2021 CVEs (page 20)
Page 20 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-28510 | Medium | 5.3 | 2023-01-26 | For certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PT… |
CVE-2021-43449 | High | 8.1 | 2023-01-23 | ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor service can be abused to read and serve arbit… |
CVE-2021-43448 | Medium | 5.3 | 2023-01-23 | ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spoof the names of use… |
CVE-2021-43447 | High | 7.5 | 2023-01-23 | ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit docu… |
CVE-2021-43446 | Medium | 6.1 | 2023-01-23 | ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the document editor allows malicious cross site s… |
CVE-2021-43445 | Critical | 9.8 | 2023-01-23 | ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE do… |
CVE-2021-43444 | High | 7.5 | 2023-01-23 | ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing… |
CVE-2021-24881 | High | 7.5 | 2023-01-23 | The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed is public, allowing unauthenticated us… |
CVE-2021-24837 | Medium | 5.4 | 2023-01-23 | The Passster WordPress plugin before 3.5.5.8 does not escape the area parameter of its shortcode, which could allow users with a role as low as Contributor to… |
CVE-2021-33642 | Medium | 5.5 | 2023-01-20 | When a file is processed, an infinite loop occurs in next_inline() of the more_curly() function. |
CVE-2021-33641 | High | 7.8 | 2023-01-20 | When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses the released memory (use after free). |
CVE-2021-39089 | Medium | 4.3 | 2023-01-20 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow an authenticated user to obtain sensitive information from a specially crafted HTTP req… |
CVE-2021-39011 | Medium | 4.2 | 2023-01-20 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 stores potentially sensitive information in log files that could be read by a privileged user. IBM… |
CVE-2021-29368 | High | 8.8 | 2023-01-20 | Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitra… |
CVE-2021-26644 | High | 8.8 | 2023-01-20 | SQL-Injection vulnerability caused by the lack of verification of input values for the table name of DB used by the Mangboard bulletin board. A remote attacker… |
CVE-2021-26642 | High | 8.8 | 2023-01-20 | When uploading an image file to a bulletin board developed with XpressEngine, a vulnerability in which an arbitrary file can be uploaded due to insufficient ve… |
CVE-2021-37500 | High | 8.1 | 2023-01-20 | Directory traversal vulnerability in Reprise License Manager (RLM) web interface before 14.2BL4 in the diagnostics function that allows RLM users with sufficie… |
CVE-2021-37499 | Medium | 6.5 | 2023-01-20 | CRLF vulnerability in Reprise License Manager (RLM) web interface through 14.2BL4 in the password parameter in View License Result function, that allows remote… |
CVE-2021-37498 | Medium | 6.5 | 2023-01-20 | An SSRF issue was discovered in Reprise License Manager (RLM) web interface through 14.2BL4 that allows remote attackers to trigger outbound requests to intran… |
CVE-2021-27782 | Medium | 5.4 | 2023-01-20 | HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts. |
CVE-2021-37774 | High | 8.0 | 2023-01-19 | An issue was discovered in function httpProcDataSrv in TL-WDR7660 2.0.30 that allows attackers to execute arbitrary code. |
CVE-2021-4314 | Medium | 5.3 | 2023-01-18 | It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only… |
CVE-2021-33959 | High | 7.5 | 2023-01-18 | Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service. |
CVE-2021-36630 | High | 7.5 | 2023-01-18 | DDOS reflection amplification vulnerability in eAut module of Ruckus Wireless SmartZone controller that allows remote attackers to perform DOS attacks via craf… |
CVE-2021-32837 | High | 7.5 | 2023-01-17 | mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of serv… |
CVE-2021-36647 | Medium | 4.7 | 2023-01-17 | Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2… |
CVE-2021-4313 | Medium | 5.5 | 2023-01-16 | A vulnerability was found in NethServer phonenehome. It has been rated as critical. This issue affects the function get_info/get_country_coor of the file serve… |
CVE-2021-36204 | High | 7.8 | 2023-01-13 | Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versi… |
CVE-2021-4312 | Low | 3.5 | 2023-01-13 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in Th3-822 Rapidleech. This affects the function zip_go of the file cl… |
CVE-2021-46872 | Medium | 6.1 | 2023-01-13 | An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI sch… |
CVE-2021-46795 | Medium | 4.7 | 2023-01-11 | A TOCTOU (time-of-check to time-of-use) vulnerability exists where an attacker may use a compromised BIOS to cause the TEE OS to read memory out of bounds that… |
CVE-2021-46791 | Medium | 5.5 | 2023-01-11 | Insufficient input validation during parsing of the System Management Mode (SMM) binary may allow a maliciously crafted SMM executable binary to corrupt Dynami… |
