2021 CVEs (page 186)
Page 186 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-3511 | Medium | 4.3 | 2021-04-28 | Disclosure of sensitive information to an unauthorized user vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and prior, DWR-HP-G300NH fir… |
CVE-2021-20716 | Critical | 9.8 | 2021-04-28 | Hidden functionality in multiple Buffalo network devices (BHR-4RV firmware Ver.2.55 and prior, FS-G54 firmware Ver.2.04 and prior, WBR2-B11 firmware Ver.2.32 a… |
CVE-2021-29476 | Critical | 9.8 | 2021-04-27 | Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1… |
CVE-2021-29472 | High | 8.8 | 2021-04-27 | Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctl… |
CVE-2021-29442 | High | 8.6 | 2021-04-27 | Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController let… |
CVE-2021-29441 | High | 8.6 | 2021-04-27 | Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use auth… |
CVE-2021-30128 | Critical | 9.8 | 2021-04-27 | Apache OFBiz has unsafe deserialization prior to 17.12.07 version |
CVE-2021-29460 | High | 7.6 | 2021-04-27 | Kirby is an open source CMS. An editor with write access to the Kirby Panel can upload an SVG file that contains harmful content like `<script>` tags. The dire… |
CVE-2021-29200 | Critical | 9.8 | 2021-04-27 | Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack |
CVE-2021-21429 | Medium | 4.0 | 2021-04-27 | OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using `File.cre… |
CVE-2021-21365 | Medium | 5.4 | 2021-04-27 | Bootstrap Package is a theme for TYPO3. It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid ba… |
CVE-2021-30638 | High | 7.5 | 2021-04-27 | Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constr… |
CVE-2021-29667 | High | 7.8 | 2021-04-27 | IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary comman… |
CVE-2021-29666 | Medium | 5.4 | 2021-04-27 | IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja… |
CVE-2021-20550 | Medium | 5.4 | 2021-04-27 | IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2021-20549 | Medium | 5.4 | 2021-04-27 | IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2021-20448 | Medium | 5.4 | 2021-04-27 | IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2021-3464 | High | 7.8 | 2021-04-27 | A DLL search path vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow privilege escalation. |
CVE-2021-3451 | Medium | 5.5 | 2021-04-27 | A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow configuration files to be written to non-st… |
CVE-2021-30642 | Critical | 9.8 | 2021-04-27 | An input validation flaw in the Symantec Security Analytics web UI 7.2 prior 7.2.7, 8.1, prior to 8.1.3-NSR3, 8.2, prior to 8.2.1-NSR2 or 8.2.2 allows a remote… |
CVE-2021-28269 | High | 8.8 | 2021-04-27 | Soyal Technology 701Client 9.0.1 is vulnerable to Insecure permissions via client.exe binary with Authenticated Users group with Full permissions. |
CVE-2021-28271 | High | 8.8 | 2021-04-27 | Soyal Technologies SOYAL 701Server 9.0.1 suffers from an elevation of privileges vulnerability which can be used by an authenticated user to change the executa… |
CVE-2021-22664 | High | 7.8 | 2021-04-27 | CNCSoft-B Versions 1.0.0.3 and prior is vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code. |
CVE-2021-22660 | High | 7.8 | 2021-04-27 | CNCSoft-B Versions 1.0.0.3 and prior is vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code. |
CVE-2021-27480 | Critical | 9.8 | 2021-04-27 | Delta Industrial Automation COMMGR Versions 1.12 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute remote code. |
CVE-2021-28125 | Medium | 6.1 | 2021-04-27 | Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects th… |
CVE-2021-20715 | Medium | 4.3 | 2021-04-27 | Improper access control vulnerability in Hot Pepper Gourmet App for Android ver.4.111.0 and earlier, and for iOS ver.4.111.0 and earlier allows a remote attack… |
CVE-2021-20714 | Medium | 6.5 | 2021-04-27 | Directory traversal vulnerability in WP Fastest Cache versions prior to 0.9.1.7 allows a remote attacker with administrator privileges to delete arbitrary file… |
CVE-2021-31826 | High | 7.5 | 2021-04-27 | Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable (for a… |
CVE-2021-31671 | High | 7.5 | 2021-04-27 | pgsync before 0.6.7 is affected by Information Disclosure of sensitive information. Syncing the schema with the --schema-first and --schema-only options is mis… |
CVE-2021-30635 | Medium | 5.3 | 2021-04-27 | Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-related folder via direc… |
CVE-2021-30165 | High | 7.5 | 2021-04-27 | The default administrator account & password of the EDIMAX wireless network camera is hard-coded. Remote attackers can disassemble firmware to obtain the privi… |
CVE-2021-29474 | Medium | 4.7 | 2021-04-26 | HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. An attacker can read arbitrary `.md` files from the server's filesystem du… |
