2021 CVEs (page 184)
Page 184 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-25317 | Low | 3.3 | 2021-05-05 | A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Clo… |
CVE-2021-25319 | High | 7.8 | 2021-05-05 | A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to… |
CVE-2021-25179 | Medium | 6.1 | 2021-05-05 | SolarWinds Serv-U before 15.2 is affected by Cross Site Scripting (XSS) via the HTTP Host header. |
CVE-2021-26804 | Medium | 6.5 | 2021-05-04 | Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validation by changing any file extension to ".g… |
CVE-2021-29478 | High | 7.5 | 2021-05-04 | Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis 6.2 bef… |
CVE-2021-29477 | High | 7.5 | 2021-05-04 | Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version… |
CVE-2021-21551 | High | 8.8 | 2021-05-04 | Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information… |
CVE-2021-3154 | High | 7.5 | 2021-05-04 | An issue was discovered in SolarWinds Serv-U before 15.2.2. Unauthenticated attackers can retrieve cleartext passwords via macro Injection. NOTE: this had a di… |
CVE-2021-22547 | Medium | 6.3 | 2021-05-04 | In IoT Devices SDK, there is an implementation of calloc() that doesn't have a length check. An attacker could pass in memory objects larger than the buffer an… |
CVE-2021-29240 | High | 7.8 | 2021-05-04 | The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before installation and may be used to install CODE… |
CVE-2021-23383 | Medium | 5.6 | 2021-05-04 | The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untruste… |
CVE-2021-23343 | Medium | 5.3 | 2021-05-04 | All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expre… |
CVE-2021-31164 | High | 7.5 | 2021-05-04 | Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements. |
CVE-2021-32020 | Critical | 9.8 | 2021-05-03 | The kernel in Amazon Web Services FreeRTOS before 10.4.3 has insufficient bounds checking during management of heap memory. |
CVE-2021-21264 | Medium | 5.2 | 2021-05-03 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-26231 (fixed in 1.0.470/471 and 1.1.1) was di… |
CVE-2021-29242 | High | 7.3 | 2021-05-03 | CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressin… |
CVE-2021-29241 | High | 7.5 | 2021-05-03 | CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS). |
CVE-2021-29239 | High | 7.8 | 2021-05-03 | CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries without first checking their validity. |
CVE-2021-29238 | High | 8.8 | 2021-05-03 | CODESYS Automation Server before 1.16.0 allows cross-site request forgery (CSRF). |
CVE-2021-29369 | Critical | 9.8 | 2021-05-03 | The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands. |
CVE-2021-28860 | Critical | 9.1 | 2021-05-03 | In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The pollute… |
CVE-2021-25631 | High | 8.8 | 2021-05-03 | In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating th… |
CVE-2021-31996 | High | 7.5 | 2021-05-03 | An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. There is a double free in merge_sort::merge(). |
CVE-2021-28359 | Medium | 6.1 | 2021-05-02 | The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1… |
CVE-2021-31935 | Medium | 6.1 | 2021-04-30 | OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list (payload in the common name) that is mishandled in the scheduling view. |
CVE-2021-31934 | Medium | 6.1 | 2021-04-30 | OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the App Suite UI on a… |
CVE-2021-31792 | Medium | 5.4 | 2021-04-30 | XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript via the name field |
CVE-2021-31933 | High | 7.2 | 2021-04-30 | A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper f… |
CVE-2021-21547 | Medium | 6.4 | 2021-04-30 | Dell EMC Unity, UnityVSA, and Unity XT versions prior to 5.0.7.0.5.008 contain a plain-text password storage vulnerability when the Dell Upgrade Readiness Util… |
CVE-2021-21544 | Low | 2.7 | 2021-04-30 | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges could… |
CVE-2021-21543 | Medium | 4.8 | 2021-04-30 | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high priv… |
CVE-2021-21542 | Medium | 4.8 | 2021-04-30 | Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high priv… |
CVE-2021-21541 | Medium | 6.1 | 2021-04-30 | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploi… |
CVE-2021-21540 | Medium | 5.9 | 2021-04-30 | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability. A remote authenticated attacker could potentially exploit this vulne… |
CVE-2021-21539 | Medium | 5.9 | 2021-04-30 | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A remote authenticated attacker could p… |
CVE-2021-21531 | High | 8.1 | 2021-04-30 | Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. A local authenticated malicious user with monitor role may… |
