2021 CVEs (page 198)
Page 198 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-1786 | Medium | 5.5 | 2021-04-02 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-… |
CVE-2021-1785 | High | 7.8 | 2021-04-02 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Upda… |
CVE-2021-1783 | High | 7.8 | 2021-04-02 | An access issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 20… |
CVE-2021-1782 | High | 7.0 | 2021-04-02 | A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mo… |
CVE-2021-1781 | Medium | 5.5 | 2021-04-02 | A privacy issue existed in the handling of Contact cards. This was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Securit… |
CVE-2021-1780 | Medium | 4.4 | 2021-04-02 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 14.4 and iPadOS 14.4. An attacker in a privileged positio… |
CVE-2021-1779 | High | 7.8 | 2021-04-02 | A logic error in kext loading was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Securit… |
CVE-2021-1778 | Medium | 5.5 | 2021-04-02 | An out-of-bounds read issue existed in the curl. This issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Up… |
CVE-2021-1777 | High | 7.8 | 2021-04-02 | This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, w… |
CVE-2021-1776 | High | 7.8 | 2021-04-02 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Securit… |
CVE-2021-1775 | High | 7.8 | 2021-04-02 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-00… |
CVE-2021-1774 | High | 7.8 | 2021-04-02 | This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, w… |
CVE-2021-1773 | Medium | 5.5 | 2021-04-02 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-… |
CVE-2021-1772 | High | 7.8 | 2021-04-02 | A stack overflow was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 20… |
CVE-2021-1771 | Low | 3.3 | 2021-04-02 | This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. A… |
CVE-2021-1769 | Medium | 5.5 | 2021-04-02 | A logic issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mo… |
CVE-2021-1768 | High | 7.8 | 2021-04-02 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Updat… |
CVE-2021-1767 | High | 7.8 | 2021-04-02 | This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, i… |
CVE-2021-1766 | Medium | 5.5 | 2021-04-02 | This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, w… |
CVE-2021-1765 | Medium | 6.5 | 2021-04-02 | This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Updat… |
CVE-2021-1764 | High | 7.5 | 2021-04-02 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Up… |
CVE-2021-1763 | High | 7.8 | 2021-04-02 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 20… |
CVE-2021-1760 | Medium | 5.5 | 2021-04-02 | A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security… |
CVE-2021-1759 | High | 7.8 | 2021-04-02 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Upda… |
CVE-2021-1758 | High | 7.8 | 2021-04-02 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Updat… |
CVE-2021-1757 | High | 7.8 | 2021-04-02 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Updat… |
CVE-2021-1756 | Low | 2.4 | 2021-04-02 | A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in iOS 14.4 and… |
CVE-2021-1755 | Low | 2.4 | 2021-04-02 | A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in macOS Big Su… |
CVE-2021-1754 | High | 7.8 | 2021-04-02 | This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, w… |
CVE-2021-1751 | High | 7.8 | 2021-04-02 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-… |
CVE-2021-1750 | High | 7.8 | 2021-04-02 | Multiple issues were addressed with improved logic. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Moja… |
CVE-2021-1748 | High | 8.8 | 2021-04-02 | A validation issue was addressed with improved input sanitization. This issue is fixed in tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4. Processing a malici… |
CVE-2021-1747 | High | 7.8 | 2021-04-02 | An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Upd… |
CVE-2021-1746 | High | 7.8 | 2021-04-02 | This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, w… |
CVE-2021-1745 | High | 7.8 | 2021-04-02 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Upda… |
CVE-2021-1744 | High | 7.8 | 2021-04-02 | An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Upd… |
CVE-2021-1743 | High | 7.8 | 2021-04-02 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Updat… |
CVE-2021-1742 | High | 7.8 | 2021-04-02 | This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, w… |
