2021 CVEs (page 183)
Page 183 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-24253 | High | 8.8 | 2021-05-06 | The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-ty… |
CVE-2021-24252 | High | 7.2 | 2021-05-06 | The Event Banner WordPress plugin through 1.3 does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, such as .exe, .php, o… |
CVE-2021-24251 | Medium | 4.3 | 2021-05-06 | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowin… |
CVE-2021-24250 | Medium | 5.4 | 2021-05-06 | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from lack of sanitisation in the label of the Fo… |
CVE-2021-24249 | Medium | 6.5 | 2021-05-06 | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowin… |
CVE-2021-24248 | High | 7.2 | 2021-05-06 | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 did not properly check for imported files, forbidding cer… |
CVE-2021-24247 | Medium | 5.4 | 2021-05-06 | The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As… |
CVE-2021-24246 | Medium | 5.4 | 2021-05-06 | The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX… |
CVE-2021-24245 | Medium | 6.1 | 2021-05-06 | The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting it in an attribute… |
CVE-2021-24244 | Medium | 6.5 | 2021-05-06 | An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low p… |
CVE-2021-24243 | Medium | 5.4 | 2021-05-06 | An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability checks nor sanitizatio… |
CVE-2021-24236 | Critical | 9.8 | 2021-05-06 | The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dange… |
CVE-2021-24214 | Medium | 6.1 | 2021-05-06 | The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected… |
CVE-2021-24179 | High | 8.8 | 2021-05-06 | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11 suffered from a Cross-Site Request Forgery issue, allowing… |
CVE-2021-24178 | High | 8.8 | 2021-05-06 | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 suffered from Cross-Site Request Forgery issues, allowing… |
CVE-2021-22211 | Low | 3.1 | 2021-05-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7. GitLab Dependency Proxy, under certain circumstances, can impersonate a… |
CVE-2021-21550 | Medium | 6.0 | 2021-05-06 | Dell EMC PowerScale OneFS 8.1.0-9.1.0 contain an improper neutralization of special elements used in an OS command vulnerability. This vulnerability can allow… |
CVE-2021-21527 | Medium | 6.0 | 2021-05-06 | Dell PowerScale OneFS 8.1.0-9.1.0 contain an improper neutralization of special elements used in an OS command vulnerability. This vulnerability may allow an a… |
CVE-2021-21505 | High | 8.0 | 2021-05-06 | Dell EMC Integrated System for Microsoft Azure Stack Hub, versions 1906 – 2011, contain an undocumented default iDRAC account. A remote unauthenticated attacke… |
CVE-2021-1535 | Medium | 5.3 | 2021-05-06 | A vulnerability in the cluster management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to view sensitive informat… |
CVE-2021-1532 | Medium | 6.5 | 2021-05-06 | A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an authentica… |
CVE-2021-1530 | Medium | 5.4 | 2021-05-06 | A vulnerability in the web-based management interface of Cisco BroadWorks Messaging Server Software could allow an authenticated, remote attacker to access sen… |
CVE-2021-1521 | Medium | 6.5 | 2021-05-06 | A vulnerability in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent att… |
CVE-2021-1520 | Medium | 6.7 | 2021-05-06 | A vulnerability in the internal message processing of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, local a… |
CVE-2021-1519 | Medium | 4.7 | 2021-05-06 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacke… |
CVE-2021-1516 | Medium | 4.3 | 2021-05-06 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA), Cisco Email Security App… |
CVE-2021-1515 | Medium | 4.3 | 2021-05-06 | A vulnerability in Cisco SD-WAN vManage Software could allow an unauthenticated, adjacent attacker to gain access to sensitive information. This vulnerability… |
CVE-2021-1514 | High | 7.8 | 2021-05-06 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with Administrator… |
CVE-2021-1513 | High | 7.5 | 2021-05-06 | A vulnerability in the vDaemon process of Cisco SD-WAN Software could allow an unauthenticated, remote attacker to cause a device to reload, resulting in a den… |
CVE-2021-1512 | Medium | 6.0 | 2021-05-06 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying file system of… |
CVE-2021-1511 | High | 7.5 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vEdge Software could allow an attacker to execute arbitrary code as the root user or cause a denial of service (DoS) c… |
