2021 CVEs (page 196)
Page 196 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-28166 | Medium | 6.5 | 2021-04-07 | In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker, a NULL po… |
CVE-2021-21425 | Critical | 9.3 | 2021-04-07 | Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticat… |
CVE-2021-29627 | High | 7.8 | 2021-04-07 | In FreeBSD 13.0-STABLE before n245050, 12.2-STABLE before r369525, 13.0-RC4 before p0, and 12.2-RELEASE before p6, listening socket accept filters implementing… |
CVE-2021-29626 | Medium | 5.5 | 2021-04-07 | In FreeBSD 13.0-STABLE before n245117, 12.2-STABLE before r369551, 11.4-STABLE before r369559, 13.0-RC5 before p1, 12.2-RELEASE before p6, and 11.4-RELEASE bef… |
CVE-2021-28927 | High | 7.8 | 2021-04-07 | The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platform_win32.c via the accessibility_speak_w… |
CVE-2021-30185 | High | 7.5 | 2021-04-07 | CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link. |
CVE-2021-21641 | Medium | 4.3 | 2021-04-07 | A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows attackers to to promote builds. |
CVE-2021-21640 | Medium | 4.3 | 2021-04-07 | Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create p… |
CVE-2021-21639 | Medium | 4.3 | 2021-04-07 | Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API e… |
CVE-2021-30184 | High | 7.8 | 2021-04-07 | GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN (Portable Game Notation) data. This is related to a buffer overflow in the use of a… |
CVE-2021-30177 | Critical | 9.8 | 2021-04-07 | There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution. This occurs because the U.S. state… |
CVE-2021-26709 | Critical | 9.8 | 2021-04-07 | D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthenticated remote attackers to take over a device… |
CVE-2021-20692 | High | 7.1 | 2021-04-07 | Directory traversal vulnerability in Archive collectively operation utility Ver.2.10.1.0 and earlier allows an attacker to create or overwrite files by leading… |
CVE-2021-20691 | Medium | 6.1 | 2021-04-07 | Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors. |
CVE-2021-20690 | Medium | 6.1 | 2021-04-07 | Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors. |
CVE-2021-20689 | Medium | 6.1 | 2021-04-07 | Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors. |
CVE-2021-20688 | Medium | 6.1 | 2021-04-07 | Cross-site scripting vulnerability in Click Ranker Ver.3.5 allows remote attackers to inject an arbitrary script via unspecified vectors. |
CVE-2021-20687 | High | 8.8 | 2021-04-07 | Cross-site request forgery (CSRF) vulnerability in Kagemai 0.8.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors. |
CVE-2021-20686 | Medium | 6.1 | 2021-04-07 | Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors. |
CVE-2021-20685 | Medium | 6.1 | 2021-04-07 | Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors. |
CVE-2021-20684 | Medium | 6.1 | 2021-04-07 | Cross-site scripting vulnerability in MagazinegerZ v.1.01 allows remote attackers to inject an arbitrary script via unspecified vectors. |
CVE-2021-1892 | High | 8.4 | 2021-04-07 | Memory corruption due to improper input validation while processing IO control which is nonstandard in Snapdragon Compute, Snapdragon Connectivity, Snapdragon… |
CVE-2021-30147 | High | 8.8 | 2021-04-07 | DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts such as adding new manager accounts via admin.php. |
CVE-2021-30178 | Medium | 5.5 | 2021-04-07 | An issue was discovered in the Linux kernel through 5.11.11. synic_get in arch/x86/kvm/hyperv.c has a NULL pointer dereference for certain accesses to the SynI… |
CVE-2021-27900 | High | 8.1 | 2021-04-06 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is missing an authorization check on several pages in the Web Console. This enables… |
CVE-2021-27899 | High | 7.4 | 2021-04-06 | The Proofpoint Insider Threat Management Agents (formerly ObserveIT Agent) for MacOS and Linux perform improper validation of the ITM Server's certificate, whi… |
CVE-2021-22158 | High | 7.2 | 2021-04-06 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is vulnerable to XML external entity (XXE) injection in the Web Console. The vulner… |
CVE-2021-22157 | Medium | 6.1 | 2021-04-06 | Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.11.1 allows stored XSS. |
CVE-2021-25692 | Medium | 4.6 | 2021-04-06 | Sensitive smart card data is logged in default INFO logs by Teradici's PCoIP Connection Manager and Security Gateway prior to version 21.01.3. |
CVE-2021-21404 | High | 7.5 | 2021-04-06 | Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server `strelaysrv` can be caused to crash and exit by se… |
CVE-2021-28688 | Medium | 6.5 | 2021-04-06 | The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This initialization went… |
CVE-2021-21423 | Medium | 6.8 | 2021-04-06 | `projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GitHub Workflows, `es… |
CVE-2021-24027 | High | 7.5 | 2021-04-06 | A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to… |
