | A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deplo… |
CVE-2021-25694 | High | 7.8 | 2021-05-13 | Teradici PCoIP Graphics Agent for Windows prior to 21.03 does not validate NVENC.dll. An attacker could replace the .dll and redirect pixels elsewhere. |
CVE-2021-26311 | High | 7.2 | 2021-05-13 | In the AMD SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a m… |
CVE-2021-22154 | Medium | 5.3 | 2021-05-13 | An Information Disclosure vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier c… |
CVE-2021-22153 | High | 7.3 | 2021-05-13 | A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier cou… |
CVE-2021-22152 | Medium | 5.5 | 2021-05-13 | A Denial of Service due to Improper Input Validation vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and… |
CVE-2021-20331 | Medium | 4.2 | 2021-05-13 | Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an applica… |
CVE-2021-31215 | High | 8.8 | 2021-05-13 | SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as SlurmUser because use of a PrologSlurmctld or EpilogSlu… |
CVE-2021-28799 | Critical | 10.0 | 2021-05-13 | An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote… |
CVE-2021-22155 | High | 8.8 | 2021-05-13 | An Authentication Bypass vulnerability in the SAML Authentication component of BlackBerry Workspaces Server (deployed with Appliance-X) version(s) 10.1, 9.1 an… |
CVE-2021-23135 | Medium | 5.9 | 2021-05-12 | Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error mess… |
CVE-2021-23134 | High | 7.8 | 2021-05-12 | Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to elevate their privileges. In typical configurations, th… |
CVE-2021-29511 | Medium | 6.5 | 2021-05-12 | evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use `e… |
CVE-2021-30214 | Medium | 5.4 | 2021-05-12 | Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter. |
CVE-2021-30213 | Medium | 6.1 | 2021-05-12 | Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in '/servlet/AdapterHTTP'… |
CVE-2021-30212 | Medium | 5.4 | 2021-05-12 | Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/documentnotes/s… |
CVE-2021-30211 | Medium | 5.4 | 2021-05-12 | Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/signup/update'… |