2021 CVEs (page 191)
Page 191 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-27031 | High | 7.8 | 2021-04-19 | A user may be tricked into opening a malicious FBX file which may exploit a use-after-free vulnerability in FBX's Review causing the application to reference a… |
CVE-2021-27030 | High | 7.8 | 2021-04-19 | A user may be tricked into opening a malicious FBX file which may exploit a Directory Traversal Remote Code Execution vulnerability in FBX’s Review causing it… |
CVE-2021-27029 | Medium | 5.5 | 2021-04-19 | The user may be tricked into opening a malicious FBX file which may exploit a Null Pointer Dereference vulnerability in FBX's Review version 1.5.0 and prior ca… |
CVE-2021-27028 | High | 7.8 | 2021-04-19 | A Memory Corruption Vulnerability in Autodesk FBX Review version 1.5.0 and prior may lead to remote code execution through maliciously crafted DLL files. |
CVE-2021-27027 | High | 7.8 | 2021-04-19 | An Out-Of-Bounds Read Vulnerability in Autodesk FBX Review version 1.5.0 and prior may lead to code execution through maliciously crafted DLL files or informat… |
CVE-2021-21981 | High | 7.8 | 2021-04-19 | VMware NSX-T contains a privilege escalation vulnerability due to an issue with RBAC (Role based access control) role assignment. Successful exploitation of th… |
CVE-2021-20992 | High | 8.1 | 2021-04-19 | In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communication between the use… |
CVE-2021-20991 | Critical | 9.8 | 2021-04-19 | In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a command injection vu… |
CVE-2021-20990 | High | 7.5 | 2021-04-19 | In Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older an internal management service is accessible on port 8000 and some API endpoints… |
CVE-2021-20989 | Medium | 5.9 | 2021-04-19 | Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote su… |
CVE-2021-21070 | Medium | 6.5 | 2021-04-19 | Adobe Robohelp version 2020.0.3 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. An atta… |
CVE-2021-29399 | Medium | 6.1 | 2021-04-19 | XMB is vulnerable to cross-site scripting (XSS) due to inadequate filtering of BBCode input. This bug affects all versions of XMB. All XMB installations must b… |
CVE-2021-23381 | High | 7.3 | 2021-04-18 | This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is… |
CVE-2021-23380 | Medium | 5.6 | 2021-04-18 | This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating system… |
CVE-2021-23379 | High | 7.3 | 2021-04-18 | This affects all versions of package portkiller. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. Th… |
CVE-2021-23378 | Critical | 9.8 | 2021-04-18 | This affects all versions of package picotts. If attacker-controlled user input is given to the say function, it is possible for an attacker to execute arbitra… |
CVE-2021-23377 | Critical | 9.8 | 2021-04-18 | This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execut… |
CVE-2021-23376 | Critical | 9.8 | 2021-04-18 | This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for an attacker to execu… |
CVE-2021-23375 | High | 7.3 | 2021-04-18 | This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitra… |
CVE-2021-23374 | High | 7.3 | 2021-04-18 | This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arb… |
CVE-2021-3493 | High | 8.8 | 2021-04-17 | The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an unde… |
CVE-2021-3492 | High | 8.8 | 2021-04-17 | Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. Thes… |
CVE-2021-29452 | High | 8.1 | 2021-04-16 | a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This fea… |
CVE-2021-29451 | Critical | 9.1 | 2021-04-16 | Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens. This allows for… |
CVE-2021-29446 | Medium | 5.9 | 2021-04-16 | jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CB… |
CVE-2021-29445 | Medium | 5.9 | 2021-04-16 | jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CB… |
CVE-2021-29444 | Medium | 5.9 | 2021-04-16 | jose-browser-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC… |
CVE-2021-27394 | High | 8.8 | 2021-04-16 | A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.19), Mendix Applications using Mendix 8 (All versions < V8.17.0… |
CVE-2021-31348 | Medium | 6.5 | 2021-04-16 | An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect memory handling while parsing crafted XML files (out-of… |
CVE-2021-31347 | Medium | 6.5 | 2021-04-16 | An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect memory handling while parsing crafted XML files (writin… |
CVE-2021-29443 | Medium | 5.9 | 2021-04-16 | jose is an npm library providing a number of cryptographic operations. In vulnerable versions AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CB… |
CVE-2021-26830 | Critical | 9.1 | 2021-04-16 | SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` inp… |
CVE-2021-20491 | Medium | 4.4 | 2021-04-16 | IBM Spectrum Protect Server 7.1 and 8.1 is subject to a stack-based buffer overflow caused by improper bounds checking during the parsing of commands. By issui… |