CVE-2021-24026 | Critical | 9.8 | 2021-04-06 | A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for Android prior to v… |
CVE-2021-20334 | Medium | 4.8 | 2021-04-06 | A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the use… |
CVE-2021-30146 | Medium | 5.4 | 2021-04-06 | Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality." |
CVE-2021-30140 | Medium | 5.4 | 2021-04-06 | LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has no extension and co… |
CVE-2021-29424 | High | 7.5 | 2021-04-06 | The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some s… |
CVE-2021-29136 | Medium | 5.5 | 2021-04-06 | Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci u… |
CVE-2021-26833 | Medium | 5.9 | 2021-04-06 | Cleartext Storage in a File or on Disk in TimelyBills <= 1.7.0 for iOS and versions <= 1.21.115 for Android allows attacker who can locally read user's files o… |
CVE-2021-30130 | High | 7.5 | 2021-04-06 | phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification. |
CVE-2021-28658 | Medium | 5.3 | 2021-04-06 | In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file… |
CVE-2021-28142 | High | 8.8 | 2021-04-06 | CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete." |
CVE-2021-30046 | Medium | 6.5 | 2021-04-06 | VIGRA Computer Vision Library Version-1-11-1 contains a segmentation fault vulnerability in the impex.hxx read_image_band() function, in which a crafted file c… |
CVE-2021-30045 | Critical | 9.1 | 2021-04-06 | SerenityOS 2021-03-27 contains a buffer overflow vulnerability in the EndOfCentralDirectory::read() function. |
CVE-2021-28874 | High | 7.8 | 2021-04-06 | SerenityOS fixed as of c9f25bca048443e317f1994ba9b106f2386688c3 contains a buffer overflow vulnerability in LibTextCode through opening a crafted file. |
CVE-2021-28075 | High | 7.5 | 2021-04-06 | iKuaiOS 3.4.8 Build 202012291059 has an arbitrary file download vulnerability, which can be exploited by attackers to obtain sensitive information. |
CVE-2021-27698 | Critical | 9.8 | 2021-04-06 | RIOT-OS 2021.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl/gnrc_rpl_control_messages.c through the _parse_options() function. |
CVE-2021-27697 | Critical | 9.8 | 2021-04-06 | RIOT-OS 2021.01 contains a buffer overflow vulnerability in sys/net/gnrc/routing/rpl/gnrc_rpl_validation.c through the gnrc_rpl_validation_options() function. |
CVE-2021-27357 | Critical | 9.8 | 2021-04-06 | RIOT-OS 2020.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl/gnrc_rpl_control_messages.c. |
CVE-2021-27343 | High | 7.5 | 2021-04-06 | SerenityOS Unspecified is affected by: Buffer Overflow. The impact is: obtain sensitive information (context-dependent). The component is: /Userland/Libraries/… |
CVE-2021-28173 | Critical | 9.8 | 2021-04-06 | The file upload function of Vangene deltaFlow E-platform does not perform access controlled properly. Remote attackers can upload and execute arbitrary files w… |
CVE-2021-28172 | High | 7.5 | 2021-04-06 | There is a Path Traversal vulnerability in the file download function of Vangene deltaFlow E-platform. Remote attackers can access credential data with this le… |
CVE-2021-28171 | Critical | 9.8 | 2021-04-06 | The Vangene deltaFlow E-platform does not take properly protective measures. Attackers can obtain privileged permissions remotely by tampering with users’ data… |
CVE-2021-30164 | Critical | 9.8 | 2021-04-06 | Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues API. |
CVE-2021-30163 | High | 7.5 | 2021-04-06 | Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to proj… |
CVE-2021-30162 | High | 7.1 | 2021-04-06 | An issue was discovered on LG mobile devices with Android OS 4.4 through 11 software. Attackers can leverage ISMS services to bypass access control on specific… |
CVE-2021-30161 | Medium | 5.5 | 2021-04-06 | An issue was discovered on LG mobile devices with Android OS 11 software. Attackers can bypass the lockscreen protection mechanism after an incoming call has b… |
CVE-2021-30158 | Medium | 5.3 | 2021-04-06 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Blocked users are unable to use Special:ResetTokens. This has secu… |
CVE-2021-30157 | Medium | 6.1 | 2021-04-06 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Spe… |
CVE-2021-30154 | Medium | 6.1 | 2021-04-06 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are… |
CVE-2021-30151 | Medium | 6.1 | 2021-04-06 | Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used. |
CVE-2021-30150 | Medium | 6.1 | 2021-04-06 | Composr 10.0.36 allows XSS in an XML script. |
CVE-2021-30149 | Critical | 9.8 | 2021-04-06 | Composr 10.0.36 allows upload and execution of PHP files. |
CVE-2021-30144 | Medium | 4.3 | 2021-04-06 | The Dashboard plugin through 1.0.2 for GLPI allows remote low-privileged users to bypass access control on viewing information about the last ten events, the c… |
CVE-2021-28209 | Medium | 4.9 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Delete video file function) does not filter the specific parameter. As obtaining the administ… |
