2021 CVEs (page 185)
Page 185 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-31431 | Medium | 6.0 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first… |
CVE-2021-31430 | Medium | 6.0 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first… |
CVE-2021-31429 | High | 8.2 | 2021-04-29 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first obtain the… |
CVE-2021-31428 | High | 8.2 | 2021-04-29 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first obtain the… |
CVE-2021-31427 | Medium | 5.6 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first… |
CVE-2021-31426 | High | 8.8 | 2021-04-29 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.2-49151. An attacker must first obtain the… |
CVE-2021-31425 | High | 8.8 | 2021-04-29 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.2-49151. An attacker must first obtain the… |
CVE-2021-31424 | High | 8.8 | 2021-04-29 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first obtain the… |
CVE-2021-31423 | Medium | 6.0 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first… |
CVE-2021-31422 | High | 7.5 | 2021-04-29 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.1-49141. An attacker must first obtain the… |
CVE-2021-31421 | Medium | 6.0 | 2021-04-29 | This vulnerability allows local attackers to delete arbitrary files on affected installations of Parallels Desktop 16.1.1-49141. An attacker must first obtain… |
CVE-2021-31420 | High | 8.8 | 2021-04-29 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.0-48950. An attacker must first obtain the… |
CVE-2021-31419 | Medium | 6.5 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first… |
CVE-2021-31418 | Medium | 6.5 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first… |
CVE-2021-31417 | Medium | 6.5 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first… |
CVE-2021-30048 | Medium | 5.3 | 2021-04-29 | Directory Traversal in the fileDownload function in com/java2nb/common/controller/FileController.java in Novel-plus (小说精品屋-plus) 3.5.1 allows attackers to read… |
CVE-2021-21417 | High | 7.2 | 2021-04-29 | fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered wh… |
CVE-2021-21415 | High | 7.8 | 2021-04-29 | Prisma VS Code a VSCode extension for Prisma schema files. This is a Remote Code Execution Vulnerability that affects all versions of the Prisma VS Code extens… |
CVE-2021-30234 | Critical | 9.8 | 2021-04-29 | The api/ZRIGMP/set_MLD_PROXY interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharact… |
CVE-2021-30233 | Critical | 9.8 | 2021-04-29 | The api/ZRIptv/setIptvInfo interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacter… |
CVE-2021-30232 | Critical | 9.8 | 2021-04-29 | The api/ZRIGMP/set_IGMP_PROXY interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharac… |
CVE-2021-30231 | Critical | 9.8 | 2021-04-29 | The api/zrDm/set_ZRElink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters… |
CVE-2021-30230 | Critical | 9.8 | 2021-04-29 | The api/ZRFirmware/set_time_zone interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacha… |
CVE-2021-30229 | High | 8.8 | 2021-04-29 | The api/zrDm/set_zrDm interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in… |
CVE-2021-30228 | Critical | 9.8 | 2021-04-29 | The api/ZRAndlink/set_ZRAndlink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metachar… |
CVE-2021-30227 | Medium | 6.1 | 2021-04-29 | Cross Site Scripting (XSS) vulnerability in the article comments feature in emlog 6.0. |
CVE-2021-29350 | High | 7.2 | 2021-04-29 | SQL injection in the getip function in conn/function.php in 发货100-设计素材下载系统 1.1 allows remote attackers to inject arbitrary SQL commands via the X-Forwarded-For… |
CVE-2021-25812 | Critical | 9.8 | 2021-04-29 | Command injection vulnerability in China Mobile An Lianbao WF-1 1.01 via the 'ip' parameter with a POST request to /api/ZRQos/set_online_client. |
CVE-2021-25811 | High | 7.5 | 2021-04-29 | MERCUSYS Mercury X18G 1.0.5 devices allow Denial of service via a crafted value to the POST listen_http_lan parameter. Upon subsequent device restarts after th… |
CVE-2021-25810 | Medium | 6.1 | 2021-04-29 | Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury X18G 1.0.5 devices, via crafted values to the 'src_dport_start', 'src_dport_end', and 'dest_port'… |
CVE-2021-20294 | High | 7.8 | 2021-04-29 | A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a crafted file could trigger a stack buff… |
CVE-2021-20228 | High | 7.5 | 2021-04-29 | A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-opti… |
CVE-2021-30224 | High | 8.8 | 2021-04-29 | Cross Site Request Forgery (CSRF) in Rukovoditel v2.8.3 allows attackers to create an admin user with an arbitrary credentials. |
