2021 CVEs (page 19)
Page 19 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-32843 | Medium | 6.2 | 2023-02-17 | HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, `virtio.c` has is a call to `vc_cf… |
CVE-2021-26277 | Medium | 5.6 | 2023-02-17 | The framework service handles pendingIntent incorrectly, allowing a malicious application with certain privileges to perform privileged actions. |
CVE-2021-3172 | High | 8.1 | 2023-02-17 | An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature. |
CVE-2021-35261 | Critical | 9.8 | 2023-02-17 | File Upload Vulnerability in Yupoxion BearAdmin before commit 10176153528b0a914eb4d726e200fd506b73b075 allows attacker to execute arbitrary remote code via the… |
CVE-2021-34182 | Critical | 9.8 | 2023-02-17 | An issue in ttyd v.1.6.3 allows attacker to execute arbitrary code via default configuration permissions. |
CVE-2021-34164 | High | 8.8 | 2023-02-17 | Permissions vulnerability in LIZHIFAKA v.2.2.0 allows authenticated attacker to execute arbitrary commands via the set password function in the admin/index/ema… |
CVE-2021-33983 | High | 7.8 | 2023-02-17 | Buffer Overflow vulnerability in Dvidelabs flatcc v.0.6.0 allows local attacker to execute arbitrary code via the fltacc execution of the error_ref_sym functio… |
CVE-2021-33950 | High | 7.5 | 2023-02-17 | An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function. |
CVE-2021-33949 | Critical | 9.8 | 2023-02-17 | An issue in FeMiner WMS v1.1 allows attackers to execute arbitrary code via the filename parameter and the exec function. |
CVE-2021-33948 | Critical | 9.8 | 2023-02-17 | SQL injection vulnerability in FantasticLBP Hotels Server v1.0 allows attacker to execute arbitrary code via the username parameter. |
CVE-2021-33926 | High | 8.8 | 2023-02-17 | An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5… |
CVE-2021-33391 | Critical | 9.8 | 2023-02-17 | An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c. |
CVE-2021-33226 | Critical | 9.8 | 2023-02-17 | Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py fil… |
CVE-2021-32441 | High | 7.5 | 2023-02-17 | SQL Injection vulnerability in Exponent-CMS v.2.6.0 fixed in 2.7.0 allows attackers to gain access to sensitive information via the selectValue function in the… |
CVE-2021-32419 | Medium | 5.3 | 2023-02-17 | An issue in Schism Tracker v20200412 fixed in v.20200412 allows attacker to obtain sensitive information via the fmt_mtm_load_song function in fmt/mtm.c. |
CVE-2021-32163 | Critical | 9.8 | 2023-02-17 | Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization. |
CVE-2021-32142 | High | 7.8 | 2023-02-17 | Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/li… |
CVE-2021-43529 | Critical | 9.8 | 2023-02-16 | Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3… |
CVE-2021-23980 | Medium | 6.1 | 2023-02-16 | A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea… |
CVE-2021-33104 | Medium | 6.5 | 2023-02-16 | Improper access control in the Intel(R) OFU software before version 14.1.28 may allow an authenticated user to potentially enable denial of service via local a… |
CVE-2021-0187 | Low | 3.2 | 2023-02-16 | Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via loca… |
CVE-2021-43074 | Medium | 4.3 | 2023-02-16 | An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions… |
CVE-2021-42761 | Critical | 9.0 | 2023-02-16 | A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6… |
CVE-2021-42756 | Critical | 9.8 | 2023-02-16 | Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and be… |
CVE-2021-40555 | Medium | 5.4 | 2023-02-16 | Cross site scripting (XSS) vulnerability in flatCore-CMS 2.2.15 allows attackers to execute arbitrary code via description field on the new page creation form. |
CVE-2021-38239 | High | 7.5 | 2023-02-15 | SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10. |
