2021 CVEs (page 192)
Page 192 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-28825 | High | 8.8 | 2021-04-14 | The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Community Edition and TIBCO Messaging - E… |
CVE-2021-28060 | Medium | 5.3 | 2021-04-14 | A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url paramet… |
CVE-2021-27708 | Critical | 9.8 | 2021-04-14 | Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote… |
CVE-2021-27260 | Low | 3.2 | 2021-04-14 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first… |
CVE-2021-27259 | High | 7.8 | 2021-04-14 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the… |
CVE-2021-27258 | Critical | 9.8 | 2021-04-14 | This vulnerability allows remote attackers to execute escalate privileges on affected installations of SolarWinds Orion Platform 2020.2. Authentication is not… |
CVE-2021-27253 | High | 8.8 | 2021-04-14 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Although authentication is… |
CVE-2021-27252 | High | 8.8 | 2021-04-14 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Authentica… |
CVE-2021-27251 | High | 8.8 | 2021-04-14 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Authentication is not requ… |
CVE-2021-27250 | Medium | 6.5 | 2021-04-14 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access poi… |
CVE-2021-27249 | High | 8.8 | 2021-04-14 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. Aut… |
CVE-2021-27248 | High | 8.8 | 2021-04-14 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. Aut… |
CVE-2021-27247 | Medium | 6.5 | 2021-04-14 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tencent WeChat 2.9.5 desktop version. User interactio… |
CVE-2021-27246 | High | 8.0 | 2021-04-14 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 AC1750 1.0.15 routers. Authentica… |
CVE-2021-30494 | Medium | 5.5 | 2021-04-14 | Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the Razer Chroma SDK subkey. Th… |
CVE-2021-30493 | Medium | 5.5 | 2021-04-14 | Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the ChromaBroadcast subkey. The… |
CVE-2021-28098 | High | 7.8 | 2021-04-14 | An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in the logging function. SecureConnector ru… |
CVE-2021-27707 | Critical | 9.8 | 2021-04-14 | Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/"portMappi… |
CVE-2021-27706 | Critical | 9.8 | 2021-04-14 | Buffer Overflow in Tenda G1 and G3 routers with firmware version V15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/"I… |
CVE-2021-27705 | Critical | 9.8 | 2021-04-14 | Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/"qosIndex… |
CVE-2021-27608 | High | 7.5 | 2021-04-14 | An unquoted service path in SAPSetup, version - 9.0, could lead to privilege escalation during the installation process that is performed when an executable fi… |
CVE-2021-27604 | Medium | 6.5 | 2021-04-14 | In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise Service Repository JAVA… |
CVE-2021-27599 | Medium | 6.5 | 2021-04-14 | SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Integration Builder Framework), versions - 7.10, 7.30, 7.31, 7.40, 7.50, allows an attacker… |
CVE-2021-27130 | Critical | 9.8 | 2021-04-14 | Online Reviewer System 1.0 contains a SQL injection vulnerability through authentication bypass, which may lead to a reverse shell upload. |
CVE-2021-25314 | High | 7.8 | 2021-04-14 | A Creation of Temporary File With Insecure Permissions vulnerability in hawk2 of SUSE Linux Enterprise High Availability 12-SP3, SUSE Linux Enterprise High Ava… |
CVE-2021-31152 | High | 8.8 | 2021-04-14 | Multilaser Router AC1200 V02.03.01.45_pt contains a cross-site request forgery (CSRF) vulnerability. An attacker can enable remote access, change passwords, an… |
CVE-2021-29338 | Medium | 5.5 | 2021-04-14 | Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the… |
CVE-2021-28300 | Critical | 9.8 | 2021-04-14 | NULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" function of GPAC v0.5.2 allows attackers to execute arbitrary code or cause a Denial… |
CVE-2021-27990 | High | 7.5 | 2021-04-14 | Appspace 6.2.4 is vulnerable to a broken authentication mechanism where pages such as /medianet/mail.aspx can be called directly and the framework is exposed w… |