CVE-2021-28208 | Medium | 4.9 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Get video file function) does not filter the specific parameter. As obtaining the administrat… |
CVE-2021-28207 | Medium | 4.9 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Get Help file function) does not filter the specific parameter. As obtaining the administrato… |
CVE-2021-28206 | Medium | 4.9 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Record video file function) does not filter the specific parameter. As obtaining the administ… |
CVE-2021-28205 | Medium | 4.9 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Delete SOL video file function) does not filter the specific parameter. As obtaining the admi… |
CVE-2021-28204 | High | 7.2 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not filter the specific parameter. As obtaining the… |
CVE-2021-28203 | High | 7.2 | 2021-04-06 | The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission… |
CVE-2021-28202 | Medium | 4.9 | 2021-04-06 | The Service configuration-2 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overf… |
CVE-2021-28201 | Medium | 4.9 | 2021-04-06 | The Service configuration-1 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overf… |
CVE-2021-28200 | Medium | 4.9 | 2021-04-06 | The CD media configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overfl… |
CVE-2021-28199 | Medium | 4.9 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length entered by users, resul… |
CVE-2021-28198 | Medium | 4.9 | 2021-04-06 | The Firmware protocol configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buff… |
CVE-2021-28197 | Medium | 4.9 | 2021-04-06 | The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffe… |
CVE-2021-28196 | Medium | 4.9 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Generate SSL certificate function) does not verify the string length entered by users, result… |
CVE-2021-28195 | Medium | 4.9 | 2021-04-06 | The Radius configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow… |
CVE-2021-28194 | Medium | 4.9 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Remote image configuration setting) does not verify the string length entered by users, resul… |
CVE-2021-28193 | Medium | 4.9 | 2021-04-06 | The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow v… |
CVE-2021-28192 | Medium | 4.9 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Remote video storage function) does not verify the string length entered by users, resulting… |
CVE-2021-28191 | Medium | 4.9 | 2021-04-06 | The Firmware update function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vuln… |
CVE-2021-28190 | Medium | 4.9 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Generate new certificate function) does not verify the string length entered by users, result… |
CVE-2021-28189 | Medium | 4.9 | 2021-04-06 | The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow v… |
CVE-2021-28188 | Medium | 4.9 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length entered by users, resul… |
CVE-2021-28187 | Medium | 4.9 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Generate new SSL certificate) does not verify the string length entered by users, resulting i… |
CVE-2021-28186 | Medium | 4.9 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-2 acquisition) does not verify the string length entered by users, resu… |
CVE-2021-28185 | Medium | 4.9 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-1 acquisition) does not verify the string length entered by users, resu… |
CVE-2021-28184 | Medium | 4.9 | 2021-04-06 | The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffe… |
CVE-2021-28183 | Medium | 4.9 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Web License configuration setting) does not verify the string length entered by users, result… |
CVE-2021-28182 | Medium | 4.9 | 2021-04-06 | The Web Service configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer ove… |
CVE-2021-28181 | Medium | 4.9 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Remote video configuration setting) does not verify the string length entered by users, resul… |
CVE-2021-28180 | Medium | 4.9 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Audit log configuration setting) does not verify the string length entered by users, resultin… |
CVE-2021-28179 | Medium | 4.9 | 2021-04-06 | The specific function in ASUS BMC’s firmware Web management page (Media support configuration setting) does not verify the string length entered by users, resu… |
CVE-2021-28178 | Medium | 4.9 | 2021-04-06 | The UEFI configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow v… |
CVE-2021-28177 | Medium | 4.9 | 2021-04-06 | The LDAP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow v… |
CVE-2021-28176 | Medium | 4.9 | 2021-04-06 | The DNS configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vu… |
CVE-2021-28175 | Medium | 4.9 | 2021-04-06 | The Radius configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow… |