2021 CVEs (page 182)
Page 182 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-31456 | High | 7.8 | 2021-05-07 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to ex… |
CVE-2021-31455 | High | 7.8 | 2021-05-07 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to ex… |
CVE-2021-31454 | High | 7.8 | 2021-05-07 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to ex… |
CVE-2021-31453 | High | 7.8 | 2021-05-07 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to ex… |
CVE-2021-31452 | High | 7.8 | 2021-05-07 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to ex… |
CVE-2021-31451 | High | 7.8 | 2021-05-07 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to ex… |
CVE-2021-31450 | High | 7.8 | 2021-05-07 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to ex… |
CVE-2021-31449 | High | 7.8 | 2021-05-07 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to ex… |
CVE-2021-31448 | Low | 3.3 | 2021-05-07 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576. User interaction is requir… |
CVE-2021-31447 | Low | 3.3 | 2021-05-07 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576. User interaction is requir… |
CVE-2021-31446 | Low | 3.3 | 2021-05-07 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576. User interaction is requir… |
CVE-2021-31445 | Low | 3.3 | 2021-05-07 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576. User interaction is requir… |
CVE-2021-31444 | Low | 3.3 | 2021-05-07 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576. User interaction is requir… |
CVE-2021-31443 | Low | 3.3 | 2021-05-07 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576. User interaction is requir… |
CVE-2021-31442 | High | 7.8 | 2021-05-07 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to ex… |
CVE-2021-31441 | High | 7.8 | 2021-05-07 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to ex… |
CVE-2021-29499 | High | 7.5 | 2021-05-07 | SIF is an open source implementation of the Singularity Container Image Format. The `siftool new` command and func siftool.New() produce predictable UUID ident… |
CVE-2021-32470 | Medium | 6.1 | 2021-05-07 | Craft CMS before 3.6.13 has an XSS vulnerability. |
CVE-2021-27574 | High | 8.1 | 2021-05-07 | An issue was discovered in Emote Remote Mouse through 4.0.0.0. It uses cleartext HTTP to check, and request, updates. Thus, attackers can machine-in-the-middle… |
CVE-2021-27573 | Critical | 9.8 | 2021-05-07 | An issue was discovered in Emote Remote Mouse through 4.0.0.0. Remote unauthenticated users can execute arbitrary code via crafted UDP packets with no prior au… |
CVE-2021-27572 | High | 8.1 | 2021-05-07 | An issue was discovered in Emote Remote Mouse through 4.0.0.0. Authentication Bypass can occur via Packet Replay. Remote unauthenticated users can execute arbi… |
CVE-2021-27571 | Medium | 5.3 | 2021-05-07 | An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can retrieve recently used and running applications, their icons, and their file paths… |
CVE-2021-27570 | Medium | 5.3 | 2021-05-07 | An issue was discovered in Emote Remote Mouse through 3.015. Attackers can close any running process by sending the process name in a specially crafted packet… |
CVE-2021-27569 | Medium | 5.3 | 2021-05-07 | An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can maximize or minimize the window of a running process by sending the process name i… |
CVE-2021-29495 | Medium | 5.9 | 2021-05-07 | Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2, httpClient SSL/TLS certificate verification was disabled… |
CVE-2021-22677 | High | 7.8 | 2021-05-07 | An integer overflow exists in the APIs of the host MCU while trying to connect to a WIFI network may lead to issues such as a denial-of-service condition or co… |
CVE-2021-29488 | Medium | 4.3 | 2021-05-07 | SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the `filesystem.renamer()` function into writing downlo… |
CVE-2021-27437 | Critical | 9.1 | 2021-05-07 | The affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard. The system contains a hard-coded administrator username and… |
CVE-2021-21419 | Medium | 5.3 | 2021-05-07 | Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious… |
CVE-2021-22673 | High | 8.0 | 2021-05-07 | The affected product is vulnerable to stack-based buffer overflow while processing over-the-air firmware updates from the CDN server, which may allow an attack… |
CVE-2021-22671 | Critical | 9.8 | 2021-05-07 | Multiple integer overflow issues exist while processing long domain names, which may allow an attacker to remotely execute code on the SimpleLink Wi-Fi (MSP432… |
CVE-2021-22679 | Critical | 9.8 | 2021-05-07 | The affected product is vulnerable to an integer overflow while processing HTTP headers, which may allow an attacker to remotely execute code on the SimpleLink… |