CVE-2021-27815 | Medium | 5.5 | 2021-04-14 | NULL Pointer Deference in the exif command line tool, when printing out XML formatted EXIF data, in exif v0.6.22 and earlier allows attackers to cause a Denial… |
CVE-2021-27288 | Medium | 6.1 | 2021-04-14 | Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "Co… |
CVE-2021-27114 | Critical | 9.8 | 2021-04-14 | An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/addassignment route, a very long text entry for the"'… |
CVE-2021-27113 | Critical | 9.8 | 2021-04-14 | An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of… |
CVE-2021-26832 | Medium | 6.1 | 2021-04-14 | Cross Site Scripting (XSS) in the "Reset Password" page form of Priority Enterprise Management System v8.00 allows attackers to execute javascript on behalf of… |
CVE-2021-26827 | High | 7.5 | 2021-04-14 | Buffer Overflow in TP-Link WR2041 v1 firmware for the TL-WR2041+ router allows remote attackers to cause a Denial-of-Service (DoS) by sending an HTTP request w… |
CVE-2021-26812 | Medium | 6.1 | 2021-04-14 | Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. This allows attackers to craft a malicious U… |
CVE-2021-26805 | Medium | 5.5 | 2021-04-14 | Buffer Overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a malicious WAV file. |
CVE-2021-22879 | High | 8.8 | 2021-04-14 | Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote… |
CVE-2021-27989 | Medium | 5.4 | 2021-04-14 | Appspace 6.2.4 is vulnerable to stored cross-site scripting (XSS) in multiple parameters within /medianet/sgcontentset.aspx. |
CVE-2021-25316 | Low | 3.3 | 2021-04-14 | A Insecure Temporary File vulnerability in s390-tools of SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-SP2 allows local attackers to pre… |
CVE-2021-28797 | Critical | 9.8 | 2021-04-14 | A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows… |
CVE-2021-31162 | Critical | 9.8 | 2021-04-14 | In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics. |
CVE-2021-24028 | Critical | 9.8 | 2021-04-14 | An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects… |
CVE-2021-29370 | Medium | 6.1 | 2021-04-13 | A UXSS was discovered in the Thanos-Soft Cheetah Browser in Android 1.2.0 due to the inadequate filter of the intent scheme. This resulted in Cross-site script… |
CVE-2021-3473 | Medium | 4.5 | 2021-04-13 | An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an inter… |
CVE-2021-3463 | Medium | 4.2 | 2021-04-13 | A null pointer dereference vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could cause systems to experience… |
CVE-2021-3462 | Medium | 5.5 | 2021-04-13 | A privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could allow unauthorized access to the… |
CVE-2021-3460 | High | 8.1 | 2021-04-13 | The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the support server which could… |
CVE-2021-29440 | High | 8.4 | 2021-04-13 | Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit page… |
CVE-2021-29439 | High | 7.2 | 2021-04-13 | The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users with the permission `admin.login` can ins… |
CVE-2021-29438 | Medium | 4.6 | 2021-04-13 | The Nextcloud dialogs library (npm package @nextcloud/dialogs) before 3.1.2 insufficiently escaped text input passed to a toast. If your application displays t… |
CVE-2021-29437 | High | 8.0 | 2021-04-13 | ScratchOAuth2 is an Oauth implementation for Scratch. Any ScratchOAuth2-related data normally accessible and modifiable by a user can be read and modified by a… |
CVE-2021-29436 | Medium | 5.4 | 2021-04-13 | Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forg… |
CVE-2021-29435 | High | 8.1 | 2021-04-13 | trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create… |
CVE-2021-29428 | High | 8.8 | 2021-04-13 | In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and… |
CVE-2021-29427 | High | 8.0 | 2021-04-13 | In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning. Repository con… |