CVE-2021-1510 | High | 7.5 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vEdge Software could allow an attacker to execute arbitrary code as the root user or cause a denial of service (DoS) c… |
CVE-2021-1509 | High | 7.5 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vEdge Software could allow an attacker to execute arbitrary code as the root user or cause a denial of service (DoS) c… |
CVE-2021-1508 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive… |
CVE-2021-1507 | Medium | 6.4 | 2021-05-06 | A vulnerability in an API of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack… |
CVE-2021-1506 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive… |
CVE-2021-1505 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive… |
CVE-2021-1499 | Medium | 5.3 | 2021-05-06 | A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to upload files to an… |
CVE-2021-1498 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injecti… |
CVE-2021-1497 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injecti… |
CVE-2021-1496 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1490 | Medium | 4.7 | 2021-05-06 | A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker t… |
CVE-2021-1486 | Medium | 5.3 | 2021-05-06 | A vulnerability in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to enumerate user accounts. This vulnerability is due to the i… |
CVE-2021-1478 | Medium | 5.3 | 2021-05-06 | A vulnerability in the Java Management Extensions (JMX) component of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager… |
CVE-2021-1468 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive… |
CVE-2021-1447 | Medium | 6.7 | 2021-05-06 | A vulnerability in the user account management system of Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an authenticated, loca… |
CVE-2021-1438 | Medium | 5.5 | 2021-05-06 | A vulnerability in Cisco Wide Area Application Services (WAAS) Software could allow an authenticated, local attacker to gain access to sensitive information on… |
CVE-2021-1430 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1429 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1428 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1427 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1426 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1421 | High | 7.8 | 2021-05-06 | A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to perform a command injection attack on a… |
CVE-2021-1401 | High | 8.8 | 2021-05-06 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1400 | High | 8.8 | 2021-05-06 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1397 | Medium | 4.7 | 2021-05-06 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker… |
CVE-2021-1365 | High | 7.1 | 2021-05-06 | Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service could allow an authenticated… |
CVE-2021-1363 | High | 7.1 | 2021-05-06 | Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service could allow an authenticated… |
CVE-2021-1284 | High | 8.8 | 2021-05-06 | A vulnerability in the web-based messaging service interface of Cisco SD-WAN vManage Software could allow an unauthenticated, adjacent attacker to bypass authe… |
CVE-2021-1275 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive… |
CVE-2021-31411 | Medium | 6.3 | 2021-05-05 | Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2)… |
CVE-2021-29101 | High | 7.5 | 2021-05-05 | ArcGIS GeoEvent Server versions 10.8.1 and below has a read-only directory path traversal vulnerability that could allow an unauthenticated, remote attacker to… |
CVE-2021-24293 | Medium | 6.1 | 2021-05-05 | In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ajax , after that t… |
CVE-2021-24276 | Medium | 6.1 | 2021-05-05 | The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leadi… |
CVE-2021-24275 | Medium | 6.1 | 2021-05-05 | The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a… |
CVE-2021-24274 | Medium | 6.1 | 2021-05-05 | The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leadi… |
CVE-2021-24273 | Medium | 5.4 | 2021-05-05 | The “Clever Addons for Elementor” WordPress Plugin before 2.1.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privilege… |
CVE-2021-24272 | Medium | 4.3 | 2021-05-05 | The fitness calculators WordPress plugin before 1.9.6 add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check… |
CVE-2021-24271 | Medium | 5.4 | 2021-05-05 | The “Ultimate Addons for Elementor” WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privil… |
CVE-2021-24270 | Medium | 5.4 | 2021-05-05 | The “DeTheme Kit for Elementor” WordPress Plugin before 1.5.5.5 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users… |
