2021 CVEs (page 187)
Page 187 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-31726 | Critical | 9.8 | 2021-04-25 | Akuvox C315 115.116.2613 allows remote command Injection via the cfgd_server service. The attack vector is sending a payload to port 189 (default root 0.0.0.0). |
CVE-2021-31718 | High | 8.8 | 2021-04-25 | The server in npupnp before 4.1.4 is affected by DNS rebinding in the embedded web server (including UPnP SOAP and GENA endpoints), leading to remote code exec… |
CVE-2021-30502 | Critical | 9.8 | 2021-04-25 | The unofficial vscode-ghc-simple (aka Simple Glasgow Haskell Compiler) extension before 0.2.3 for Visual Studio Code allows remote code execution via a crafted… |
CVE-2021-31712 | Medium | 5.4 | 2021-04-24 | react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a… |
CVE-2021-31794 | Medium | 6.1 | 2021-04-24 | Settings.aspx?view=About in Directum 5.8.2 allows XSS via the HTTP User-Agent header. |
CVE-2021-31795 | High | 7.0 | 2021-04-24 | The PowerVR GPU kernel driver in pvrsrvkm.ko through 2021-04-24 for the Linux kernel, as used on Alcatel 1S phones, allows attackers to overwrite heap memory v… |
CVE-2021-31598 | High | 7.5 | 2021-04-24 | An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_decode() performs incorrect memory handling while parsing crafted XML files, leading t… |
CVE-2021-31791 | High | 7.5 | 2021-04-23 | In Hardware Sentry KM before 10.0.01 for BMC PATROL, a cleartext password may be discovered after a failure or timeout of a command. |
CVE-2021-31584 | High | 8.8 | 2021-04-23 | Sipwise C5 NGCP www_csc version 3.6.4 up to and including platform NGCP CE mr3.8.13 allows call/click2dial CSRF attacks for actions with administrative privile… |
CVE-2021-31583 | Medium | 5.4 | 2021-04-23 | Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS vulnerabilities wh… |
CVE-2021-29158 | Medium | 4.9 | 2021-04-23 | Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control. |
CVE-2021-25899 | High | 7.5 | 2021-04-23 | An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. An unauthenticated attacker can send a crafted HTTP request to perform a blind time… |
CVE-2021-25898 | High | 7.5 | 2021-04-23 | An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Passwords are stored in unencrypted source-code text files. This was noted when acc… |
CVE-2021-31780 | High | 7.5 | 2021-04-23 | In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit. When an object has a… |
CVE-2021-29470 | Medium | 4.7 | 2021-04-23 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in E… |
CVE-2021-20089 | High | 8.8 | 2021-04-23 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in purl 2.3.2 allows a malicious user to inject properties into Objec… |
CVE-2021-20086 | High | 8.8 | 2021-04-23 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inject properties into… |
CVE-2021-20085 | High | 8.8 | 2021-04-23 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malicious user to inject… |
CVE-2021-20083 | High | 8.8 | 2021-04-23 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malicious user to inject… |
CVE-2021-29469 | Medium | 5.3 | 2021-04-23 | Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause… |
CVE-2021-22682 | High | 7.8 | 2021-04-23 | Cscape (All versions prior to 9.90 SP4) is configured by default to be installed for all users, which allows full permissions, including read/write access. Thi… |
CVE-2021-22678 | High | 7.8 | 2021-04-23 | Cscape (All versions prior to 9.90 SP4) lacks proper validation of user-supplied data when parsing project files. This could lead to memory corruption. An atta… |
CVE-2021-22207 | Medium | 5.5 | 2021-04-23 | Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service via packet injection or crafted captu… |
CVE-2021-22205 | Critical | 10.0 | 2021-04-23 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a fi… |
CVE-2021-22204 | Medium | 6.8 | 2021-04-23 | Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image |
CVE-2021-20088 | High | 8.8 | 2021-04-23 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in mootools-more 1.6.0 allows a malicious user to inject properties i… |
CVE-2021-20087 | High | 8.8 | 2021-04-23 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-deparam 0.5.1 allows a malicious user to inject properties… |
CVE-2021-20084 | High | 8.8 | 2021-04-23 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-sparkle 1.5.2-beta allows a malicious user to inject proper… |
CVE-2021-31540 | High | 7.1 | 2021-04-23 | Wowza Streaming Engine through 4.8.5 (in a default installation) has incorrect file permissions of configuration files in the conf/ directory. A regular local… |
