2021 CVEs (page 199)
Page 199 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-29083 | High | 7.2 | 2021-04-01 | Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows… |
CVE-2021-29942 | High | 7.3 | 2021-04-01 | An issue was discovered in the reorder crate through 2021-02-24 for Rust. swap_index can return uninitialized values if an iterator returns a len() that is too… |
CVE-2021-29941 | High | 7.3 | 2021-04-01 | An issue was discovered in the reorder crate through 2021-02-24 for Rust. swap_index has an out-of-bounds write if an iterator returns a len() that is too smal… |
CVE-2021-29940 | Critical | 9.8 | 2021-04-01 | An issue was discovered in the through crate through 2021-02-18 for Rust. There is a double free (in through and through_and) upon a panic of the map function. |
CVE-2021-29939 | High | 7.3 | 2021-04-01 | An issue was discovered in the stackvector crate through 2021-02-19 for Rust. There is an out-of-bounds write in StackVec::extend if size_hint provides certain… |
CVE-2021-29938 | High | 7.5 | 2021-04-01 | An issue was discovered in the slice-deque crate through 2021-02-19 for Rust. A double drop can occur in SliceDeque::drain_filter upon a panic in a predicate f… |
CVE-2021-29937 | Critical | 9.8 | 2021-04-01 | An issue was discovered in the telemetry crate through 2021-02-17 for Rust. There is a drop of uninitialized memory if a value.clone() call panics within misc… |
CVE-2021-29936 | Critical | 9.8 | 2021-04-01 | An issue was discovered in the adtensor crate through 2021-01-11 for Rust. There is a drop of uninitialized memory via the FromIterator implementation for Vect… |
CVE-2021-29935 | High | 7.3 | 2021-04-01 | An issue was discovered in the rocket crate before 0.4.7 for Rust. uri::Formatter can have a use-after-free if a user-provided function panics. |
CVE-2021-29934 | High | 7.3 | 2021-04-01 | An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust. Attackers can read the contents of uninitialized memory locations via a user… |
CVE-2021-29933 | High | 7.5 | 2021-04-01 | An issue was discovered in the insert_many crate through 2021-01-26 for Rust. Elements may be dropped twice if a .next() method panics. |
CVE-2021-29932 | High | 7.5 | 2021-04-01 | An issue was discovered in the parse_duration crate through 2021-03-18 for Rust. It allows attackers to cause a denial of service (CPU and memory consumption)… |
CVE-2021-29931 | High | 7.5 | 2021-04-01 | An issue was discovered in the arenavec crate through 2021-01-12 for Rust. A double drop can sometimes occur upon a panic in T::drop(). |
CVE-2021-29930 | High | 7.5 | 2021-04-01 | An issue was discovered in the arenavec crate through 2021-01-12 for Rust. A drop of uninitialized memory can sometimes occur upon a panic in T::default(). |
CVE-2021-29929 | High | 7.5 | 2021-04-01 | An issue was discovered in the endian_trait crate through 2021-01-04 for Rust. A double drop can occur when a user-provided Endian impl panics. |
CVE-2021-29251 | Medium | 6.5 | 2021-04-01 | BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register (in Server Settings > Policies). This affects Docker use cases in which… |
CVE-2021-26071 | Low | 3.5 | 2021-04-01 | The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 bef… |
CVE-2021-29349 | Medium | 6.5 | 2021-03-31 | Mahara 20.10 is affected by Cross Site Request Forgery (CSRF) that allows a remote attacker to remove inbox-mail on the server. The application fails to valida… |
CVE-2021-28994 | High | 7.5 | 2021-03-31 | kopano-ical (formerly zarafa-ical) in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x t… |
CVE-2021-27349 | Medium | 6.1 | 2021-03-31 | Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727. |
CVE-2021-27220 | Medium | 5.3 | 2021-03-31 | An issue was discovered in PRTG Network Monitor before 21.1.66.1623. By invoking the screenshot functionality with prepared context paths, an attacker is able… |
CVE-2021-22538 | Medium | 6.3 | 2021-03-31 | A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server (versions prior to 0.23.1), allows an attacker who (1) has… |
CVE-2021-29663 | Medium | 4.8 | 2021-03-31 | CourseMS (aka Course Registration Management System) 2.1 is affected by cross-site scripting (XSS). When an attacker with access to an Admin account creates a… |
CVE-2021-26943 | High | 8.2 | 2021-03-31 | The UX360CA BIOS through 303 on ASUS laptops allow an attacker (with the ring 0 privilege) to overwrite nearly arbitrary physical memory locations, including S… |
CVE-2021-29662 | High | 7.5 | 2021-03-31 | The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in s… |
CVE-2021-23007 | Medium | 5.3 | 2021-03-31 | On BIG-IP versions 14.1.4 and 16.0.1.1, when the Traffic Management Microkernel (TMM) process handles certain undisclosed traffic, it may start dropping all fr… |