CVE-2021-34117 | High | 7.5 | 2023-02-15 | SQL Injection vulnerability in SEO Panel 4.9.0 in api/user.api.php in function getUserName in the username parameter, allows attackers to gain sensitive inform… |
CVE-2021-33925 | Critical | 9.8 | 2023-02-15 | SQL Injection vulnerability in nitinparashar30 cms-corephp through commit bdabe52ef282846823bda102728a35506d0ec8f9 (May 19, 2021) allows unauthenticated attack… |
CVE-2021-33396 | Medium | 6.5 | 2023-02-15 | Cross Site Request Forgery (CSRF) vulnerability in baijiacms 4.1.4, allows attackers to change the password or other information of an arbitrary account via in… |
CVE-2021-33304 | Critical | 9.8 | 2023-02-15 | Double Free vulnerability in virtualsquare picoTCP v1.7.0 and picoTCP-NG v2.1 in modules/pico_fragments.c in function pico_fragments_reassemble, allows attacke… |
CVE-2021-46023 | High | 7.5 | 2023-02-14 | An Untrusted Pointer Dereference was discovered in function mrb_vm_exec in mruby before 3.1.0-rc. The vulnerability causes a segmentation fault and application… |
CVE-2021-36471 | Critical | 9.8 | 2023-02-07 | Directory Traversal vulnerability in AdminLTE 3.1.0 allows remote attackers to gain escalated privilege and view sensitive information via /admin/index2.html… |
CVE-2021-37492 | High | 7.5 | 2023-02-07 | An issue discovered in src/wallet/wallet.cpp in Ravencoin Core 4.3.2.1 and earlier allows attackers to view sensitive information via CWallet::CreateTransactio… |
CVE-2021-37491 | High | 7.5 | 2023-02-07 | An issue discovered in src/wallet/wallet.cpp in Dogecoin Project Dogecoin Core 1.14.3 and earlier allows attackers to view sensitive information via CWallet::C… |
CVE-2021-31578 | Critical | 9.8 | 2023-02-06 | In Boa, there is a possible escalation of privilege due to a stack buffer overflow. This could lead to remote escalation of privilege from a proximal attacker… |
CVE-2021-31577 | Critical | 9.8 | 2023-02-06 | In Boa, there is a possible escalation of privilege due to a missing permission check. This could lead to remote escalation of privilege from a proximal attack… |
CVE-2021-31576 | High | 7.5 | 2023-02-06 | In Boa, there is a possible information disclosure due to a missing permission check. This could lead to remote information disclosure to a proximal attacker w… |
CVE-2021-31575 | Critical | 9.8 | 2023-02-06 | In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal at… |
CVE-2021-31574 | Critical | 9.8 | 2023-02-06 | In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal at… |
CVE-2021-31573 | Critical | 9.8 | 2023-02-06 | In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal at… |
CVE-2021-36226 | Critical | 9.8 | 2023-02-06 | Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files. |
CVE-2021-36225 | High | 8.8 | 2023-02-06 | Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installa… |
CVE-2021-36224 | Critical | 9.8 | 2023-02-06 | Western Digital My Cloud devices before OS5 have a nobody account with a blank password. |
CVE-2021-37519 | Medium | 5.5 | 2023-02-03 | Buffer Overflow vulnerability in authfile.c memcached 1.6.9 allows attackers to cause a denial of service via crafted authenticattion file. |
CVE-2021-37518 | Medium | 6.1 | 2023-02-03 | Universal Cross Site Scripting (UXSS) vulnerability in Vimium Extension 1.66 and earlier allows remote attackers to run arbitrary code via omnibar feature. |
CVE-2021-37502 | Medium | 5.4 | 2023-02-03 | Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user. |
CVE-2021-37501 | High | 7.5 | 2023-02-03 | Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows attackers to cause a denial of service via h5tools_str_sprint in /hdf5/tools… |
CVE-2021-37497 | Critical | 9.8 | 2023-02-03 | SQL injection vulnerability in route of PbootCMS 3.0.5 allows remote attackers to run arbitrary SQL commands via crafted GET request. |
CVE-2021-37379 | Medium | 5.4 | 2023-02-03 | Cross Site Scripting (XSS) vulnerability in Teradek Sphere all firmware versions allows remote attackers to run arbitrary code via the Friendly Name field in S… |
