2021 CVEs (page 195)
Page 195 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-25380 | Medium | 5.8 | 2021-04-09 | Improper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions registered by the user. |
CVE-2021-25379 | Medium | 4.0 | 2021-04-09 | Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action. |
CVE-2021-25378 | Medium | 4.3 | 2021-04-09 | Improper access control of certain port in SmartThings prior to version 1.7.63.6 allows remote temporary denial of service. |
CVE-2021-25377 | Low | 3.3 | 2021-04-09 | Intent redirection in Samsung Experience Service versions 10.8.0.4 in Android P(9.0) below, and 12.2.0.5 in Android Q(10.0) above allows attacker to execute pr… |
CVE-2021-25376 | Low | 3.1 | 2021-04-09 | An improper synchronization logic in Samsung Email prior to version 6.1.41.0 can leak messages in certain mailbox in plain text when STARTTLS negotiation is fa… |
CVE-2021-25375 | Medium | 6.5 | 2021-04-09 | Using predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote attackers to get attachments of another emails when users open… |
CVE-2021-25374 | High | 8.6 | 2021-04-09 | An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O(8.1) and below, and 3.9.00.9… |
CVE-2021-25373 | Medium | 5.5 | 2021-04-09 | Using unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(9.0), 2.7.02.1 in Android Q(10.0) and 2… |
CVE-2021-25365 | Medium | 5.9 | 2021-04-09 | An improper exception control in softsimd prior to SMR APR-2021 Release 1 allows unprivileged applications to access the API in softsimd. |
CVE-2021-25364 | Medium | 4.0 | 2021-04-09 | A pendingIntent hijacking vulnerability in Secure Folder prior to SMR APR-2021 Release 1 allows unprivileged applications to access contact information. |
CVE-2021-25363 | Medium | 6.8 | 2021-04-09 | An improper access control in ActivityManagerService prior to SMR APR-2021 Release 1 allows untrusted applications to access running processesdelete some local… |
CVE-2021-25362 | Medium | 6.8 | 2021-04-09 | An improper permission management in CertInstaller prior to SMR APR-2021 Release 1 allows untrusted applications to delete certain local files. |
CVE-2021-25361 | High | 7.9 | 2021-04-09 | An improper access control vulnerability in stickerCenter prior to SMR APR-2021 Release 1 allows local attackers to read or write arbitrary files of system pro… |
CVE-2021-25360 | Critical | 9.0 | 2021-04-09 | An improper input validation vulnerability in libswmfextractor library prior to SMR APR-2021 Release 1 allows attackers to execute arbitrary code on mediaextra… |
CVE-2021-25359 | Medium | 4.0 | 2021-04-09 | An improper SELinux policy prior to SMR APR-2021 Release 1 allows local attackers to access AP information without proper permissions via untrusted application… |
CVE-2021-25358 | Medium | 4.0 | 2021-04-09 | A vulnerability that stores IMSI values in an improper path prior to SMR APR-2021 Release 1 allows local attackers to access IMSI values without any permission… |
CVE-2021-25357 | Medium | 5.6 | 2021-04-09 | A pendingIntent hijacking vulnerability in Create Movie prior to SMR APR-2021 Release 1 in Android O(8.x) and P(9.0), 3.4.81.1 in Android Q(10,0), and 3.6.80.7… |
CVE-2021-25356 | High | 7.1 | 2021-04-09 | An improper caller check vulnerability in Managed Provisioning prior to SMR APR-2021 Release 1 allows unprivileged application to install arbitrary application… |
CVE-2021-21728 | Medium | 5.3 | 2021-04-09 | A ZTE product has a configuration error vulnerability. Because a certain port is open by default, an attacker can consume system processing resources by flushi… |
CVE-2021-21433 | Critical | 9.9 | 2021-04-09 | Discord Recon Server is a bot that allows you to do your reconnaissance process from your Discord. Remote code execution in version 0.0.1 would allow remote us… |
CVE-2021-21432 | High | 7.5 | 2021-04-09 | Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enabl… |
CVE-2021-20080 | Medium | 6.1 | 2021-04-09 | Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unau… |
CVE-2021-20022 | High | 7.2 | 2021-04-09 | SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host. |
CVE-2021-20021 | Critical | 9.8 | 2021-04-09 | A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to th… |
CVE-2021-29671 | Low | 3.3 | 2021-04-09 | IBM Spectrum Scale 5.1.0.1 could allow a local attacker to bypass the filesystem audit logging mechanism when file audit logging is enabled. IBM X-Force ID: 19… |
CVE-2021-21431 | High | 7.6 | 2021-04-09 | sopel-channelmgnt is a channelmgnt plugin for sopel. In versions prior to 2.0.1, on some IRC servers, restrictions around the removal of the bot using the kick… |
CVE-2021-29221 | High | 7.0 | 2021-04-09 | A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. By adding files to an existing installation's directory, a loc… |
CVE-2021-25328 | High | 8.8 | 2021-04-09 | Skyworth Digital Technology RN510 V.3.1.0.4 RN510 V.3.1.0.4 contains a buffer overflow vulnerability in /cgi-bin/app-staticIP.asp. An authenticated attacker ca… |
CVE-2021-25327 | Medium | 6.5 | 2021-04-09 | Skyworth Digital Technology RN510 V.3.1.0.4 contains a cross-site request forgery (CSRF) vulnerability in /cgi-bin/net-routeadd.asp and /cgi-bin/sec-urlfilter… |