CVE-2021-21530 | High | 8.3 | 2021-04-30 | Dell OpenManage Enterprise-Modular (OME-M) versions prior to 1.30.00 contain a security bypass vulnerability. An authenticated malicious user with low privileg… |
CVE-2021-21507 | High | 8.8 | 2021-04-30 | Dell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX Switch Module firmware versions prior to 2.0.0.82 contain a Weak Pa… |
CVE-2021-21233 | High | 8.8 | 2021-04-30 | Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2021-21232 | High | 8.8 | 2021-04-30 | Use after free in Dev Tools in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21231 | High | 8.8 | 2021-04-30 | Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2021-21230 | High | 8.8 | 2021-04-30 | Type confusion in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21229 | Medium | 6.5 | 2021-04-30 | Incorrect security UI in downloads in Google Chrome on Android prior to 90.0.4430.93 allowed a remote attacker to perform domain spoofing via a crafted HTML pa… |
CVE-2021-21228 | Medium | 4.3 | 2021-04-30 | Insufficient policy enforcement in extensions in Google Chrome prior to 90.0.4430.93 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2021-21227 | High | 8.8 | 2021-04-30 | Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2021-31926 | Medium | 6.5 | 2021-04-30 | AMP Application Deployment Service in CubeCoders AMP 2.1.x before 2.1.1.2 allows a remote, authenticated user to open ports in the local system firewall by cra… |
CVE-2021-29464 | Low | 3.3 | 2021-04-30 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A heap buffer overflow was found in… |
CVE-2021-29463 | Low | 3.3 | 2021-04-30 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in E… |
CVE-2021-29486 | High | 7.5 | 2021-04-30 | cumulative-distribution-function is an open source npm library used which calculates statistical cumulative distribution function from data array of x values… |
CVE-2021-21537 | Medium | 6.2 | 2021-04-30 | Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacker may exploit this vulnerability in orde… |
CVE-2021-21536 | Medium | 6.2 | 2021-04-30 | Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacker may exploit this vulnerability in orde… |
CVE-2021-21535 | High | 7.4 | 2021-04-30 | Dell Hybrid Client versions prior to 1.5 contain a missing authentication for a critical function vulnerability. A local unauthenticated attacker may exploit t… |
CVE-2021-21534 | Medium | 4.0 | 2021-04-30 | Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacker may exploit this vulnerability in orde… |
CVE-2021-20515 | Medium | 6.7 | 2021-04-30 | IBM Informix Dynamic Server 14.10 is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A local privileged user could overflow a… |
CVE-2021-31232 | Medium | 5.5 | 2021-04-30 | The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth… |
CVE-2021-31231 | Medium | 5.5 | 2021-04-30 | The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when experimental.alertmanag… |
CVE-2021-28959 | Critical | 9.8 | 2021-04-30 | Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive. This leads to remote code… |
CVE-2021-20266 | Medium | 4.9 | 2021-04-30 | A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest thre… |
CVE-2021-26807 | High | 7.8 | 2021-04-30 | GalaxyClient version 2.0.28.9 loads unsigned DLLs such as zlib1.dll, libgcc_s_dw2-1.dll and libwinpthread-1.dll from PATH, which allows an attacker to potentia… |
CVE-2021-20326 | Medium | 6.5 | 2021-04-30 | A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.4. |
CVE-2021-31873 | Critical | 9.8 | 2021-04-30 | An issue was discovered in klibc before 2.0.9. Additions in the malloc() function may result in an integer overflow and a subsequent heap buffer overflow. |
CVE-2021-31872 | Critical | 9.8 | 2021-04-30 | An issue was discovered in klibc before 2.0.9. Multiple possible integer overflows in the cpio command on 32-bit systems may result in a buffer overflow or oth… |
CVE-2021-31871 | High | 7.5 | 2021-04-30 | An issue was discovered in klibc before 2.0.9. An integer overflow in the cpio command may result in a NULL pointer dereference on 64-bit systems. |
CVE-2021-31870 | Critical | 9.8 | 2021-04-30 | An issue was discovered in klibc before 2.0.9. Multiplication in the calloc() function may result in an integer overflow and a subsequent heap buffer overflow. |
CVE-2021-31919 | High | 7.5 | 2021-04-30 | An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized va… |
CVE-2021-29484 | Medium | 6.8 | 2021-04-29 | Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. At… |
CVE-2021-29468 | High | 8.8 | 2021-04-29 | Cygwin Git is a patch set for the git command line tool for the cygwin environment. A specially crafted repository that contains symbolic links as well as file… |