CVE-2021-31539 | Medium | 5.5 | 2021-04-23 | Wowza Streaming Engine before 4.8.8.01 (in a default installation) has cleartext passwords stored in the conf/admin.password file. A regular local user is able… |
CVE-2021-31410 | High | 8.6 | 2021-04-23 | Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access project sources via… |
CVE-2021-31408 | Medium | 6.3 | 2021-04-23 | Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses… |
CVE-2021-22893 | Critical | 10.0 | 2021-04-23 | Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure… |
CVE-2021-31407 | High | 8.6 | 2021-04-23 | Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0… |
CVE-2021-31406 | Medium | 4.0 | 2021-04-23 | Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6)… |
CVE-2021-31405 | High | 7.5 | 2021-04-23 | Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 thr… |
CVE-2021-31404 | Medium | 4.0 | 2021-04-23 | Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1… |
CVE-2021-31403 | Medium | 4.0 | 2021-04-23 | Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), an… |
CVE-2021-26909 | Low | 3.7 | 2021-04-23 | Automox Agent prior to version 31 uses an insufficiently protected S3 bucket endpoint for storing sensitive files, which could be brute-forced by an attacker t… |
CVE-2021-26908 | Low | 3.3 | 2021-04-23 | Automox Agent prior to version 31 logs potentially sensitive information in local log files, which could be used by a locally-authenticated attacker to subvert… |
CVE-2021-26291 | Critical | 9.1 | 2021-04-23 | Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potenti… |
CVE-2021-25382 | Medium | 6.1 | 2021-04-23 | An improper authorization of using debugging command in Secure Folder prior to SMR Oct-2020 Release 1 allows unauthorized access to contents in Secure Folder v… |
CVE-2021-31607 | High | 7.8 | 2021-04-23 | In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion… |
CVE-2021-31597 | Critical | 9.4 | 2021-04-23 | The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists bu… |
CVE-2021-2320 | Critical | 9.1 | 2021-04-22 | Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Management Console). The supported version that… |
CVE-2021-2319 | Critical | 9.1 | 2021-04-22 | Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Management Console). The supported version that… |
CVE-2021-2318 | Critical | 9.1 | 2021-04-22 | Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Management Console). The supported version that… |
CVE-2021-2317 | Critical | 10.0 | 2021-04-22 | Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Management Console). The supported version that… |
CVE-2021-2316 | High | 8.1 | 2021-04-22 | Vulnerability in the Oracle HRMS (France) product of Oracle E-Business Suite (component: French HR). Supported versions that are affected are 12.1.1-12.1.3. Ea… |
CVE-2021-2315 | Medium | 5.4 | 2021-04-22 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). Supported versions that are affected are 11.1.1.9.0, 12… |
CVE-2021-2314 | High | 8.1 | 2021-04-22 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Profiles). Supported versions that are affected are 12.1… |
CVE-2021-2312 | Medium | 4.4 | 2021-04-22 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily… |
CVE-2021-2311 | Medium | 6.5 | 2021-04-22 | Vulnerability in the Oracle Hospitality Inventory Management product of Oracle Food and Beverage Applications (component: Export to Reporting and Analytics). T… |
CVE-2021-2310 | High | 7.5 | 2021-04-22 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Diffic… |
CVE-2021-2309 | High | 7.5 | 2021-04-22 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Diffic… |
CVE-2021-2308 | Low | 2.7 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.23 and prior. E… |
CVE-2021-2307 | Medium | 6.1 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging). Supported versions that are affected are 5.7.33 and prior and 8.0.23… |
CVE-2021-2306 | Medium | 6.0 | 2021-04-22 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily… |
CVE-2021-2305 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.23 and prior. Easily exploitab… |
CVE-2021-2304 | Medium | 5.5 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.23 and prior. Eas… |
CVE-2021-2303 | Medium | 4.9 | 2021-04-22 | Vulnerability in the OSS Support Tools product of Oracle Support Tools (component: Diagnostic Assistant). The supported version that is affected is Prior to 2… |
CVE-2021-2302 | Critical | 9.8 | 2021-04-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: OPSS). Supported versions that are affected are 11.1.1.9… |
CVE-2021-2301 | Low | 2.7 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.23 and prior. E… |