CVE-2021-22675 | High | 7.2 | 2021-05-07 | The affected product is vulnerable to integer overflow while parsing malformed over-the-air firmware update files, which may allow an attacker to remotely exec… |
CVE-2021-3502 | Medium | 5.5 | 2021-05-07 | A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi ser… |
CVE-2021-26123 | Medium | 6.1 | 2021-05-07 | LivingLogic XIST4C before 0.107.8 allows XSS via login.htm, login.wihtm, or login-form.htm. |
CVE-2021-26122 | Medium | 6.1 | 2021-05-07 | LivingLogic XIST4C before 0.107.8 allows XSS via feedback.htm or feedback.wihtm. |
CVE-2021-21984 | Critical | 9.8 | 2021-05-07 | VMware vRealize Business for Cloud 7.x prior to 7.6.0 contains a remote code execution vulnerability due to an unauthorised end point. A malicious actor with n… |
CVE-2021-30173 | Medium | 6.5 | 2021-05-07 | Local File Inclusion vulnerability of the omni-directional communication system allows remote authenticated attacker inject absolute path into Url parameter an… |
CVE-2021-30172 | Medium | 4.6 | 2021-05-07 | Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers ca… |
CVE-2021-30171 | Medium | 4.6 | 2021-05-07 | Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry… |
CVE-2021-30170 | Medium | 4.6 | 2021-05-07 | Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScrip… |
CVE-2021-1927 | High | 8.4 | 2021-05-07 | Possible use after free due to lack of null check while memory is being freed in FastRPC driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2021-1925 | High | 7.5 | 2021-05-07 | Possible denial of service scenario due to improper handling of group management action frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2021-1915 | High | 7.8 | 2021-05-07 | Buffer overflow can occur due to improper validation of NDP application information length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sna… |
CVE-2021-1910 | High | 7.3 | 2021-05-07 | Double free in video due to lack of input buffer length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdra… |
CVE-2021-1906 | Medium | 6.2 | 2021-05-07 | Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Conne… |
CVE-2021-1905 | High | 8.4 | 2021-05-07 | Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Con… |
CVE-2021-1895 | Medium | 6.8 | 2021-05-07 | Possible integer overflow due to improper length check while flashing an image in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music |
CVE-2021-1891 | High | 8.4 | 2021-05-07 | A possible use-after-free occurrence in audio driver can happen when pointers are not properly handled in Snapdragon Auto, Snapdragon Compute, Snapdragon Conne… |
CVE-2021-32093 | Medium | 6.5 | 2021-05-07 | The ConfigFileAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to read arbitrary files via the ConfigName pa… |
CVE-2021-32092 | Medium | 6.1 | 2021-05-07 | A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows remote attackers to inj… |
CVE-2021-32091 | Medium | 6.1 | 2021-05-07 | A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6. |
CVE-2021-32090 | Critical | 9.8 | 2021-05-07 | The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter. |
CVE-2021-32074 | High | 7.5 | 2021-05-07 | HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was n… |
CVE-2021-32104 | High | 8.8 | 2021-05-07 | A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1. |
CVE-2021-32103 | Medium | 4.8 | 2021-05-07 | A Stored XSS vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web scrip… |
CVE-2021-32102 | High | 8.8 | 2021-05-07 | A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php in OpenEMR 5.0.2.1. |
CVE-2021-32101 | High | 8.2 | 2021-05-07 | The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. To exploit the vulnerability, an… |
CVE-2021-32100 | Medium | 6.5 | 2021-05-07 | A remote file inclusion vulnerability exists in Artica Pandora FMS 742, exploitable by the lowest privileged user. |
CVE-2021-32099 | Critical | 9.8 | 2021-05-07 | A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session… |
CVE-2021-32098 | Critical | 9.8 | 2021-05-07 | Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization. |
CVE-2021-32096 | High | 8.8 | 2021-05-07 | The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code (for an ev… |
CVE-2021-32095 | High | 8.1 | 2021-05-07 | U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files. |
CVE-2021-32094 | High | 8.8 | 2021-05-07 | U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files. |
CVE-2021-32077 | High | 7.5 | 2021-05-06 | Primary Source Verification in VerityStream MSOW Solutions before 3.1.1 allows an anonymous internet user to discover Social Security Number (SSN) values via a… |
CVE-2021-31737 | Critical | 9.8 | 2021-05-06 | emlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of database backup file in admin/data.php. |
CVE-2021-29203 | Critical | 9.8 | 2021-05-06 | A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software, prior t… |