CVE-2021-31784 | High | 7.8 | 2021-04-26 | An out-of-bounds write vulnerability exists in the file-reading procedure in Open Design Alliance Drawings SDK before 2021.6 on all supported by ODA platforms… |
CVE-2021-31783 | High | 7.5 | 2021-04-26 | show_default.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not validated with a pr… |
CVE-2021-31646 | Critical | 9.8 | 2021-04-26 | Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote). The affected component is the file forgot_pwd.php - it uses… |
CVE-2021-29475 | Critical | 10.0 | 2021-04-26 | HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. An attacker is able to receive arbitrary files from the file system when e… |
CVE-2021-29473 | Low | 2.5 | 2021-04-26 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in… |
CVE-2021-22669 | High | 8.8 | 2021-04-26 | Incorrect permissions are set to default on the ‘Project Management’ page of WebAccess/SCADA portal of WebAccess/SCADA Versions 9.0.1 and prior, which may allo… |
CVE-2021-29694 | High | 7.5 | 2021-04-26 | IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf… |
CVE-2021-29672 | High | 7.8 | 2021-04-26 | IBM Spectrum Protect Client 8.1.0.0-8 through 1.11.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking when processing the cur… |
CVE-2021-21226 | Critical | 9.6 | 2021-04-26 | Use after free in navigation in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2021-21225 | High | 8.8 | 2021-04-26 | Out of bounds memory access in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2021-21224 | High | 8.8 | 2021-04-26 | Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
CVE-2021-21223 | Critical | 9.6 | 2021-04-26 | Integer overflow in Mojo in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
CVE-2021-21222 | Medium | 6.5 | 2021-04-26 | Heap buffer overflow in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to bypass site isolation v… |
CVE-2021-21221 | Medium | 6.5 | 2021-04-26 | Insufficient validation of untrusted input in Mojo in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the renderer process to… |
CVE-2021-21220 | High | 8.8 | 2021-04-26 | Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a… |
CVE-2021-21219 | Medium | 5.5 | 2021-04-26 | Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2021-21218 | Medium | 5.5 | 2021-04-26 | Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2021-21217 | Medium | 5.5 | 2021-04-26 | Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2021-21216 | Medium | 6.5 | 2021-04-26 | Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2021-21215 | Medium | 6.5 | 2021-04-26 | Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2021-21214 | High | 8.8 | 2021-04-26 | Use after free in Network API in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Exte… |
CVE-2021-21213 | High | 8.8 | 2021-04-26 | Use after free in WebMIDI in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21212 | Medium | 6.5 | 2021-04-26 | Incorrect security UI in Network Config UI in Google Chrome on ChromeOS prior to 90.0.4430.72 allowed a remote attacker to potentially compromise WiFi connecti… |
CVE-2021-21211 | Medium | 6.5 | 2021-04-26 | Inappropriate implementation in Navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2021-21210 | Medium | 6.5 | 2021-04-26 | Inappropriate implementation in Network in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially access local UDP ports via a crafted HT… |
CVE-2021-21209 | Medium | 6.5 | 2021-04-26 | Inappropriate implementation in storage in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2021-21208 | Medium | 6.5 | 2021-04-26 | Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing vi… |
CVE-2021-21207 | High | 8.6 | 2021-04-26 | Use after free in IndexedDB in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extension to potentially per… |
CVE-2021-21206 | High | 8.8 | 2021-04-26 | Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21205 | High | 8.1 | 2021-04-26 | Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions via a c… |
CVE-2021-21204 | High | 8.8 | 2021-04-26 | Use after free in Blink in Google Chrome on OS X prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21203 | High | 8.8 | 2021-04-26 | Use after free in Blink in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21202 | High | 8.6 | 2021-04-26 | Use after free in extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extension to potentially pe… |
CVE-2021-21201 | Critical | 9.6 | 2021-04-26 | Use after free in permissions in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2021-20546 | Medium | 5.5 | 2021-04-26 | IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local attacker could… |
CVE-2021-20536 | Medium | 6.2 | 2021-04-26 | IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-… |
CVE-2021-20532 | High | 7.8 | 2021-04-26 | IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 could allow a local user to escalate their privileges to take full control of the system due to insecure d… |
