2021 CVEs (page 194)
Page 194 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-0435 | High | 7.5 | 2021-04-13 | In avrc_proc_vendor_command of avrc_api.cc, there is a possible leak of heap data due to uninitialized data. This could lead to remote information disclosure w… |
CVE-2021-0433 | High | 8.0 | 2021-04-13 | In onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when pairing a Bluetooth device due to a tapjacking/overlay attack. T… |
CVE-2021-0432 | High | 7.0 | 2021-04-13 | In ClearPullerCacheIfNecessary and ForceClearPullerCache of StatsPullerManager.cpp, there is a possible use-after-free due to a race condition. This could lead… |
CVE-2021-0431 | High | 7.5 | 2021-04-13 | In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a p… |
CVE-2021-0430 | Critical | 9.8 | 2021-04-13 | In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution via a ma… |
CVE-2021-0429 | High | 7.8 | 2021-04-13 | In pollOnce of ALooper.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional ex… |
CVE-2021-0428 | Medium | 5.5 | 2021-04-13 | In getSimSerialNumber of TelephonyManager.java, there is a possible way to read a trackable identifier due to a missing permission check. This could lead to lo… |
CVE-2021-0427 | High | 7.8 | 2021-04-13 | In parseExclusiveStateAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of… |
CVE-2021-0426 | High | 7.8 | 2021-04-13 | In parsePrimaryFieldFirstUidAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalat… |
CVE-2021-0400 | Medium | 5.5 | 2021-04-13 | In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of location data to emergency services due… |
CVE-2021-29999 | Critical | 9.8 | 2021-04-13 | An issue was discovered in Wind River VxWorks through 6.8. There is a possible stack overflow in dhcp server. |
CVE-2021-29998 | Critical | 9.8 | 2021-04-13 | An issue was discovered in Wind River VxWorks before 6.5. There is a possible heap overflow in dhcp client. |
CVE-2021-29997 | Medium | 5.3 | 2021-04-13 | An issue was discovered in Wind River VxWorks 7 before 21.03. A specially crafted packet may lead to buffer over-read on IKE. |
CVE-2021-28973 | Medium | 4.9 | 2021-04-13 | The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configur… |
CVE-2021-21731 | High | 8.1 | 2021-04-13 | A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused because the management page does not fully verify whether the r… |
CVE-2021-21730 | Critical | 9.8 | 2021-04-13 | A ZTE product is impacted by improper access control vulnerability. The attacker could exploit this vulnerability to access CLI by brute force attacks.This aff… |
CVE-2021-21729 | Medium | 6.5 | 2021-04-13 | Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perform illegal authorization operations by… |
CVE-2021-30176 | Critical | 9.8 | 2021-04-13 | The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint. |
CVE-2021-30175 | Critical | 9.8 | 2021-04-13 | ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page. |
CVE-2021-22505 | Critical | 9.8 | 2021-04-13 | Escalation of privileges vulnerability in Micro Focus Operations Agent, affects versions 12.0x, 12.10, 12.11, 12.12, 12.14 and 12.15. The vulnerability could b… |
CVE-2021-28647 | High | 7.8 | 2021-04-13 | Trend Micro Password Manager version 5 (Consumer) is vulnerable to a DLL Hijacking vulnerability which could allow an attacker to inject a malicious DLL file d… |
CVE-2021-28646 | Medium | 5.5 | 2021-04-13 | An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to take control of… |
CVE-2021-28645 | High | 7.8 | 2021-04-13 | An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to escalate… |
CVE-2021-25253 | High | 7.8 | 2021-04-13 | An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource used by the service cou… |
CVE-2021-25250 | High | 7.8 | 2021-04-13 | An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a sensitive file could allow a loc… |
CVE-2021-29943 | Critical | 9.1 | 2021-04-13 | When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server… |
CVE-2021-29425 | Medium | 4.8 | 2021-04-13 | In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result wou… |
CVE-2021-29262 | High | 7.5 | 2021-04-13 | When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security… |
CVE-2021-27905 | Critical | 9.8 | 2021-04-13 | The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is us… |
CVE-2021-29054 | High | 8.8 | 2021-04-13 | Certain Papoo products are affected by: Cross Site Request Forgery (CSRF) in the admin interface. This affects Papoo CMS Light through 21.02 and Papoo CMS Pro… |