CVE-2021-27941 | Medium | 4.6 | 2021-05-06 | Unconstrained Web access to the device's private encryption key in the QR code pairing mode in the eWeLink mobile application (through 4.9.2 on Android and thr… |
CVE-2021-29493 | Medium | 6.5 | 2021-05-06 | Kennnyshiwa-cogs contains cogs for Red Discordbot. An RCE exploit has been found in the Tickets module of kennnyshiwa-cogs. This exploit allows discord users t… |
CVE-2021-28665 | High | 7.5 | 2021-05-06 | Stormshield SNS with versions before 3.7.18, 3.11.6 and 4.1.6 has a memory-management defect in the SNMP plugin that can lead to excessive consumption of memor… |
CVE-2021-31828 | High | 7.1 | 2021-05-06 | An SSRF issue in Open Distro for Elasticsearch (ODFE) before 1.13.1.0 allows an existing privileged user to enumerate listening services or interact with confi… |
CVE-2021-31918 | High | 7.5 | 2021-05-06 | A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creatio… |
CVE-2021-31916 | Medium | 6.7 | 2021-05-06 | An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel before 5.12… |
CVE-2021-31793 | High | 7.5 | 2021-05-06 | An issue exists on NightOwl WDB-20-V2 WDB-20-V2_20190314 devices that allows an unauthenticated user to gain access to snapshots and video streams from the doo… |
CVE-2021-3507 | Medium | 6.1 | 2021-05-06 | A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could occur in fdctrl_transfer_handler() in hw/block/fdc.c whi… |
CVE-2021-32052 | Medium | 6.1 | 2021-05-06 | In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLFiel… |
CVE-2021-31829 | Medium | 5.5 | 2021-05-06 | kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading to disclosure of stack content via side-channel attack… |
CVE-2021-28152 | Critical | 9.8 | 2021-05-06 | Hongdian H8922 3.0.5 devices have an undocumented feature that allows access to a shell as a superuser. To connect, the telnet service is used on port 5188 wit… |
CVE-2021-28151 | High | 8.8 | 2021-05-06 | Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cgi ping command, whi… |
CVE-2021-28150 | Medium | 5.5 | 2021-05-06 | Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the administrator password and other sensitive data) via /backup2.cgi. |
CVE-2021-28149 | Medium | 6.5 | 2021-05-06 | Hongdian H8922 3.0.5 devices allow Directory Traversal. The /log_download.cgi log export handler does not validate user input and allows a remote attacker with… |
CVE-2021-32030 | Critical | 9.8 | 2021-05-06 | The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when proce… |
CVE-2021-30473 | Critical | 9.8 | 2021-05-06 | aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap. |
CVE-2021-20204 | Critical | 9.8 | 2021-05-06 | A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades t… |
CVE-2021-28128 | High | 8.1 | 2021-05-06 | In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a val… |
CVE-2021-22210 | Medium | 5.3 | 2021-05-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. When querying the repository branches through API, GitLab was ignoring… |
CVE-2021-22209 | High | 7.5 | 2021-05-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tokens which resulted… |
CVE-2021-22208 | Medium | 4.3 | 2021-05-06 | An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7. Improper permission check could allow the change of timestamp for is… |
CVE-2021-22206 | Medium | 6.8 | 2021-05-06 | An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other maintainers to be able… |
CVE-2021-3501 | High | 7.1 | 2021-05-06 | A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by… |
CVE-2021-32062 | Medium | 5.3 | 2021-05-06 | MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PA… |
CVE-2021-31616 | High | 8.8 | 2021-05-06 | Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.1.0 allow a stack buffer overflow via crafted messages. The overflow in… |
CVE-2021-31532 | Medium | 6.8 | 2021-05-06 | NXP LPC55S6x microcontrollers (0A and 1B), i.MX RT500 (silicon rev B1 and B2), i.MX RT600 (silicon rev A0, B0), LPC55S6x, LPC55S2x, LPC552x (silicon rev 0A, 1B… |
CVE-2021-31409 | High | 7.5 | 2021-05-06 | Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12… |
CVE-2021-31245 | Medium | 5.9 | 2021-05-06 | omr-admin.py in openmptcprouter-vps-admin 0.57.3 and earlier compares the user provided password with the original password in a length dependent manner, which… |
CVE-2021-29921 | Critical | 9.8 | 2021-05-06 | In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attack… |
CVE-2021-29490 | Medium | 5.8 | 2021-05-06 | Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable… |
CVE-2021-27216 | Medium | 6.3 | 2021-05-06 | Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race condition, a local user can delete arbitrary files as root… |
CVE-2021-26543 | High | 8.8 | 2021-05-06 | The "gitDiff" function in Wayfair git-parse <=1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to be aware of this, s… |
CVE-2021-24254 | High | 7.2 | 2021-05-06 | The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary… |