CVE-2021-20432 | Medium | 6.5 | 2021-04-26 | IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and ret… |
CVE-2021-27851 | Medium | 5.5 | 2021-04-26 | A security vulnerability that can lead to local privilege escalation has been found in ’guix-daemon’. It affects multi-user setups in which ’guix-daemon’ runs… |
CVE-2021-23382 | Medium | 5.3 | 2021-04-26 | The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-ma… |
CVE-2021-3494 | Medium | 5.9 | 2021-04-26 | A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA… |
CVE-2021-3472 | High | 7.8 | 2021-04-26 | A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver which can lead to a local privilege escalation. The h… |
CVE-2021-28399 | Medium | 5.3 | 2021-04-26 | OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function. |
CVE-2021-25839 | Critical | 9.8 | 2021-04-26 | A weak password requirement vulnerability exists in the Create New User function of MintHCM RELEASE 3.0.8, which could lead an attacker to easier password brut… |
CVE-2021-25838 | Medium | 6.1 | 2021-04-26 | The Import function in MintHCM RELEASE 3.0.8 allows an attacker to execute a cross-site scripting (XSS) payload in file-upload. |
CVE-2021-31802 | High | 8.8 | 2021-04-26 | NETGEAR R7000 1.0.11.116 devices have a heap-based Buffer Overflow that is exploitable from the local network without authentication. The vulnerability exists… |
CVE-2021-28079 | Medium | 6.1 | 2021-04-26 | Jamovi <=1.6.18 is affected by a cross-site scripting (XSS) vulnerability. The column-name is vulnerable to XSS in the ElectronJS Framework. An attacker can ma… |
CVE-2021-26797 | Critical | 9.8 | 2021-04-26 | An access control vulnerability in Hame SD1 Wi-Fi firmware <=V.20140224154640 allows an attacker to get system administrator through an open Telnet service. |
CVE-2021-25928 | Critical | 9.8 | 2021-04-26 | Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execut… |
CVE-2021-25927 | Critical | 9.8 | 2021-04-26 | Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execu… |
CVE-2021-23365 | Medium | 4.8 | 2021-04-26 | The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML auth… |
CVE-2021-31804 | Medium | 5.5 | 2021-04-26 | LeoCAD before 21.03 sometimes allows a use-after-free during the opening of a new document. |
CVE-2021-31803 | Medium | 6.1 | 2021-04-26 | cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581). |
CVE-2021-20712 | Medium | 5.3 | 2021-04-26 | Improper access control vulnerability in NEC Aterm WG2600HS firmware Ver1.5.1 and earlier, and Aterm WX3000HP firmware Ver1.1.2 and earlier allows a device con… |
CVE-2021-20711 | Critical | 9.8 | 2021-04-26 | Aterm WG2600HS firmware Ver1.5.1 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors. |
CVE-2021-20710 | Medium | 6.1 | 2021-04-26 | Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.5.1 and earlier allows remote attackers to inject an arbitrary script via unspecified vector… |
CVE-2021-20709 | High | 7.2 | 2021-04-26 | Improper validation of integrity check value vulnerability in NEC Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, a… |
CVE-2021-20708 | High | 7.2 | 2021-04-26 | NEC Aterm devices (Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier… |
CVE-2021-20697 | Critical | 9.8 | 2021-04-26 | Missing authentication for critical function in DAP-1880AC firmware version 1.21 and earlier allows a remote attacker to login to the device as an authenticate… |
CVE-2021-20696 | High | 8.8 | 2021-04-26 | DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to execute arbitrary OS commands by sending a specially crafted request to… |
CVE-2021-20695 | High | 8.8 | 2021-04-26 | Improper following of a certificate's chain of trust vulnerability in DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to ga… |
CVE-2021-20694 | High | 8.8 | 2021-04-26 | Improper access control vulnerability in DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to bypass access restriction and t… |
CVE-2021-20693 | High | 7.5 | 2021-04-26 | Improper access control vulnerability in Gurunavi App for Android ver.10.0.10 and earlier and for iOS ver.11.1.2 and earlier allows a remote attacker to lead a… |
CVE-2021-20680 | Medium | 6.1 | 2021-04-26 | Cross-site scripting vulnerability in NEC Aterm devices (Aterm WG1900HP2 firmware Ver.1.3.1 and earlier, Aterm WG1900HP firmware Ver.2.5.1 and earlier, Aterm W… |
CVE-2021-31762 | High | 8.8 | 2021-04-25 | Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users feature, and then get a reverse shell thro… |
CVE-2021-31761 | Critical | 9.6 | 2021-04-25 | Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature. |
CVE-2021-31760 | High | 8.8 | 2021-04-25 | Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to achieve Remote Command Execution (RCE) through Webmin's running process feature. |