CVE-2021-30219 | Medium | 5.5 | 2021-04-29 | samurai 1.2 has a NULL pointer dereference in printstatus() function in build.c via a crafted build file. |
CVE-2021-30218 | Medium | 5.5 | 2021-04-29 | samurai 1.2 has a NULL pointer dereference in writefile() in util.c via a crafted build file. |
CVE-2021-30027 | Medium | 5.5 | 2021-04-29 | md_analyze_line in md4c.c in md4c 0.4.7 allows attackers to trigger use of uninitialized memory, and cause a denial of service via a malformed Markdown documen… |
CVE-2021-28899 | High | 7.5 | 2021-04-29 | Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubses… |
CVE-2021-28280 | Medium | 6.1 | 2021-04-29 | CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML |
CVE-2021-27651 | Critical | 9.8 | 2021-04-29 | In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks. |
CVE-2021-20092 | High | 7.5 | 2021-04-29 | The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly restrict access to sensitive inf… |
CVE-2021-20091 | High | 8.8 | 2021-04-29 | The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly sanitize user input. An authenti… |
CVE-2021-20090 | Critical | 9.8 | 2021-04-29 | A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow un… |
CVE-2021-29141 | Medium | 6.5 | 2021-04-29 | A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba… |
CVE-2021-29139 | Medium | 4.8 | 2021-04-29 | A remote cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has rele… |
CVE-2021-29142 | Medium | 4.8 | 2021-04-29 | A remote cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has rele… |
CVE-2021-29140 | High | 8.2 | 2021-04-29 | A remote XML external entity (XXE) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has rele… |
CVE-2021-29138 | Medium | 6.5 | 2021-04-29 | A remote disclosure of privileged information vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Arub… |
CVE-2021-29147 | High | 8.8 | 2021-04-29 | A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has rel… |
CVE-2021-29146 | Medium | 5.4 | 2021-04-29 | A remote cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has rele… |
CVE-2021-29145 | Critical | 9.8 | 2021-04-29 | A remote server side request forgery (SSRF) remote code execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8… |
CVE-2021-29144 | Medium | 6.5 | 2021-04-29 | A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba… |
CVE-2021-29137 | Medium | 6.1 | 2021-04-29 | A remote URL redirection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave… |
CVE-2021-25167 | High | 8.8 | 2021-04-29 | A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for Air… |
CVE-2021-25166 | High | 8.8 | 2021-04-29 | A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for Air… |
CVE-2021-25163 | High | 8.1 | 2021-04-29 | A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for Air… |
CVE-2021-31879 | Medium | 6.1 | 2021-04-29 | GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007. |
CVE-2021-31875 | Critical | 9.8 | 2021-04-29 | In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_json_parse, which ca… |
CVE-2021-31776 | High | 7.8 | 2021-04-29 | Aviatrix VPN Client before 2.14.14 on Windows has an unquoted search path that enables local privilege escalation to the SYSTEM user, if the machine is misconf… |
CVE-2021-25216 | High | 8.1 | 2021-04-29 | In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well a… |
CVE-2021-25215 | High | 7.5 | 2021-04-29 | In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as… |
CVE-2021-25214 | Medium | 6.5 | 2021-04-29 | In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview E… |
CVE-2021-21414 | High | 7.7 | 2021-04-29 | Prisma is an open source ORM for Node.js & TypeScript. As of today, we are not aware of any Prisma users or external consumers of the `@prisma/sdk` package who… |
CVE-2021-21391 | Medium | 6.5 | 2021-04-29 | CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list… |
CVE-2021-2321 | Medium | 6.0 | 2021-04-28 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily… |
CVE-2021-29483 | Critical | 9.4 | 2021-04-28 | ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variab… |
CVE-2021-25165 | High | 8.1 | 2021-04-28 | A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for Air… |
CVE-2021-25164 | Medium | 6.5 | 2021-04-28 | A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for Air… |
CVE-2021-25152 | High | 7.2 | 2021-04-28 | A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches fo… |
CVE-2021-29482 | High | 7.5 | 2021-04-28 | xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format… |