CVE-2021-37378 | Medium | 5.4 | 2023-02-03 | Cross Site Scripting (XSS) vulnerability in Teradek Cube and Cube Pro firmware version 7.3.x and earlier allows remote attackers to run arbitrary code via the… |
CVE-2021-37377 | Medium | 5.4 | 2023-02-03 | Cross Site Scripting (XSS) vulnerability in Teradek Brik firmware version 7.2.x and earlier allows remote attackers to run arbitrary code via the Friendly Name… |
CVE-2021-37376 | Medium | 5.4 | 2023-02-03 | Cross Site Scripting (XSS) vulnerability in Teradek Bond, Bond 2 and Bond Pro firmware version 7.3.x and earlier allows remote attackers to run arbitrary code… |
CVE-2021-37375 | Medium | 5.4 | 2023-02-03 | Cross Site Scripting (XSS) vulnerability in Teradek VidiU / VidiU Mini firmware version 3.0.8 and earlier allows remote attackers to run arbitrary code via the… |
CVE-2021-37374 | Medium | 5.4 | 2023-02-03 | Cross Site Scripting (XSS) vulnerability in Teradek Clip all firmware versions allows remote attackers to run arbitrary code via the Friendly Name field in Sys… |
CVE-2021-37373 | Medium | 5.4 | 2023-02-03 | Cross Site Scripting (XSS) vulnerability in Teradek Slice 1st generation firmware 7.3.x and earlier allows remote attackers to run arbitrary code via the Frien… |
CVE-2021-37317 | Critical | 9.1 | 2023-02-03 | Directory Traversal vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary fi… |
CVE-2021-37316 | High | 7.5 | 2023-02-03 | SQL injection vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to view sensitive informati… |
CVE-2021-37315 | Critical | 9.1 | 2023-02-03 | Incorrect Access Control issue discoverd in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbit… |
CVE-2021-37311 | High | 7.5 | 2023-02-03 | Buffer Overflow vulnerability in fcitx5 5.0.8 allows attackers to cause a denial of service via crafted message to the application's listening port. |
CVE-2021-37306 | High | 7.5 | 2023-02-03 | An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: a… |
CVE-2021-37305 | High | 7.5 | 2023-02-03 | An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: /… |
CVE-2021-37304 | High | 7.5 | 2023-02-03 | An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the ht… |
CVE-2021-37234 | Medium | 6.5 | 2023-02-03 | Incorrect Access Control vulnerability in Modern Honey Network commit 0abf0db9cd893c6d5c727d036e1f817c02de4c7b allows remote attackers to view sensitive inform… |
CVE-2021-36712 | Medium | 5.4 | 2023-02-03 | Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function. |
CVE-2021-36570 | High | 8.8 | 2023-02-03 | Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---. |
CVE-2021-36569 | High | 8.8 | 2023-02-03 | Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2. |
CVE-2021-36546 | High | 7.5 | 2023-02-03 | Incorrect Access Control issue discovered in KiteCMS 1.1 allows remote attackers to view sensitive information via path in application URL. |
CVE-2021-36545 | Medium | 5.4 | 2023-02-03 | Cross Site Scripting (XSS) vulnerability in tpcms 3.2 allows remote attackers to run arbitrary code via the cfg_copyright or cfg_tel field in Site Configuratio… |
CVE-2021-36544 | High | 7.5 | 2023-02-03 | Incorrect Access Control issue discovered in tpcms 3.2 allows remote attackers to view sensitive information via path in application URL. |
CVE-2021-36538 | Medium | 5.4 | 2023-02-03 | Cross Site Scripting (XSS) vulnerability in Gurock TestRail before 7.1.2 allows remote authenticated attackers to run arbitrary code via the reference field in… |
CVE-2021-36535 | Medium | 5.5 | 2023-02-03 | Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js file to mjs_set_errorf. |
CVE-2021-36532 | High | 8.1 | 2023-02-03 | Race condition vulnerability discovered in portfolioCMS 1.0 allows remote attackers to run arbitrary code via fileExt parameter to localhost/admin/uploads.php. |
