2021 CVEs (page 18)
Page 18 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-45464 | High | 8.8 | 2023-04-15 | kvmtool through 39181fc allows an out-of-bounds write, related to virtio/balloon.c and virtio/pci.c. This allows a guest OS user to execute arbitrary code on t… |
CVE-2021-43612 | High | 7.5 | 2023-04-15 | In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets. |
CVE-2021-39295 | High | 7.5 | 2023-04-15 | In OpenBMC 2.9, crafted IPMI messages allow an attacker to cause a denial of service to the BMC via the netipmid (IPMI lan+) interface. |
CVE-2021-34337 | Medium | 6.3 | 2023-04-15 | An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured… |
CVE-2021-30153 | Medium | 4.3 | 2023-04-15 | An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. . When using VisualEditor to edit a… |
CVE-2021-46880 | Critical | 9.8 | 2023-04-15 | x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unverified certificate cha… |
CVE-2021-46879 | High | 7.8 | 2023-04-11 | An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in flb_msgpack_gelf_va… |
CVE-2021-46878 | High | 7.8 | 2023-04-11 | An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flb_pack_msgpack_to_json_format leads to type confusion bug that interprets wha… |
CVE-2021-45985 | High | 7.5 | 2023-04-10 | In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read. |
CVE-2021-3267 | High | 7.2 | 2023-04-04 | File Upload vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the uploadFile function. |
CVE-2021-31707 | Critical | 9.8 | 2023-04-04 | Permissions vulnerability found in KiteCMS allows a remote attacker to execute arbitrary code via the upload file type. |
CVE-2021-28235 | Critical | 9.8 | 2023-04-04 | Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function. |
CVE-2021-41526 | High | 7.8 | 2023-03-29 | A vulnerability has been reported in the windows installer (MSI) built with InstallScript custom action. This vulnerability may allow privilege escalation when… |
CVE-2021-3923 | Low | 2.3 | 2023-03-27 | A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information wh… |
CVE-2021-43317 | High | 7.5 | 2023-03-24 | A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essent… |
CVE-2021-43316 | High | 7.5 | 2023-03-24 | A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le64(). |
CVE-2021-43315 | High | 7.5 | 2023-03-24 | A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essent… |
CVE-2021-43314 | High | 7.5 | 2023-03-24 | A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essent… |
CVE-2021-43313 | High | 7.5 | 2023-03-24 | A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the functio… |
CVE-2021-43312 | High | 7.5 | 2023-03-24 | A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the functio… |
CVE-2021-43311 | High | 7.5 | 2023-03-24 | A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essenti… |
CVE-2021-3684 | Medium | 5.5 | 2023-03-24 | A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installat… |
CVE-2021-3674 | High | 7.8 | 2023-03-24 | A flaw was found in rizin. The create_section_from_phdr function allocates space for ELF section data by processing the headers. Crafted values in the headers… |
CVE-2021-3844 | Medium | 5.7 | 2023-03-24 | Rapid7 InsightVM suffers from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For examp… |
CVE-2021-46877 | High | 7.5 | 2023-03-18 | jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read… |
CVE-2021-21548 | High | 7.4 | 2023-03-17 | Dell EMC Unisphere for PowerMax versions before 9.1.0.27, Dell EMC Unisphere for PowerMax Virtual Appliance versions before 9.1.0.27, and PowerMax OS Release… |
CVE-2021-36821 | High | 7.1 | 2023-03-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPMU DEV Forminator allows Stored XSS.This issue a… |
CVE-2021-31637 | High | 7.8 | 2023-03-16 | An issue found in UwAmp v.1.1, 1.2, 1.3, 2.0, 2.1, 2.2, 2.2.1, 3.0.0, 3.0.1, 3.0.2 allows a remote attacker to execute arbitrary code via a crafted DLL. |
CVE-2021-4195 | Medium | 6.1 | 2023-03-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manage… |
CVE-2021-45423 | Critical | 9.8 | 2023-03-13 | A Buffer Overflow vulnerabilityexists in Pev 0.81 via the pe_exports function from exports.c.. The array offsets_to_Names is dynamically allocated on the stack… |
CVE-2021-46876 | Medium | 5.3 | 2023-03-12 | An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence. |
CVE-2021-46875 | Medium | 6.1 | 2023-03-12 | An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file. |
CVE-2021-27788 | High | 8.3 | 2023-03-10 | HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability. By tricking a user into clicking a crafted URL, a remote unauthenticated attacker coul… |
CVE-2021-33360 | Critical | 9.8 | 2023-03-10 | An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, child_process, and/or filePa… |
CVE-2021-34125 | High | 7.5 | 2023-03-09 | An issue discovered in Yuneec Mantis Q and PX4-Autopilot v 1.11.3 and below allow attacker to gain access to sensitive information via various nuttx commands. |