CVE-2021-1741 | High | 7.8 | 2021-04-02 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Updat… |
CVE-2021-1738 | High | 7.8 | 2021-04-02 | An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Upd… |
CVE-2021-1737 | High | 7.8 | 2021-04-02 | An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Upd… |
CVE-2021-1736 | High | 7.8 | 2021-04-02 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Upda… |
CVE-2021-22203 | High | 7.5 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 before 13.9.5, and all… |
CVE-2021-22202 | Low | 2.4 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in System hooks throug… |
CVE-2021-22201 | Critical | 9.6 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9. A specially crafted import file could read files on the server. |
CVE-2021-22200 | Medium | 5.9 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6. Under a special condition it was possible to access data of an internal… |
CVE-2021-22198 | Medium | 4.3 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions from 13.8 and above allowing an authenticated user to delete incident metric images of publ… |
CVE-2021-22197 | Low | 3.5 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific ri… |
CVE-2021-22196 | Medium | 6.3 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge reque… |
CVE-2021-28124 | Medium | 5.9 | 2021-04-02 | A man-in-the-middle vulnerability in Cohesity DataPlatform support channel in version 6.3 up to 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6.5.1b. Missing serv… |
CVE-2021-28123 | Critical | 9.8 | 2021-04-02 | Undocumented Default Cryptographic Key Vulnerability in Cohesity DataPlatform version 6.3 prior 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6.5.1b. The ssh key… |
CVE-2021-28113 | Medium | 6.7 | 2021-04-02 | A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to… |
CVE-2021-21400 | High | 7.1 | 2021-04-02 | wire-webapp is an open-source front end for Wire, a secure collaboration platform. In wire-webapp before version 2021-03-15-production.0, when being prompted t… |
CVE-2021-29652 | Medium | 6.1 | 2021-04-02 | Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process |
CVE-2021-29651 | Medium | 6.1 | 2021-04-02 | Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2). |
CVE-2021-29012 | Critical | 9.8 | 2021-04-02 | DMA Softlab Radius Manager 4.4.0 assigns the same session cookie to every admin session. The cookie is valid when the admin is logged in, but is invalid (tempo… |
CVE-2021-29011 | Medium | 6.1 | 2021-04-02 | DMA Softlab Radius Manager 4.4.0 is affected by Cross Site Scripting (XSS) via the description, name, or address field (under admin.php). |
CVE-2021-25894 | Medium | 6.1 | 2021-04-02 | Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the /magnoliaPublic/travel/members/login.html mgnlUserId paramet… |
CVE-2021-25893 | Medium | 5.4 | 2021-04-02 | Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the setText parameter of /magnoliaAuthor/.magnolia/. |
CVE-2021-22696 | High | 7.5 | 2021-04-02 | CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework… |
CVE-2021-30000 | Critical | 9.8 | 2021-04-02 | An issue was discovered in LATRIX 0.6.0. SQL injection in the txtaccesscode parameter of inandout.php leads to information disclosure and code execution. |
CVE-2021-30004 | Medium | 5.3 | 2021-04-02 | In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c. |
CVE-2021-30003 | Medium | 4.8 | 2021-04-02 | An issue was discovered on Nokia G-120W-F 3FE46606AGAB91 devices. There is Stored XSS in the administrative interface via urlfilter.cgi?add url_address. |
CVE-2021-30002 | Medium | 6.2 | 2021-04-02 | An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/v4l2-core/v4l2-ioctl.c has a memory leak… |
CVE-2021-23925 | Medium | 6.1 | 2021-04-01 | An issue was discovered in Devolutions Server before 2020.3. There is a cross-site scripting (XSS) vulnerability in entries of type Document. |
CVE-2021-23924 | High | 7.5 | 2021-04-01 | An issue was discovered in Devolutions Server before 2020.3. There is an exposure of sensitive information in diagnostic files. |
CVE-2021-23923 | High | 8.1 | 2021-04-01 | An issue was discovered in Devolutions Server before 2020.3. There is Broken Authentication with Windows domain users. |
CVE-2021-23922 | Medium | 5.4 | 2021-04-01 | An issue was discovered in Devolutions Remote Desktop Manager before 2020.2.12. There is a cross-site scripting (XSS) vulnerability in webviews. |