CVE-2021-25326 | Medium | 5.4 | 2021-04-09 | Skyworth Digital Technology RN510 V.3.1.0.4 is affected by an incorrect access control vulnerability in/cgi-bin/test_version.asp. If Wi-Fi is connected but an… |
CVE-2021-30458 | Medium | 6.1 | 2021-04-09 | An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transfor… |
CVE-2021-30159 | Medium | 4.3 | 2021-04-09 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certai… |
CVE-2021-30156 | Medium | 4.3 | 2021-04-09 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Special:Contributions can leak that a "hidden" user exists. |
CVE-2021-30155 | Medium | 4.3 | 2021-04-09 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. ContentModelChange does not check if a user has correct permission… |
CVE-2021-30152 | Medium | 4.3 | 2021-04-09 | An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is curren… |
CVE-2021-3482 | Medium | 6.5 | 2021-04-08 | A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp… |
CVE-2021-3448 | Medium | 4.0 | 2021-04-08 | A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while fo… |
CVE-2021-3413 | Medium | 6.3 | 2021-04-08 | A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0. A credential leak was identified which will expose Azure Resour… |
CVE-2021-22513 | Medium | 6.5 | 2021-04-08 | Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier vers… |
CVE-2021-22512 | Medium | 6.5 | 2021-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and… |
CVE-2021-22511 | Medium | 6.5 | 2021-04-08 | Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and ea… |
CVE-2021-22510 | Medium | 6.1 | 2021-04-08 | Reflected XSS vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects all version 6.7 and earlier versions. |
CVE-2021-29154 | High | 7.8 | 2021-04-08 | BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the ke… |
CVE-2021-3146 | High | 7.8 | 2021-04-08 | The Dolby Audio X2 (DAX2) API service before 0.8.8.90 on Windows allows local users to gain privileges. |
CVE-2021-22312 | Medium | 6.5 | 2021-04-08 | There is a memory leak vulnerability in some Huawei products. An authenticated remote attacker may exploit this vulnerability by sending specific message to th… |
CVE-2021-3328 | High | 7.5 | 2021-04-08 | An issue was discovered in Aprelium Abyss Web Server X1 2.12.1 and 2.14. A crafted HTTP request can lead to an out-of-bounds read that crashes the application. |
CVE-2021-22507 | Critical | 9.8 | 2021-04-08 | Authentication bypass vulnerability in Micro Focus Operations Bridge Manager affects versions 2019.05, 2019.11, 2020.05 and 2020.10. The vulnerability could al… |
CVE-2021-22115 | Medium | 6.5 | 2021-04-08 | Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging config field is changed. CAPI database logs s… |
CVE-2021-27945 | Medium | 6.1 | 2021-04-08 | The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting (XSS) vulnerability affecting versions 2.0.0 up to and including 3.2.4. An attacke… |
CVE-2021-27522 | High | 8.8 | 2021-04-08 | Learnsite 1.2.5.0 contains a remote privilege escalation vulnerability in /Manager/index.aspx through the JudgIsAdmin() function. By modifying the initial lett… |
CVE-2021-30463 | High | 7.8 | 2021-04-08 | VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. After reading the RKEY value from u… |
CVE-2021-30462 | High | 7.2 | 2021-04-08 | VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration does not require a password to run /usr/local/vest… |
CVE-2021-28925 | Critical | 9.8 | 2021-04-08 | SQL injection vulnerability in Nagios Network Analyzer before 2.4.3 via the o[col] parameter to api/checks/read/. |
CVE-2021-28924 | Medium | 6.1 | 2021-04-08 | Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page. |
CVE-2021-20480 | Medium | 6.5 | 2021-04-08 | IBM WebSphere Application Server 7.0, 8.0, and 8.5 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, a remote authen… |
CVE-2021-30114 | Medium | 6.5 | 2021-04-08 | Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a voucher payment request through modul… |
CVE-2021-30113 | Medium | 6.1 | 2021-04-08 | A blind XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in event name and description fields. An attacker can inject a JavaScript code that w… |
CVE-2021-30112 | Medium | 6.5 | 2021-04-08 | Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a student_leave_application request thr… |
CVE-2021-30111 | Medium | 5.4 | 2021-04-08 | A stored XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in the event name and description fields. An attack can inject a JavaScript code tha… |
CVE-2021-3012 | Medium | 5.4 | 2021-04-08 | A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitra… |
CVE-2021-28686 | Medium | 5.5 | 2021-04-08 | AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to trigger a stack-based buffer overflow. This could enable low-pri… |
CVE-2021-28685 | High | 7.8 | 2021-04-08 | AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to interact directly with physical memory (by calling one of severa… |
CVE-2021-1405 | High | 7.5 | 2021-04-08 | A vulnerability in the email parsing module in Clam AntiVirus (ClamAV) Software version 0.103.1 and all prior versions could allow an unauthenticated, remote a… |