CVE-2021-22539 | High | 8.2 | 2021-04-16 | An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint *.bzl… |
CVE-2021-31414 | Critical | 9.8 | 2021-04-16 | The unofficial vscode-rpm-spec extension before 0.3.2 for Visual Studio Code allows remote code execution via a crafted workspace configuration. |
CVE-2021-26074 | Medium | 6.5 | 2021-04-16 | Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot pack… |
CVE-2021-26073 | High | 7.7 | 2021-04-16 | Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building A… |
CVE-2021-27692 | Critical | 9.8 | 2021-04-16 | Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary O… |
CVE-2021-27691 | Critical | 9.8 | 2021-04-16 | Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN , and Tenda G1 and G3 routers with firmware versions v… |
CVE-2021-29450 | Medium | 6.5 | 2021-04-15 | Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requ… |
CVE-2021-21405 | Medium | 5.9 | 2021-04-15 | Lotus is an Implementation of the Filecoin protocol written in Go. BLS signature validation in lotus uses blst library method VerifyCompressed. This method acc… |
CVE-2021-29447 | High | 7.1 | 2021-04-15 | Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE… |
CVE-2021-29432 | Medium | 5.3 | 2021-04-15 | Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be use… |
CVE-2021-29431 | High | 7.7 | 2021-04-15 | Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP ad… |
CVE-2021-29430 | High | 7.5 | 2021-04-15 | Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP req… |
CVE-2021-30245 | High | 8.8 | 2021-04-15 | The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006 an… |
CVE-2021-31402 | High | 7.5 | 2021-04-15 | The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-2020-35669. |
CVE-2021-28055 | Medium | 6.5 | 2021-04-15 | An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an… |
CVE-2021-29433 | Medium | 4.3 | 2021-04-15 | Sydent is a reference Matrix identity server. In Sydent versions 2.2.0 and prior, sissing input validation of some parameters on the endpoints used to confirm… |
CVE-2021-26582 | Medium | 6.1 | 2021-04-15 | A security vulnerability in HPE IceWall SSO Domain Gateway Option (Dgfw) module version 10.0 on RHEL 5/6/7, version 10.0 on HP-UX 11i v3, version 10.0 on Windo… |
CVE-2021-3243 | Medium | 6.1 | 2021-04-15 | Wfilter ICF 5.0.117 contains a cross-site scripting (XSS) vulnerability. An attacker in the same LAN can craft a packet with a malicious User-Agent header to i… |
CVE-2021-29448 | High | 7.6 | 2021-04-15 | Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be explo… |
CVE-2021-27112 | Critical | 9.8 | 2021-04-15 | LightCMS v1.3.5 contains a remote code execution vulnerability in /app/Http/Controllers/Admin/NEditorController.php during the downloading of external images. |
CVE-2021-31229 | Medium | 6.5 | 2021-04-15 | An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd() performs incorrect memory handling while parsing crafted XML files, whi… |
CVE-2021-20288 | High | 7.2 | 2021-04-15 | An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_ke… |
CVE-2021-30209 | Medium | 6.5 | 2021-04-15 | Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background without any security verification, which may… |
CVE-2021-28549 | High | 7.8 | 2021-04-15 | Adobe Photoshop versions 21.2.6 (and earlier) and 22.3 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted JSX file… |
CVE-2021-28548 | High | 7.8 | 2021-04-15 | Adobe Photoshop versions 21.2.6 (and earlier) and 22.3 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted JSX file… |
CVE-2021-28242 | High | 8.8 | 2021-04-15 | SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive database information by injecting SQL comm… |
CVE-2021-27673 | Medium | 4.8 | 2021-04-15 | Cross Site Scripting (XSS) in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code b… |
CVE-2021-27672 | Medium | 4.9 | 2021-04-15 | SQL Injection in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive database information… |
CVE-2021-21100 | High | 7.8 | 2021-04-15 | Adobe Digital Editions version 4.5.11.187245 (and earlier) is affected by a Privilege Escalation vulnerability during installation. An unauthenticated attacker… |
CVE-2021-21096 | Medium | 5.5 | 2021-04-15 | Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by an Improper Authorization vulnerability in the Genuine Software Service. A… |
CVE-2021-21095 | High | 7.8 | 2021-04-15 | Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by an Out-of-bounds write vulnerability when parsing a crafted file. An unauth… |
CVE-2021-21094 | High | 7.8 | 2021-04-15 | Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by an Out-of-bounds write vulnerability when parsing a specially crafted file… |
CVE-2021-21093 | High | 7.8 | 2021-04-15 | Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by a memory corruption vulnerability when parsing a specially crafted file. An… |
CVE-2021-21092 | High | 7.8 | 2021-04-15 | Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by a memory corruption vulnerability when parsing a specially crafted file. An… |