CVE-2021-1087 | Medium | 5.5 | 2021-04-29 | NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin), which could allow an attacker to retrieve information that could lead to… |
CVE-2021-1086 | High | 7.1 | 2021-04-29 | NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where it allows guests to control unauthorized resources, which may lead t… |
CVE-2021-1085 | High | 7.3 | 2021-04-29 | NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where there is the potential to write to a shared memory location and man… |
CVE-2021-1084 | High | 7.8 | 2021-04-29 | NVIDIA vGPU driver contains a vulnerability in the guest kernel mode driver and Virtual GPU Manager (vGPU plugin), in which an input length is not validated, w… |
CVE-2021-1083 | High | 7.8 | 2021-04-29 | NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and Virtual GPU Manager (vGPU plugin), in which an input length is not validated… |
CVE-2021-1082 | High | 7.8 | 2021-04-29 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), in which an input length is not validated, which may lead to informatio… |
CVE-2021-1081 | High | 7.8 | 2021-04-29 | NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and Virtual GPU manager (vGPU plugin), in which an input length is not validated… |
CVE-2021-1080 | High | 7.8 | 2021-04-29 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), in which certain input data is not validated, which may lead to informa… |
CVE-2021-21388 | High | 8.9 | 2021-04-29 | systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systemi… |
CVE-2021-1504 | High | 8.6 | 2021-04-29 | Multiple vulnerabilities in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote… |
CVE-2021-1501 | High | 8.6 | 2021-04-29 | A vulnerability in the SIP inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2021-1495 | Medium | 5.8 | 2021-04-29 | Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configur… |
CVE-2021-1493 | High | 8.5 | 2021-04-29 | A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2021-1489 | Medium | 6.5 | 2021-04-29 | A vulnerability in filesystem usage management for Cisco Firepower Device Manager (FDM) Software could allow an authenticated, remote attacker to exhaust files… |
CVE-2021-1488 | Medium | 6.7 | 2021-04-29 | A vulnerability in the upgrade process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an aut… |
CVE-2021-1477 | Medium | 4.3 | 2021-04-29 | A vulnerability in an access control mechanism of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to access serv… |
CVE-2021-1476 | Medium | 6.7 | 2021-04-29 | A vulnerability in the CLI of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated… |
CVE-2021-1458 | Medium | 4.8 | 2021-04-29 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attac… |
CVE-2021-1457 | Medium | 4.8 | 2021-04-29 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attac… |
CVE-2021-1456 | Medium | 4.8 | 2021-04-29 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attac… |
CVE-2021-1455 | Medium | 4.8 | 2021-04-29 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attac… |
CVE-2021-1448 | High | 7.8 | 2021-04-29 | A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with roo… |
CVE-2021-1445 | High | 8.6 | 2021-04-29 | Multiple vulnerabilities in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote… |
CVE-2021-1402 | High | 8.6 | 2021-04-29 | A vulnerability in the software-based SSL/TLS message handler of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker… |
CVE-2021-1369 | Medium | 5.4 | 2021-04-29 | A vulnerability in the REST API of Cisco Firepower Device Manager (FDM) On-Box Software could allow an authenticated, remote attacker to gain read and write ac… |
CVE-2021-1256 | Medium | 6.0 | 2021-04-29 | A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to overwrite files on the file system… |
CVE-2021-31438 | High | 7.8 | 2021-04-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931. User interaction is required to… |
CVE-2021-31437 | High | 7.8 | 2021-04-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931. User interaction is required to… |
CVE-2021-31436 | High | 7.8 | 2021-04-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931. User interaction is required to… |
CVE-2021-31435 | High | 7.8 | 2021-04-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931. User interaction is required to… |
CVE-2021-31434 | High | 7.8 | 2021-04-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931. User interaction is required to… |
CVE-2021-31433 | High | 7.8 | 2021-04-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931. User interaction is required to… |
CVE-2021-31432 | Medium | 6.0 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first… |