CVE-2021-23006 | Medium | 6.1 | 2021-03-31 | On all 7.x and 6.x versions (fixed in 8.0.0), undisclosed BIG-IQ pages have a reflected cross-site scripting vulnerability. Note: Software versions which have… |
CVE-2021-23005 | Critical | 9.1 | 2021-03-31 | On all 7.x and 6.x versions (fixed in 8.0.0), when using a Quorum device for BIG-IQ high availability (HA) for automatic failover, BIG-IQ does not make use of… |
CVE-2021-23004 | High | 7.5 | 2021-03-31 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6… |
CVE-2021-23003 | High | 7.5 | 2021-03-31 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6… |
CVE-2021-23002 | Medium | 4.5 | 2021-03-31 | When using BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, or all 12.1.x and 11.6.x versions or Edge C… |
CVE-2021-23001 | Medium | 4.3 | 2021-03-31 | On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, t… |
CVE-2021-23000 | High | 7.5 | 2021-03-31 | On BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, if the tmm.http.rfc.enforcement BigDB key is enabled in a BIG-IP system, or the Bad host header value is che… |
CVE-2021-22999 | High | 7.5 | 2021-03-31 | On versions 15.0.x before 15.1.0 and 14.1.x before 14.1.4, the BIG-IP system provides an option to connect HTTP/2 clients to HTTP/1.x servers. When a client is… |
CVE-2021-22998 | Medium | 5.3 | 2021-03-31 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6… |
CVE-2021-22997 | High | 7.5 | 2021-03-31 | On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport servic… |
CVE-2021-22996 | High | 7.5 | 2021-03-31 | On all 7.x versions (fixed in 8.0.0), when set up for auto failover, a BIG-IQ Data Collection Device (DCD) cluster member that receives an undisclosed message… |
CVE-2021-22994 | Medium | 6.1 | 2021-03-31 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6… |
CVE-2021-22993 | High | 8.8 | 2021-03-31 | On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and 12.1.x before… |
CVE-2021-22991 | Critical | 9.8 | 2021-03-31 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed reques… |
CVE-2021-21983 | Medium | 6.5 | 2021-03-31 | Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network acc… |
CVE-2021-21975 | High | 7.5 | 2021-03-31 | Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Op… |
CVE-2021-21418 | Medium | 4.6 | 2021-03-31 | ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that… |
CVE-2021-29658 | High | 8.8 | 2021-03-31 | The unofficial vscode-rufo extension before 0.0.4 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted workspace f… |
CVE-2021-22995 | High | 7.5 | 2021-03-31 | On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not implement any form of au… |
CVE-2021-22992 | Critical | 9.8 | 2021-03-31 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6… |
CVE-2021-22990 | High | 7.2 | 2021-03-31 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6… |
CVE-2021-22989 | Critical | 9.1 | 2021-03-31 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6… |
CVE-2021-22987 | Critical | 9.9 | 2021-03-31 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6… |
CVE-2021-23348 | Medium | 6.3 | 2021-03-31 | This affects the package portprocesses before 1.0.5. If (attacker-controlled) user input is given to the killProcess function, it is possible for an attacker t… |
CVE-2021-22988 | High | 8.8 | 2021-03-31 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6… |
CVE-2021-22986 | Critical | 9.8 | 2021-03-31 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x… |
CVE-2021-3479 | Medium | 5.5 | 2021-03-31 | There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenE… |
CVE-2021-3478 | Medium | 5.5 | 2021-03-31 | There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit a crafted file to be processed by OpenE… |
CVE-2021-3477 | Medium | 5.5 | 2021-03-31 | There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed… |
CVE-2021-3470 | Medium | 5.3 | 2021-03-31 | A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's ma… |
CVE-2021-28245 | High | 7.5 | 2021-03-31 | PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensitive information through adding an admin… |
CVE-2021-23988 | High | 8.8 | 2021-03-31 | Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence of memory corruption and we presume that with enough e… |
CVE-2021-23987 | High | 8.8 | 2021-03-31 | Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed evidence of memory c… |
CVE-2021-23986 | Medium | 6.5 | 2021-03-31 | A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The response to this c… |
CVE-2021-23985 | Medium | 6.5 | 2021-03-31 | If an attacker is able to alter specific about:config values (for example malware running on the user's computer), the Devtools remote debugging feature could… |
CVE-2021-23984 | Medium | 6.5 | 2021-03-31 | A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable… |
CVE-2021-23983 | Medium | 6.5 | 2021-03-31 | By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memory corruption and a… |