CVE-2021-24269 | Medium | 5.4 | 2021-05-05 | The “Sina Extension for Elementor” WordPress Plugin before 3.3.12 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privile… |
CVE-2021-24268 | Medium | 5.4 | 2021-05-05 | The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged u… |
CVE-2021-24267 | Medium | 5.4 | 2021-05-05 | The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) b… |
CVE-2021-24266 | Medium | 5.4 | 2021-05-05 | The “The Plus Addons for Elementor Page Builder Lite” WordPress Plugin before 2.0.6 has four widgets that are vulnerable to stored Cross-Site Scripting (XSS) b… |
CVE-2021-24265 | Medium | 5.4 | 2021-05-05 | The “Rife Elementor Extensions & Templates” WordPress Plugin before 1.1.6 has a widget that is vulnerable to stored Cross-Site Scripting(XSS) by lower-privileg… |
CVE-2021-24264 | Medium | 5.4 | 2021-05-05 | The “Image Hover Effects – Elementor Addon” WordPress Plugin before 1.3.4 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privile… |
CVE-2021-24263 | Medium | 5.4 | 2021-05-05 | The “Elementor Addons – PowerPack Addons for Elementor” WordPress Plugin before 2.3.2 for WordPress has several widgets that are vulnerable to stored Cross-Sit… |
CVE-2021-24262 | Medium | 5.4 | 2021-05-05 | The “WooLentor – WooCommerce Elementor Addons + Builder” WordPress Plugin before 1.8.6 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by… |
CVE-2021-24261 | Medium | 5.4 | 2021-05-05 | The “HT Mega – Absolute Addons for Elementor Page Builder” WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored Cross-Site Scripting… |
CVE-2021-24260 | Medium | 5.4 | 2021-05-05 | The “Livemesh Addons for Elementor” WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privilege… |
CVE-2021-24259 | Medium | 5.4 | 2021-05-05 | The “Elementor Addon Elements” WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged… |
CVE-2021-24258 | Medium | 5.4 | 2021-05-05 | The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by… |
CVE-2021-24257 | Medium | 5.4 | 2021-05-05 | The “Premium Addons for Elementor” WordPress Plugin before 4.2.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileg… |
CVE-2021-24256 | Medium | 5.4 | 2021-05-05 | The “Elementor – Header, Footer & Blocks Template” WordPress Plugin before 1.5.8 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lo… |
CVE-2021-24255 | Medium | 5.4 | 2021-05-05 | The Essential Addons for Elementor Lite WordPress Plugin before 4.5.4 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privile… |
CVE-2021-32055 | Critical | 9.1 | 2021-05-05 | Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in… |
CVE-2021-29489 | High | 7.6 | 2021-05-05 | Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered… |
CVE-2021-29100 | High | 7.8 | 2021-05-05 | A path traversal vulnerability exists in Esri ArcGIS Earth versions 1.11.0 and below which allows arbitrary file creation on an affected system through crafted… |
CVE-2021-20401 | High | 7.8 | 2021-05-05 | IBM QRadar SIEM 7.3 and 7.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outboun… |
CVE-2021-20397 | Medium | 6.1 | 2021-05-05 | IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri… |
CVE-2021-31542 | High | 7.5 | 2021-05-05 | In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded file… |
CVE-2021-31518 | High | 7.5 | 2021-05-05 | Trend Micro Home Network Security 6.5.599 and earlier is vulnerable to a file-parsing vulnerability which could allow an attacker to exploit the vulnerability… |
CVE-2021-31517 | High | 7.5 | 2021-05-05 | Trend Micro Home Network Security 6.5.599 and earlier is vulnerable to a file-parsing vulnerability which could allow an attacker to exploit the vulnerability… |
CVE-2021-20254 | Medium | 6.8 | 2021-05-05 | A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a fl… |
CVE-2021-29250 | Medium | 5.4 | 2021-05-05 | BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting (XSS) vulnerability within the POS Add Products functionality. This enables cookie ste… |
CVE-2021-29248 | Medium | 5.3 | 2021-05-05 | BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a cookie. |
CVE-2021-29247 | Medium | 5.3 | 2021-05-05 | BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie. |
CVE-2021-29246 | Medium | 6.7 | 2021-05-05 | BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution. The attacker must cra… |
CVE-2021-29245 | Medium | 5.3 | 2021-05-05 | BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key. |
CVE-2021-31800 | Critical | 9.8 | 2021-05-05 | Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22. An attacker that connects to a running smbserver instance can list an… |