CVE-2021-2300 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.23 and prior. Easily exploitab… |
CVE-2021-2299 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exp… |
CVE-2021-2298 | Medium | 6.5 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exp… |
CVE-2021-2297 | Medium | 5.3 | 2021-04-22 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Diffic… |
CVE-2021-2296 | Medium | 5.3 | 2021-04-22 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Diffic… |
CVE-2021-2295 | High | 8.1 | 2021-04-22 | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affecte… |
CVE-2021-2294 | Medium | 6.5 | 2021-04-22 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3… |
CVE-2021-2293 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.23 and prior. Eas… |
CVE-2021-2292 | High | 8.1 | 2021-04-22 | Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Document Management). Supported versions that… |
CVE-2021-2291 | Medium | 4.7 | 2021-04-22 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Diffic… |
CVE-2021-2290 | High | 8.1 | 2021-04-22 | Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). Supported versions that are affected are 12.1.1-12.1… |
CVE-2021-2289 | High | 8.1 | 2021-04-22 | Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Template, GTIN search). Supported versions that are affected are 12.1.1-… |
CVE-2021-2288 | High | 8.1 | 2021-04-22 | Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Bill Issues). Supported versions that are affected are 12.1.1-12.1… |
CVE-2021-2287 | High | 7.1 | 2021-04-22 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily… |
CVE-2021-2286 | High | 7.1 | 2021-04-22 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily… |
CVE-2021-2285 | High | 7.1 | 2021-04-22 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily… |
CVE-2021-2284 | High | 7.1 | 2021-04-22 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily… |
CVE-2021-2283 | High | 7.1 | 2021-04-22 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily… |
CVE-2021-2282 | High | 7.1 | 2021-04-22 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily… |
CVE-2021-2281 | High | 7.1 | 2021-04-22 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily… |
CVE-2021-2280 | High | 7.1 | 2021-04-22 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily… |
CVE-2021-2279 | High | 8.1 | 2021-04-22 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Diffic… |
CVE-2021-2278 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exp… |
CVE-2021-2277 | High | 7.5 | 2021-04-22 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2… |
CVE-2021-2276 | High | 8.1 | 2021-04-22 | Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). Supported versions that are affect… |
CVE-2021-2275 | Medium | 6.5 | 2021-04-22 | Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: View Reports). Supported versions that are affected are 12.1.3… |
CVE-2021-2274 | High | 8.1 | 2021-04-22 | Vulnerability in the Oracle E-Business Tax product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.1-12.1… |
CVE-2021-2273 | High | 8.1 | 2021-04-22 | Vulnerability in the Oracle Legal Entity Configurator product of Oracle E-Business Suite (component: Create Contracts). Supported versions that are affected ar… |
CVE-2021-2272 | High | 8.1 | 2021-04-22 | Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component: Inquiries). Supported versions that are affected are 12.1.1-12… |
CVE-2021-2271 | High | 8.1 | 2021-04-22 | Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Resource Exceptions). Supported versions that are affected are 12.1… |
CVE-2021-2270 | High | 8.1 | 2021-04-22 | Vulnerability in the Oracle Site Hub product of Oracle E-Business Suite (component: Sites). Supported versions that are affected are 12.1.1-12.1.3. Easily expl… |
CVE-2021-2269 | High | 8.1 | 2021-04-22 | Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Price Book). The supported version that is affected is 12.1.3. Easi… |
CVE-2021-2268 | High | 8.1 | 2021-04-22 | Vulnerability in the Oracle Quoting product of Oracle E-Business Suite (component: Courseware). Supported versions that are affected are 12.1.1-12.1.3. Easily… |
CVE-2021-2267 | High | 8.1 | 2021-04-22 | Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.1-… |
CVE-2021-2266 | Medium | 6.0 | 2021-04-22 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily… |
CVE-2021-2264 | High | 8.4 | 2021-04-22 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily… |
CVE-2021-2263 | High | 8.1 | 2021-04-22 | Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Intelligence, RFx). Supported versions that are affected are 12.1.1-12.1.3… |