CVE-2021-23982 | Medium | 6.5 | 2021-03-31 | Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on… |
CVE-2021-23981 | High | 8.1 | 2021-03-31 | A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a… |
CVE-2021-21782 | High | 8.8 | 2021-03-31 | An out-of-bounds write vulnerability exists in the SGI format buffer size processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed fi… |
CVE-2021-21776 | High | 8.8 | 2021-03-31 | An out-of-bounds write vulnerability exists in the SGI Format Buffer Size Processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed fi… |
CVE-2021-21773 | High | 7.8 | 2021-03-31 | An out-of-bounds write vulnerability exists in the TIFF header count-processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file ca… |
CVE-2021-28657 | Medium | 5.5 | 2021-03-31 | A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or… |
CVE-2021-21413 | High | 8.0 | 2021-03-30 | isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfalls which may make it… |
CVE-2021-29650 | Medium | 5.5 | 2021-03-30 | An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to cause a denial of service (panic) because net/netfilter… |
CVE-2021-29649 | Medium | 5.5 | 2021-03-30 | An issue was discovered in the Linux kernel before 5.11.11. The user mode driver (UMD) has a copy_process() memory leak, related to a lack of cleanup steps in… |
CVE-2021-29648 | Medium | 5.5 | 2021-03-30 | An issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly consider that resolved_ids and resolved_sizes are intentionally… |
CVE-2021-29647 | Medium | 5.5 | 2021-03-30 | An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows attackers to obtain sensitive information from kernel memory… |
CVE-2021-29646 | Medium | 5.5 | 2021-03-30 | An issue was discovered in the Linux kernel before 5.11.11. tipc_nl_retrieve_key in net/tipc/node.c does not properly validate certain data sizes, aka CID-0217… |
CVE-2021-29642 | Medium | 5.3 | 2021-03-30 | GistPad before 0.2.7 allows a crafted workspace folder to change the URL for the Gist API, which leads to leakage of GitHub access tokens. |
CVE-2021-3476 | Medium | 5.3 | 2021-03-30 | A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to OpenEXR could… |
CVE-2021-3475 | Medium | 5.3 | 2021-03-30 | There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be processed by OpenEXR could cause an integer overflow… |
CVE-2021-3474 | Medium | 5.3 | 2021-03-30 | There's a flaw in OpenEXR in versions before 3.0.0-beta. A crafted input file that is processed by OpenEXR could cause a shift overflow in the FastHufDecoder… |
CVE-2021-26579 | Medium | 5.5 | 2021-03-30 | A security vulnerability in HPE Unified Data Management (UDM) could allow the local disclosure of privileged information (CWE-321: Use of Hard-coded Cryptograp… |
CVE-2021-21412 | Medium | 6.4 | 2021-03-30 | Potential for arbitrary code execution in npm package @thi.ng/egf `#gpg`-tagged property values (only if `decrypt: true` option is enabled). PR with patch has… |
CVE-2021-20520 | Medium | 5.4 | 2021-03-30 | IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2021-20518 | Medium | 5.4 | 2021-03-30 | IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2021-20506 | Medium | 5.4 | 2021-03-30 | IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2021-20504 | Medium | 5.4 | 2021-03-30 | IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2021-20503 | Medium | 5.4 | 2021-03-30 | IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2021-20502 | High | 7.1 | 2021-03-30 | IBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vul… |
CVE-2021-20447 | Medium | 5.4 | 2021-03-30 | IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2021-20352 | Medium | 5.4 | 2021-03-30 | IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2021-21398 | Medium | 5.4 | 2021-03-30 | PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type Dat… |
CVE-2021-20482 | High | 7.1 | 2021-03-30 | IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacke… |
CVE-2021-27271 | High | 7.8 | 2021-03-30 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required t… |
CVE-2021-27270 | High | 7.8 | 2021-03-30 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required t… |
CVE-2021-27269 | High | 7.8 | 2021-03-30 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required t… |
CVE-2021-27268 | High | 7.8 | 2021-03-30 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required t… |
CVE-2021-27267 | High | 7.8 | 2021-03-30 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required t… |
CVE-2021-27266 | Low | 3.3 | 2021-03-30 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is re… |
CVE-2021-27265 | Low | 3.3 | 2021-03-30 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is re… |
CVE-2021-27264 | Low | 3.3 | 2021-03-30 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is re… |
CVE-2021-27263 | Low | 3.3 | 2021-03-30 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is re… |