CVE-2021-33639 | High | 7.5 | 2023-03-08 | REMAP cmd of SVM driver can be used to remap read only memory as read-write, then cause read only memory/file modified. |
CVE-2021-33353 | Critical | 9.8 | 2023-03-08 | Directory Traversal vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows attacker to execute arbitrary code via th… |
CVE-2021-33352 | Critical | 9.8 | 2023-03-08 | An issue in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows attacker to execute arbitrary code via a phar file upload in the t… |
CVE-2021-33351 | Critical | 9.0 | 2023-03-08 | Cross Site Scripting Vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before and fixed in v.1.3.7 allows attackers to escalte privileges via… |
CVE-2021-4333 | Medium | 6.5 | 2023-03-07 | The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to missing or incorrec… |
CVE-2021-4332 | Medium | 6.5 | 2023-03-07 | The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plu… |
CVE-2021-4331 | High | 8.8 | 2023-03-07 | The Plus Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plu… |
CVE-2021-4330 | High | 8.8 | 2023-03-07 | The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient validation of file… |
CVE-2021-44197 | Medium | 6.1 | 2023-03-07 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in UBIT Information Technologies Student Information Management Sys… |
CVE-2021-44196 | Medium | 6.1 | 2023-03-07 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in UBIT Information Technologies Student Information Management Sys… |
CVE-2021-36403 | Medium | 5.3 | 2023-03-06 | In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing ri… |
CVE-2021-36402 | Medium | 5.3 | 2023-03-06 | In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk. |
CVE-2021-20251 | Medium | 5.9 | 2023-03-06 | A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are… |
CVE-2021-36713 | Medium | 6.1 | 2023-03-06 | Cross Site Scripting (XSS) vulnerability in the DataTables plug-in 1.9.2 for jQuery allows attackers to run arbitrary code via the sBaseName parameter to funct… |
CVE-2021-36401 | Medium | 4.8 | 2023-03-06 | In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk. |
CVE-2021-36400 | Medium | 5.3 | 2023-03-06 | In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions. |
CVE-2021-36399 | Medium | 5.4 | 2023-03-06 | In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk. |
CVE-2021-36398 | Medium | 5.4 | 2023-03-06 | In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk. |
CVE-2021-36397 | Medium | 5.3 | 2023-03-06 | In Moodle, insufficient capability checks meant message deletions were not limited to the current user. |
CVE-2021-36396 | High | 7.5 | 2023-03-06 | In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk. |
CVE-2021-36395 | High | 7.5 | 2023-03-06 | In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service. |
CVE-2021-36394 | Critical | 9.8 | 2023-03-06 | In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. |
CVE-2021-36393 | Critical | 9.8 | 2023-03-06 | In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. |
CVE-2021-36392 | Critical | 9.8 | 2023-03-06 | In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses. |
CVE-2021-35377 | Medium | 6.1 | 2023-03-06 | Cross Site Scripting vulnerability found in VICIdial v2.14-610c and v.2.10-415c allows attackers execute arbitrary code via the /agc/vicidial.php, agc/vicidial… |
CVE-2021-4329 | Medium | 5.5 | 2023-03-05 | A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affected by this issue is some unknown functionality of the file logi… |
CVE-2021-36689 | Medium | 5.5 | 2023-03-04 | An issue discovered in com.samourai.wallet.PinEntryActivity.java in Streetside Samourai Wallet 0.99.96i allows attackers to view sensitive information and decr… |
CVE-2021-4328 | Medium | 6.3 | 2023-03-02 | A vulnerability has been found in 狮子鱼CMS and classified as critical. Affected by this vulnerability is the function goods_detail of the file ApiController.clas… |
CVE-2021-3854 | Critical | 9.8 | 2023-03-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Glox Technology Useroam Hotspot allows SQL Injection. Thi… |
CVE-2021-45479 | Medium | 5.4 | 2023-03-02 | Improper Neutralization of Input During Web Page Generation vulnerability in Yordam Information Technologies Library Automation System allows Stored XSS. This… |
CVE-2021-45478 | Medium | 6.5 | 2023-03-02 | Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users. This issu… |
CVE-2021-45477 | Medium | 6.5 | 2023-03-02 | Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users. This issu… |
CVE-2021-4327 | Medium | 5.5 | 2023-03-01 | A vulnerability was found in SerenityOS. It has been rated as critical. Affected by this issue is the function initialize_typed_array_from_array_buffer in the… |
CVE-2021-4326 | Low | 3.3 | 2023-03-01 | A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or… |
CVE-2021-3855 | High | 8.8 | 2023-03-01 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Liman Central Management System Liman MYS (HTTP/Controller… |