CVE-2021-36503 | Critical | 9.8 | 2023-02-03 | SQL injection vulnerability in native-php-cms 1.0 allows remote attackers to run arbitrary SQL commands via the cat parameter to /list.php file. |
CVE-2021-36493 | High | 7.5 | 2023-02-03 | Buffer Overflow vulnerability in pdfimages in xpdf 4.03 allows attackers to crash the application via crafted command. |
CVE-2021-36489 | Medium | 6.5 | 2023-02-03 | Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of service via crafted PCX/TGA/BMP files to allegro_image addon. |
CVE-2021-36484 | Critical | 9.8 | 2023-02-03 | SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page. |
CVE-2021-36444 | High | 8.8 | 2023-02-03 | Cross Site Request Forgery (CSRF) vulnerability in imcat 5.4 allows remote attackers to gain escalated privileges via flaws one time token generation on the ad… |
CVE-2021-36443 | High | 8.8 | 2023-02-03 | Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification. |
CVE-2021-36434 | Critical | 9.1 | 2023-02-03 | SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_json_check function in jocm… |
CVE-2021-36433 | Critical | 9.1 | 2023-02-03 | SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_delete_mask function in joc… |
CVE-2021-36432 | High | 7.5 | 2023-02-03 | SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_set_mask() function in jocm… |
CVE-2021-36431 | Critical | 9.1 | 2023-02-03 | SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_json_check() function in jo… |
CVE-2021-36426 | High | 8.8 | 2023-02-03 | File Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code via crafted file upload to include/inc_lib/general.inc.php. |
CVE-2021-36425 | Medium | 5.4 | 2023-02-03 | Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include… |
CVE-2021-36424 | Critical | 9.8 | 2023-02-03 | An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation. |
CVE-2021-3809 | High | 7.8 | 2023-02-01 | Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP… |
CVE-2021-3808 | High | 7.8 | 2023-02-01 | Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP… |
CVE-2021-3439 | High | 7.8 | 2023-02-01 | HP has identified a potential vulnerability in BIOS firmware of some Workstation products. Firmware updates are being released to mitigate these potential vuln… |
CVE-2021-22786 | High | 7.5 | 2023-02-01 | A CWE-200: Information Exposure vulnerability exists that could cause the exposure of sensitive information stored on the memory of the controller when communi… |
CVE-2021-46873 | Medium | 5.3 | 2023-01-29 | WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's system time to a fu… |
CVE-2021-4315 | Medium | 5.5 | 2023-01-28 | A vulnerability has been found in NYUCCL psiTurk up to 3.2.0 and classified as critical. This vulnerability affects unknown code of the file psiturk/experiment… |
CVE-2021-41231 | High | 7.2 | 2023-01-27 | OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DataFlow and to create… |
CVE-2021-41144 | High | 8.8 | 2023-01-27 | OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, a layout block was able to bypass the block blacklist to execute remote code. Ve… |
CVE-2021-41143 | High | 7.2 | 2023-01-27 | OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the… |
CVE-2021-39217 | High | 7.2 | 2023-01-27 | OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Custom Layout enabled admin users to execute arbitrary commands via block method… |
CVE-2021-21395 | Medium | 4.2 | 2023-01-27 | Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable… |
CVE-2021-41989 | High | 7.8 | 2023-01-26 | Qlik QlikView through 12.60.20100.0 creates a Temporary File in a Directory with Insecure Permissions. |
CVE-2021-41988 | High | 7.8 | 2023-01-26 | Qlik NPrinting Designer through 21.14.3.0 creates a Temporary File in a Directory with Insecure Permissions. |
CVE-2021-36686 | Medium | 5.4 | 2023-01-26 | Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page. |
CVE-2021-36539 | Medium | 6.5 | 2023-01-26 | Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc… |