CVE-2021-21091 | Low | 3.3 | 2021-04-15 | Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by an Out-of-bounds read vulnerability when parsing a crafted file. An unauthe… |
CVE-2021-21087 | Medium | 5.4 | 2021-04-15 | Adobe Coldfusion versions 2016 (update 16 and earlier), 2018 (update 10 and earlier) and 2021.0.0.323925 are affected by an Improper Neutralization of Input Du… |
CVE-2021-0488 | Medium | 6.7 | 2021-04-15 | In pb_write of pb_encode.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System… |
CVE-2021-27545 | Medium | 6.5 | 2021-04-15 | SQL Injection in the "add-services.php" component of PHPGurukul Beauty Parlour Management System v1.0 allows remote attackers to obtain sensitive database info… |
CVE-2021-27544 | Medium | 4.8 | 2021-04-15 | Cross Site Scripting (XSS) in the "add-services.php" component of PHPGurukul Beauty Parlour Management System v1.0 allows remote attackers to execute arbitrary… |
CVE-2021-27129 | Medium | 5.4 | 2021-04-15 | CASAP Automated Enrollment System version 1.0 contains a cross-site scripting (XSS) vulnerability through the Students > Edit > ROUTE parameter. |
CVE-2021-27850 | Critical | 9.8 | 2021-04-15 | A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5… |
CVE-2021-23887 | High | 7.8 | 2021-04-15 | Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to writ… |
CVE-2021-23886 | Medium | 5.5 | 2021-04-15 | Denial of Service vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to cause a… |
CVE-2021-23884 | Medium | 4.3 | 2021-04-15 | Cleartext Transmission of Sensitive Information vulnerability in the ePO Extension of McAfee Content Security Reporter (CSR) prior to 2.8.0 allows an ePO admin… |
CVE-2021-30487 | Low | 2.7 | 2021-04-15 | In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the… |
CVE-2021-30479 | Medium | 5.3 | 2021-04-15 | An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the all_public_streams API feature resulted in guest users being able to rec… |
CVE-2021-30478 | Medium | 4.3 | 2021-04-15 | An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (previously is_api_super_user) resulted in u… |
CVE-2021-30477 | Medium | 4.3 | 2021-04-15 | An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing webhooks to private streams meant that… |
CVE-2021-26076 | Low | 3.7 | 2021-04-15 | The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4… |
CVE-2021-26075 | Medium | 4.3 | 2021-04-15 | The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before 8.13.4, and from ve… |
CVE-2021-27183 | High | 7.2 | 2021-04-14 | An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is… |
CVE-2021-27182 | High | 8.8 | 2021-04-14 | An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClient). It can be exploited via an email mes… |
CVE-2021-27181 | High | 8.8 | 2021-04-14 | An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit th… |
CVE-2021-27180 | Medium | 6.1 | 2021-04-14 | An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webmail (aka WorldClient). It can be exploited via a GET request. It allows perform… |
CVE-2021-29449 | Medium | 6.3 | 2021-04-14 | Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in vers… |
CVE-2021-28157 | High | 7.2 | 2021-04-14 | An SQL Injection issue in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows an administrative user to execute arbitrary SQL c… |
CVE-2021-28048 | Medium | 6.5 | 2021-04-14 | An overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows a remote attacker to leak cross-origin… |
CVE-2021-3017 | High | 7.5 | 2021-04-14 | The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the def_wirelesspasswo… |
CVE-2021-30459 | Critical | 9.8 | 2021-04-14 | A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL s… |
CVE-2021-29654 | High | 7.2 | 2021-04-14 | AjaxSearchPro before 4.20.8 allows Deserialization of Untrusted Data (in the import database feature of the administration panel), leading to Remote Code execu… |
CVE-2021-28484 | High | 7.5 | 2021-04-14 | An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04). The handler did not va… |
CVE-2021-27710 | Critical | 9.8 | 2021-04-14 | Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote… |
CVE-2021-26031 | Medium | 5.3 | 2021-04-14 | An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate filters on module layout settings could lead to an LFI. |
CVE-2021-26030 | Medium | 6.1 | 2021-04-14 | An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page |
CVE-2021-28856 | Medium | 5.5 | 2021-04-14 | In Deark before v1.5.8, a specially crafted input file can cause a division by zero in (src/fmtutil.c) because of the value of pixelsize. |
CVE-2021-28855 | Medium | 5.5 | 2021-04-14 | In Deark before 1.5.8, a specially crafted input file can cause a NULL pointer dereference in the dbuf_write function (src/deark-dbuf.c). |
CVE-2021-28826 | High | 8.8 | 2021-04-14 | The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Community Edition and TIBCO Messaging -… |