CVE-2021-22283 | Medium | 6.2 | 2023-02-28 | Improper Initialization vulnerability in ABB Relion protection relays - 611 series, ABB Relion protection relays - 615 series IEC 4.0 FP1, ABB Relion protectio… |
CVE-2021-46841 | Medium | 5.9 | 2023-02-27 | This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in Apple Music 3.5.0 for Android. An attacker in a privi… |
CVE-2021-32302 | Medium | 6.1 | 2023-02-27 | Cross Site Scripting vulnerability in IRZ Electronics RUH2 GSM router allows attacker to obtain sensitive information via the Upload File parameter. |
CVE-2021-3329 | Critical | 9.6 | 2023-02-26 | Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack |
CVE-2021-35290 | High | 7.2 | 2023-02-24 | File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on /admin/main/mod-blog page. |
CVE-2021-34249 | High | 7.5 | 2023-02-24 | SQL injection vulnerability in sourcecodester online-book-store 1.0 allows remote attackers to view sensitive information via the id paremeter in application U… |
CVE-2021-34167 | High | 8.8 | 2023-02-24 | Cross Site Request Forgery (CSRF) vulnerability in taoCMS 3.0.2 allows remote attackers to gain escalated privileges via taocms/admin/admin.php. |
CVE-2021-35370 | Critical | 9.8 | 2023-02-24 | An issue found in Peacexie Imcat v5.4 allows attackers to execute arbitrary code via the incomplete filtering function. |
CVE-2021-35369 | Medium | 6.5 | 2023-02-24 | Arbitrary File Read vulnerability found in Peacexie ImCat v.5.2 fixed in v.5.4 allows attackers to obtain sensitive information via the filtering_get_contents… |
CVE-2021-33387 | Critical | 9.6 | 2023-02-24 | Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request. |
CVE-2021-33224 | Critical | 9.8 | 2023-02-24 | File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file. |
CVE-2021-4105 | Critical | 9.8 | 2023-02-24 | Improper Handling of Parameters vulnerability in BG-TEK COSLAT Firewall allows Remote Code Inclusion. This issue affects COSLAT Firewall: from 5.24.0.R.201806… |
CVE-2021-33367 | Medium | 5.5 | 2023-02-22 | Buffer Overflow vulnerability in Freeimage v3.18.0 allows attacker to cause a denial of service via a crafted JXR file. |
CVE-2021-4325 | Low | 3.5 | 2023-02-22 | A vulnerability, which was classified as problematic, has been found in NHN TOAST UI Chart 4.1.4. This issue affects some unknown processing of the component L… |
CVE-2021-32860 | Medium | 6.1 | 2023-02-21 | iziModal is a modal plugin with jQuery. Versions prior to 1.6.1 are vulnerable to cross-site scripting (XSS) when handling untrusted modal titles. An attacker… |
CVE-2021-32859 | Medium | 6.1 | 2023-02-21 | The Baremetrics date range picker is a solution for selecting both date ranges and single dates from a single calender view. Versions 1.0.14 and prior are pron… |
CVE-2021-32858 | Medium | 6.1 | 2023-02-21 | esdoc-publish-html-plugin is a plugin for the document maintenance software ESDoc. TheHTML sanitizer in esdoc-publish-html-plugin 1.1.2 and prior can be bypass… |
CVE-2021-32857 | Medium | 6.1 | 2023-02-21 | Cockpit is a content management system that allows addition of content management functionality to any site. In versions 0.12.2 and prior, bad HTML sanitizatio… |
CVE-2021-32856 | Medium | 6.1 | 2023-02-21 | Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting (XSS)… |
CVE-2021-32855 | Medium | 6.1 | 2023-02-21 | Vditor is a browser-side Markdown editor. Versions prior to 3.8.7 are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the… |
CVE-2021-32854 | Medium | 6.1 | 2023-02-21 | textAngular is a text editor for Angular.js. Version 1.5.16 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS… |
CVE-2021-32853 | Medium | 6.1 | 2023-02-20 | Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. This results in client-s… |
CVE-2021-32852 | Medium | 5.4 | 2023-02-20 | Countly, a product analytics solution, is vulnerable to cross-site scripting prior to version 21.11 of the community edition. The victim must follow a maliciou… |
CVE-2021-32851 | Medium | 6.1 | 2023-02-20 | Mind-elixir is a free, open source mind map core. Prior to version 0.18.1, mind-elixir is prone to cross-site scripting when handling untrusted menus. This iss… |
CVE-2021-32850 | Medium | 6.1 | 2023-02-20 | jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color n… |
CVE-2021-32848 | High | 7.5 | 2023-02-20 | Octobox is software for managing GitHub notifications. Prior to pull request (PR) 2807, a user of the system can provide a specifically crafted search query st… |
CVE-2021-32847 | High | 7.1 | 2023-02-20 | HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior, a malicious guest can trigger a vulnerability… |
CVE-2021-32846 | High | 7.7 | 2023-02-17 | HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107, function `pci_vtsock_proc_tx` in `virtio-sock` can lead… |
CVE-2021-32845 | High | 7.7 | 2023-02-17 | HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, the implementation of `qnotify` at… |
CVE-2021-32844 | Medium | 6.2 | 2023-02-17 | HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, ` vi_pci_write` has is a call to `… |