CVE-2021-29003 | Critical | 9.8 | 2021-04-13 | Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacters to sys_config_valid.xgi, as demonstra… |
CVE-2021-28938 | Medium | 4.3 | 2021-04-13 | Siren Federate before 6.8.14-10.3.9, 6.9.x through 7.6.x before 7.6.2-20.2, 7.7.x through 7.9.x before 7.9.3-21.6, 7.10.x before 7.10.2-22.2, and 7.11.x before… |
CVE-2021-30637 | Medium | 5.4 | 2021-04-13 | htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php. |
CVE-2021-30503 | Critical | 9.8 | 2021-04-13 | The unofficial GLSL Linting extension before 1.4.0 for Visual Studio Code allows remote code execution via a crafted glslangValidatorPath in the workspace conf… |
CVE-2021-30044 | Medium | 5.4 | 2021-04-13 | Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php. |
CVE-2021-30042 | Medium | 5.4 | 2021-04-13 | Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Clinic Name", "Clinic Address", "Clinic City", or "Clinic Contact" field on clinics/register.php |
CVE-2021-30039 | Medium | 5.4 | 2021-04-13 | Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Fever" or "Blood Pressure" field on the patients/register-report.php. |
CVE-2021-30034 | Medium | 5.4 | 2021-04-13 | Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Symptons field on patients/register-report.php. |
CVE-2021-30030 | Medium | 5.4 | 2021-04-13 | Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Full Name field on register-patient.php. |
CVE-2021-29429 | Medium | 4.0 | 2021-04-12 | In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by G… |
CVE-2021-21393 | Medium | 5.3 | 2021-04-12 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2021-21392 | Medium | 6.3 | 2021-04-12 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2021-3163 | Medium | 6.1 | 2021-04-12 | A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attr… |
CVE-2021-22497 | Low | 3.8 | 2021-04-12 | Advanced Authentication versions prior to 6.3 SP4 have a potential broken authentication due to improper session management issue. |
CVE-2021-21394 | Medium | 5.3 | 2021-04-12 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2021-21545 | High | 7.8 | 2021-04-12 | Dell Peripheral Manager 1.3.1 or greater contains remediation for a local privilege escalation vulnerability that could be potentially exploited to gain arbitr… |
CVE-2021-21524 | Critical | 9.8 | 2021-04-12 | Dell SRM versions prior to 4.5.0.1 and Dell SMR versions prior to 4.5.0.1 contain an Untrusted Deserialization Vulnerability. A remote unauthenticated attacker… |
CVE-2021-3128 | High | 7.5 | 2021-04-12 | In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is used, a routing lo… |
CVE-2021-3125 | High | 7.5 | 2021-04-12 | In TP-Link TL-XDR3230 < 1.0.12, TL-XDR1850 < 1.0.9, TL-XDR1860 < 1.0.14, TL-XDR3250 < 1.0.2, TL-XDR6060 Turbo < 1.1.8, TL-XDR5430 < 1.0.11, and possibly others… |
CVE-2021-29357 | High | 8.6 | 2021-04-12 | The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 (and LifeTime management console before 11.7.0) allows SSRF… |
CVE-2021-29302 | High | 8.1 | 2021-04-12 | TP-Link TL-WR802N(US), Archer_C50v5_US v4_200 <= 2020.06 contains a buffer overflow vulnerability in the httpd process in the body message. The attack vector i… |
CVE-2021-23270 | High | 7.5 | 2021-04-12 | In Gargoyle OS 1.12.0, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's r… |
CVE-2021-20519 | Medium | 5.4 | 2021-04-12 | IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alt… |
CVE-2021-27486 | High | 7.8 | 2021-04-12 | FATEK Automation WinProladder Versions 3.30 and prior is vulnerable to an integer underflow, which may cause an out-of-bounds write and allow an attacker to ex… |
CVE-2021-24024 | Medium | 4.3 | 2021-04-12 | A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may… |
CVE-2021-22190 | High | 8.5 | 2021-04-12 | A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token |
CVE-2021-25926 | Medium | 6.1 | 2021-04-12 | In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the… |
CVE-2021-25925 | Medium | 5.4 | 2021-04-12 | in SiCKRAGE, versions 4.2.0 to 10.0.11.dev1 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly when processed b… |
CVE-2021-24231 | Medium | 6.5 | 2021-04-12 | The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged a… |
CVE-2021-24230 | High | 8.1 | 2021-04-12 | The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged i… |
CVE-2021-24229 | Critical | 9.6 | 2021-04-12 | The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin bef… |