CVE-2021-23921 | Critical | 9.1 | 2021-04-01 | An issue was discovered in Devolutions Server before 2020.3. There is broken access control on Password List entry elements. |
CVE-2021-21421 | High | 8.1 | 2021-04-01 | node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key v… |
CVE-2021-21420 | High | 7.5 | 2021-04-01 | vscode-stripe is an extension for Visual Studio Code. A vulnerability in Stripe for Visual Studio Code extension exists when it loads an untrusted source-code… |
CVE-2021-21416 | Low | 3.7 | 2021-04-01 | django-registration is a user registration package for Django. The django-registration package provides tools for implementing user-account registration flows… |
CVE-2021-28047 | Medium | 5.4 | 2021-04-01 | Cross-Site Scripting (XSS) in Administrative Reports in Devolutions Remote Desktop Manager before 2021.1 allows remote authenticated users to inject arbitrary… |
CVE-2021-29421 | High | 7.5 | 2021-04-01 | models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries. |
CVE-2021-28970 | Medium | 6.5 | 2021-04-01 | eMPS 9.0.1.923211 on the Central Management of FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the job_id parame… |
CVE-2021-28969 | Medium | 6.5 | 2021-04-01 | eMPS 9.0.1.923211 on FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort_by parameter to the email search f… |
CVE-2021-27653 | Medium | 6.6 | 2021-04-01 | Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure. |
CVE-2021-26718 | Medium | 5.5 | 2021-04-01 | KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus protection. |
CVE-2021-26581 | Medium | 6.5 | 2021-04-01 | A potential security vulnerability has been identified in HPE Superdome Flex server. A denial of service attack can be remotely exploited leaving hung connecti… |
CVE-2021-26580 | Medium | 6.1 | 2021-04-01 | A potential security vulnerability has been identified in HPE iLO Amplifier Pack. The vulnerability could be remotely exploited to allow Cross-Site Scripting (… |
CVE-2021-26072 | Medium | 4.3 | 2021-04-01 | The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal… |
CVE-2021-21982 | Critical | 9.1 | 2021-04-01 | VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a malicious actor with network access to… |
CVE-2021-20078 | Critical | 9.1 | 2021-04-01 | Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component… |
CVE-2021-3447 | Medium | 5.5 | 2021-04-01 | A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as wel… |
CVE-2021-25924 | High | 8.8 | 2021-04-01 | In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup` endpoint. An atta… |
CVE-2021-22890 | Low | 3.7 | 2021-04-01 | curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tick… |
CVE-2021-22876 | Medium | 5.3 | 2021-04-01 | curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP R… |
CVE-2021-22195 | High | 8.6 | 2021-04-01 | Client side code execution in gitlab-vscode-extension v3.15.0 and earlier allows attacker to execute code on user system |
CVE-2021-20291 | Medium | 6.5 | 2021-04-01 | A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked us… |
CVE-2021-28165 | High | 7.5 | 2021-04-01 | In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame. |
CVE-2021-28164 | Medium | 5.3 | 2021-04-01 | In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access prot… |
CVE-2021-28163 | Low | 2.7 | 2021-04-01 | In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of th… |
CVE-2021-22177 | Medium | 4.3 | 2021-04-01 | Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via git… |
CVE-2021-3393 | Medium | 4.3 | 2021-04-01 | An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permissi… |
CVE-2021-28546 | Medium | 6.5 | 2021-04-01 | Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are missing support for an inte… |
CVE-2021-28545 | High | 8.1 | 2021-04-01 | Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are missing support for an inte… |
CVE-2021-20296 | Medium | 5.3 | 2021-04-01 | A flaw was found in OpenEXR in versions before 3.0.0-beta. A crafted input file supplied by an attacker, that is processed by the Dwa decompression functionali… |
CVE-2021-20235 | High | 8.1 | 2021-04-01 | There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp. The decoder static allocator could have its sized changed, but the… |
CVE-2021-20234 | Medium | 6.5 | 2021-04-01 | An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp. This issue causes a client tha… |
CVE-2021-28918 | Critical | 9.1 | 2021-04-01 | Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI… |