CVE-2021-25154 | High | 7.5 | 2021-04-28 | A remote escalation of privilege vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for… |
CVE-2021-25153 | High | 8.1 | 2021-04-28 | A remote SQL injection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave M… |
CVE-2021-25151 | High | 8.8 | 2021-04-28 | A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches fo… |
CVE-2021-23364 | Medium | 5.3 | 2021-04-28 | The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries. |
CVE-2021-25147 | High | 8.1 | 2021-04-28 | A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released p… |
CVE-2021-3508 | Medium | 5.5 | 2021-04-28 | A flaw was found in PDFResurrect in version 0.22b. There is an infinite loop in get_xref_linear_skipped() in pdf.c via a crafted PDF file. |
CVE-2021-29388 | Medium | 5.4 | 2021-04-28 | A stored cross-site scripting (XSS) vulnerability in SourceCodester Budget Management System 1.0 allows users to inject and store arbitrary JavaScript code in… |
CVE-2021-29387 | Medium | 5.4 | 2021-04-28 | Multiple stored cross-site scripting (XSS) vulnerabilities in Sourcecodester Equipment Inventory System 1.0 allow remote attackers to inject arbitrary javascri… |
CVE-2021-29159 | Medium | 6.1 | 2021-04-28 | A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. An attacker with a local account can create entit… |
CVE-2021-22332 | High | 7.5 | 2021-04-28 | There is a pointer double free vulnerability in some versions of CloudEngine 5800, CloudEngine 6800, CloudEngine 7800 and CloudEngine 12800. When a function is… |
CVE-2021-22331 | High | 7.5 | 2021-04-28 | There is a JavaScript injection vulnerability in certain Huawei smartphones. A module does not verify some inputs sufficiently. Attackers can exploit this vuln… |
CVE-2021-22514 | Critical | 9.8 | 2021-04-28 | An arbitrary code execution vulnerability exists in Micro Focus Application Performance Management, affecting versions 9.40, 9.50 and 9.51. The vulnerability c… |
CVE-2021-22393 | High | 7.5 | 2021-04-28 | There is a denial of service vulnerability in some versions of CloudEngine 5800, CloudEngine 6800, CloudEngine 7800 and CloudEngine 12800. The affected product… |
CVE-2021-22330 | Medium | 6.5 | 2021-04-28 | There is an out of bounds write vulnerability in Huawei Smartphone HUAWEI P30 versions 9.1.0.131(C00E130R1P21) when processing a message. An unauthenticated at… |
CVE-2021-22327 | Medium | 6.5 | 2021-04-28 | There is an arbitrary memory write vulnerability in Huawei smart phone when processing file parsing. Due to insufficient validation of the input files, success… |
CVE-2021-30169 | Medium | 5.3 | 2021-04-28 | The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential. |
CVE-2021-30168 | Critical | 9.8 | 2021-04-28 | The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator’s credential and further control… |
CVE-2021-30167 | Critical | 9.8 | 2021-04-28 | The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s inf… |
CVE-2021-30166 | High | 7.2 | 2021-04-28 | The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack… |
CVE-2021-27648 | Critical | 9.0 | 2021-04-28 | Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essential before 1.4.8-2801 allows remote aut… |
CVE-2021-31866 | Medium | 5.3 | 2021-04-28 | Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string co… |
CVE-2021-31865 | Medium | 5.3 | 2021-04-28 | Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded attachments. |
CVE-2021-31864 | Medium | 5.3 | 2021-04-28 | Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the add_issue_notes permission requirement by leveraging the incomi… |
CVE-2021-31863 | High | 7.5 | 2021-04-28 | Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to rea… |
CVE-2021-31779 | Medium | 6.4 | 2021-04-28 | The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account. |
CVE-2021-31778 | Medium | 5.4 | 2021-04-28 | The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account. |
CVE-2021-31777 | Medium | 4.9 | 2021-04-28 | The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user acc… |
CVE-2021-27933 | Medium | 6.1 | 2021-04-28 | pfSense 2.5.0 allows XSS via the services_wol_edit.php Description field. |
CVE-2021-31856 | Critical | 9.8 | 2021-04-28 | A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles e… |
CVE-2021-31815 | Low | 3.3 | 2021-04-28 | GAEN (aka Google/Apple Exposure Notifications) through 2021-04-27 on Android allows attackers to obtain sensitive information, such as a user's location histor… |
CVE-2021-3512 | High | 8.8 | 2021-04-28 | Improper access control vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and prior, DWR-HP-G300NH firmware Ver.1.83 and prior, HW-450HP-Z… |