CVE-2021-1404 | High | 7.5 | 2021-04-08 | A vulnerability in the PDF parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to c… |
CVE-2021-1252 | High | 7.5 | 2021-04-08 | A vulnerability in the Excel XLM macro parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote a… |
CVE-2021-28174 | Medium | 6.5 | 2021-04-08 | Mitake smart stock selection system contains a broken authentication vulnerability. By manipulating the parameters in the URL, remote attackers can gain the pr… |
CVE-2021-1485 | Medium | 6.6 | 2021-04-08 | A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privi… |
CVE-2021-1480 | High | 7.8 | 2021-04-08 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated… |
CVE-2021-1479 | High | 7.8 | 2021-04-08 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated… |
CVE-2021-1475 | Medium | 6.5 | 2021-04-08 | Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to… |
CVE-2021-1474 | Medium | 6.5 | 2021-04-08 | Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to… |
CVE-2021-1473 | Medium | 5.3 | 2021-04-08 | Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary comma… |
CVE-2021-1472 | Medium | 5.3 | 2021-04-08 | Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary comma… |
CVE-2021-1467 | Medium | 4.3 | 2021-04-08 | A vulnerability in Cisco Webex Meetings for Android could allow an authenticated, remote attacker to modify the avatar of another user. This vulnerability is d… |
CVE-2021-1463 | Medium | 6.1 | 2021-04-08 | A vulnerability in the web-based management interface of Cisco Unified Intelligence Center Software could allow an unauthenticated, remote attacker to conduct… |
CVE-2021-1459 | Critical | 9.8 | 2021-04-08 | A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote… |
CVE-2021-1420 | Medium | 4.7 | 2021-04-08 | A vulnerability in certain web pages of Cisco Webex Meetings could allow an unauthenticated, remote attacker to modify a web page in the context of a user's br… |
CVE-2021-1415 | Medium | 6.3 | 2021-04-08 | Multiple vulnerabilities in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authentica… |
CVE-2021-1414 | Medium | 6.3 | 2021-04-08 | Multiple vulnerabilities in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authentica… |
CVE-2021-1413 | Medium | 6.3 | 2021-04-08 | Multiple vulnerabilities in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authentica… |
CVE-2021-1409 | Medium | 6.1 | 2021-04-08 | Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &a… |
CVE-2021-1408 | Medium | 6.1 | 2021-04-08 | Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &a… |
CVE-2021-1407 | Medium | 6.1 | 2021-04-08 | Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &a… |
CVE-2021-1406 | Medium | 4.9 | 2021-04-08 | A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could… |
CVE-2021-1399 | Medium | 4.3 | 2021-04-08 | A vulnerability in the Self Care Portal of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Editio… |
CVE-2021-1386 | High | 7.0 | 2021-04-08 | A vulnerability in the dynamic link library (DLL) loading mechanism in Cisco Advanced Malware Protection (AMP) for Endpoints Windows Connector, ClamAV for Wind… |
CVE-2021-1380 | Medium | 6.1 | 2021-04-08 | Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &a… |
CVE-2021-1362 | High | 8.8 | 2021-04-08 | A vulnerability in the SOAP API endpoint of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unifie… |
CVE-2021-1309 | High | 7.4 | 2021-04-08 | Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business RV Series Routers. An unauthenticated, adjac… |
CVE-2021-1308 | High | 7.4 | 2021-04-08 | Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business RV Series Routers. An unauthenticated, adjac… |
CVE-2021-1251 | High | 7.4 | 2021-04-08 | Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business RV Series Routers. An unauthenticated, adjac… |
CVE-2021-1137 | High | 7.8 | 2021-04-08 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated… |
CVE-2021-30457 | Critical | 9.8 | 2021-04-07 | An issue was discovered in the id-map crate through 2021-02-26 for Rust. A double free can occur in remove_set upon a panic in a Drop impl. |
CVE-2021-30456 | Critical | 9.8 | 2021-04-07 | An issue was discovered in the id-map crate through 2021-02-26 for Rust. A double free can occur in get_or_insert upon a panic of a user-provided f function. |
CVE-2021-30455 | Critical | 9.8 | 2021-04-07 | An issue was discovered in the id-map crate through 2021-02-26 for Rust. A double free can occur in IdMap::clone_from upon a .clone panic. |
CVE-2021-30454 | Critical | 9.8 | 2021-04-07 | An issue was discovered in the outer_cgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader. |
CVE-2021-29641 | High | 8.8 | 2021-04-07 | Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to upload a .php file t… |
CVE-2021-30246 | Critical | 9.1 | 2021-04-07 | In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known pr… |
CVE-2021-26758 | High | 8.8 | 2021-04-07 | Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the… |
CVE-2021-30123 | High | 8.8 | 2021-04-07 | FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code execution. |