CVE-2021-28483 | Critical | 9.0 | 2021-04-13 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2021-28482 | High | 8.8 | 2021-04-13 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2021-28481 | Critical | 9.8 | 2021-04-13 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2021-28480 | Critical | 9.8 | 2021-04-13 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2021-28477 | High | 7.0 | 2021-04-13 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2021-28475 | High | 7.8 | 2021-04-13 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2021-28473 | High | 7.8 | 2021-04-13 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2021-28472 | High | 7.8 | 2021-04-13 | Visual Studio Code Maven for Java Extension Remote Code Execution Vulnerability |
CVE-2021-28471 | High | 7.8 | 2021-04-13 | Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability |
CVE-2021-28470 | High | 7.8 | 2021-04-13 | Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability |
CVE-2021-28469 | High | 7.8 | 2021-04-13 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2021-28468 | High | 7.8 | 2021-04-13 | Raw Image Extension Remote Code Execution Vulnerability |
CVE-2021-28466 | High | 7.8 | 2021-04-13 | Raw Image Extension Remote Code Execution Vulnerability |
CVE-2021-28464 | High | 7.8 | 2021-04-13 | VP9 Video Extensions Remote Code Execution Vulnerability |
CVE-2021-28460 | High | 8.1 | 2021-04-13 | Azure Sphere Unsigned Code Execution Vulnerability |
CVE-2021-28459 | Medium | 6.1 | 2021-04-13 | Azure DevOps Server Spoofing Vulnerability |
CVE-2021-28458 | High | 7.8 | 2021-04-13 | Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerability |
CVE-2021-28457 | High | 7.8 | 2021-04-13 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2021-28456 | Medium | 5.5 | 2021-04-13 | Microsoft Excel Information Disclosure Vulnerability |
CVE-2021-28454 | High | 7.8 | 2021-04-13 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2021-28453 | High | 7.8 | 2021-04-13 | Microsoft Word Remote Code Execution Vulnerability |
CVE-2021-28452 | High | 7.1 | 2021-04-13 | Microsoft Outlook Memory Corruption Vulnerability |
CVE-2021-28451 | High | 7.8 | 2021-04-13 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2021-28450 | Medium | 5.0 | 2021-04-13 | Microsoft SharePoint Denial of Service Vulnerability |
CVE-2021-28449 | High | 7.8 | 2021-04-13 | Microsoft Office Remote Code Execution Vulnerability |
CVE-2021-28448 | High | 7.8 | 2021-04-13 | Visual Studio Code Kubernetes Tools Remote Code Execution Vulnerability |
CVE-2021-28447 | Medium | 4.4 | 2021-04-13 | Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability |
CVE-2021-28446 | High | 7.1 | 2021-04-13 | Windows Portmapping Information Disclosure Vulnerability |
CVE-2021-28445 | High | 8.1 | 2021-04-13 | Windows Network File System Remote Code Execution Vulnerability |
CVE-2021-28444 | Medium | 5.7 | 2021-04-13 | Windows Hyper-V Security Feature Bypass Vulnerability |
CVE-2021-28443 | Medium | 5.5 | 2021-04-13 | Windows Console Driver Denial of Service Vulnerability |
CVE-2021-28442 | Medium | 6.5 | 2021-04-13 | Windows TCP/IP Information Disclosure Vulnerability |
CVE-2021-28441 | Medium | 6.5 | 2021-04-13 | Windows Hyper-V Information Disclosure Vulnerability |
CVE-2021-28440 | High | 7.0 | 2021-04-13 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2021-28439 | High | 7.5 | 2021-04-13 | Windows TCP/IP Driver Denial of Service Vulnerability |
CVE-2021-28438 | Medium | 5.5 | 2021-04-13 | Windows Console Driver Denial of Service Vulnerability |
CVE-2021-28437 | Medium | 5.5 | 2021-04-13 | Windows Installer Information Disclosure Vulnerability |
CVE-2021-28436 | High | 7.8 | 2021-04-13 | Windows Speech Runtime Elevation of Privilege Vulnerability |
CVE-2021-28435 | Medium | 5.5 | 2021-04-13 | Windows Event Tracing Information Disclosure Vulnerability |
CVE-2021-28434 | High | 8.8 | 2021-04-13 | Remote Procedure Call Runtime Remote Code Execution Vulnerability |
CVE-2021-28358 | High | 8.8 | 2021-04-13 | Remote Procedure Call Runtime Remote Code Execution Vulnerability |
CVE-2021-28357 | High | 8.8 | 2021-04-13 | Remote Procedure Call Runtime Remote Code Execution Vulnerability |
CVE-2021-28356 | High | 8.8 | 2021-04-13 | Remote Procedure Call Runtime Remote Code Execution Vulnerability |
CVE-2021-28355 | High | 8.8 | 2021-04-13 | Remote Procedure Call Runtime Remote Code Execution Vulnerability |