CVE-2021-24228 | Critical | 9.6 | 2021-04-12 | The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form (wp-… |
CVE-2021-24227 | High | 7.5 | 2021-04-12 | The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the… |
CVE-2021-24226 | High | 7.5 | 2021-04-12 | In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortco… |
CVE-2021-24225 | Medium | 5.4 | 2021-04-12 | The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in a… |
CVE-2021-24224 | High | 8.8 | 2021-04-12 | The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in… |
CVE-2021-24223 | Critical | 9.8 | 2021-04-12 | The N5 Upload Form WordPress plugin through 1.0 suffers from an arbitrary file upload issue in page where a Form from the plugin is embed, as any file can be u… |
CVE-2021-24222 | Critical | 9.8 | 2021-04-12 | The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the [formCadastro] is embed. The form allows… |
CVE-2021-24221 | High | 8.8 | 2021-04-12 | The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with th… |
CVE-2021-24220 | Critical | 9.1 | 2021-04-12 | Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme… |
CVE-2021-24219 | Medium | 5.3 | 2021-04-12 | The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7… |
CVE-2021-24218 | High | 8.8 | 2021-04-12 | The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a l… |
CVE-2021-24217 | High | 8.1 | 2021-04-12 | The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied cre… |
CVE-2021-24215 | Critical | 9.8 | 2021-04-12 | An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website custom… |
CVE-2021-24213 | Medium | 6.1 | 2021-04-12 | The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of t… |
CVE-2021-24200 | Medium | 6.5 | 2021-04-12 | The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Inj… |
CVE-2021-24199 | Medium | 6.5 | 2021-04-12 | The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Inj… |
CVE-2021-24198 | High | 8.1 | 2021-04-12 | The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the… |
CVE-2021-24197 | High | 8.1 | 2021-04-12 | The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the… |
CVE-2021-23370 | High | 7.5 | 2021-04-12 | This affects the package swiper before 6.5.1. |
CVE-2021-23369 | Medium | 5.6 | 2021-04-12 | The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an… |
CVE-2021-23368 | Medium | 5.3 | 2021-04-12 | The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing. |
CVE-2021-23371 | High | 7.5 | 2021-04-12 | This affects the package chrono-node before 2.2.4. It hangs on a date-like string with lots of embedded spaces. |
CVE-2021-29379 | High | 8.8 | 2021-04-12 | An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perfor… |
CVE-2021-28879 | Critical | 9.8 | 2021-04-11 | In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer ov… |
CVE-2021-28878 | High | 7.5 | 2021-04-11 | In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditi… |
CVE-2021-28877 | High | 7.5 | 2021-04-11 | In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested. This bug… |
CVE-2021-28876 | Medium | 5.3 | 2021-04-11 | In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same… |
CVE-2021-28875 | High | 7.5 | 2021-04-11 | In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer… |
CVE-2021-30485 | Medium | 6.5 | 2021-04-11 | An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd(), while parsing a crafted XML file, performs incorrect memory handling… |
CVE-2021-30481 | High | 8.0 | 2021-04-10 | Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow… |
CVE-2021-20020 | Critical | 9.8 | 2021-04-10 | A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root. |
CVE-2021-30480 | High | 8.5 | 2021-04-09 | Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker… |
CVE-2021-21199 | High | 8.8 | 2021-04-09 | Use after free in Aura in Google Chrome on Linux prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially explo… |
CVE-2021-21198 | High | 7.4 | 2021-04-09 | Out of bounds read in IPC in Google Chrome prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2021-21197 | High | 8.8 | 2021-04-09 | Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2021-21196 | High | 8.8 | 2021-04-09 | Heap buffer overflow in TabStrip in Google Chrome on Windows prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a craf… |
CVE-2021-21195 | High | 8.8 | 2021-04-09 | Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21194 | High | 8.8 | 2021-04-09 | Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2021-25381 | Medium | 5.5 | 2021-04-09 | Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above allows local attacker… |