CVE-2021-46779 | High | 7.1 | 2023-01-11 | Insufficient input validation in SVC_ECC_PRIMITIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (AMD Secure Proces… |
CVE-2021-46768 | Medium | 5.5 | 2023-01-11 | Insufficient input validation in SEV firmware may allow an attacker to perform out-of-bounds memory reads within the ASP boot loader, potentially leading to a… |
CVE-2021-46767 | Medium | 6.1 | 2023-01-11 | Insufficient input validation in the ASP may allow an attacker with physical access, unauthorized write access to memory potentially leading to a loss of integ… |
CVE-2021-26409 | High | 7.8 | 2023-01-11 | Insufficient bounds checking in SEV-ES may allow an attacker to corrupt Reverse Map table (RMP) memory, potentially resulting in a loss of SNP (Secure Nested P… |
CVE-2021-26407 | Medium | 5.5 | 2023-01-11 | A randomly generated Initialization Vector (IV) may lead to a collision of IVs with the same key potentially resulting in information disclosure. |
CVE-2021-26404 | Medium | 5.5 | 2023-01-11 | Improper input validation and bounds checking in SEV firmware may leak scratch buffer bytes leading to potential information disclosure. |
CVE-2021-26403 | Medium | 6.5 | 2023-01-11 | Insufficient checks in SEV may lead to a malicious hypervisor disclosing the launch secret potentially resulting in compromise of VM confidentiality. |
CVE-2021-26402 | High | 7.1 | 2023-01-11 | Insufficient bounds checking in ASP (AMD Secure Processor) firmware while handling BIOS mailbox commands, may allow an attacker to write partially-controlled d… |
CVE-2021-26398 | High | 7.8 | 2023-01-11 | Insufficient input validation in SYS_KEY_DERIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (AMD Secure Processor… |
CVE-2021-26396 | Medium | 4.4 | 2023-01-11 | Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity in the SNP guest. |
CVE-2021-26355 | Medium | 5.5 | 2023-01-11 | Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in a potential denial-… |
CVE-2021-26346 | Medium | 5.5 | 2023-01-11 | Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory tab… |
CVE-2021-26343 | Medium | 5.5 | 2023-01-11 | Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result… |
CVE-2021-26328 | Medium | 4.4 | 2023-01-11 | Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests. |
CVE-2021-26316 | High | 7.8 | 2023-01-11 | Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (… |
CVE-2021-3966 | Critical | 9.6 | 2023-01-11 | usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem. |
CVE-2021-46871 | Medium | 6.1 | 2023-01-10 | tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes. |
CVE-2021-36603 | Medium | 6.1 | 2023-01-09 | Cross Site Scripting (XSS) in Tasmota firmware 6.5.0 allows remote attackers to inject JavaScript code via a crafted string in the field "Friendly Name 1". |
CVE-2021-4311 | Medium | 5.5 | 2023-01-09 | A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component XML Handler. The ma… |
CVE-2021-4310 | Low | 3.5 | 2023-01-09 | A vulnerability was found in 01-Scripts 01-Artikelsystem. It has been classified as problematic. Affected is an unknown function of the file 01article.php. The… |
CVE-2021-4309 | Low | 3.5 | 2023-01-08 | A vulnerability, which was classified as problematic, has been found in 01-Scripts 01ACP. This issue affects some unknown processing. The manipulation of the a… |
CVE-2021-4308 | Medium | 5.5 | 2023-01-08 | A vulnerability was found in WebPA up to 3.1.1. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql inject… |
CVE-2021-4301 | Medium | 6.3 | 2023-01-07 | A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical. Affected by this issue is some unknown functionality. The manipulation o… |
CVE-2021-4307 | Medium | 6.3 | 2023-01-07 | A vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. Th… |
CVE-2021-4306 | Low | 3.5 | 2023-01-07 | A vulnerability classified as problematic has been found in cronvel terminal-kit up to 2.1.7. Affected is an unknown function. The manipulation leads to ineffi… |
CVE-2021-46868 | High | 7.5 | 2023-01-06 | The HW_KEYMASTER module has a problem in releasing memory.Successful exploitation of this vulnerability may result in out-of-bounds memory access. |
CVE-2021-46867 | High | 7.5 | 2023-01-06 | The HW_KEYMASTER module has a problem in releasing memory.Successful exploitation of this vulnerability may result in out-of-bounds memory access. |
CVE-2021-32828 | Medium | 5.4 | 2023-01-05 | The Nuxeo Platform is an open source content management platform for building business applications. In version 11.5.109, the `oauth2` REST API is vulnerable t… |
CVE-2021-40342 | High | 7.1 | 2023-01-05 | In the DES implementation, the affected product versions use a default key for encryption. Successful exploitation allows an attacker to obtain sensitive info… |
CVE-2021-40341 | High | 7.1 | 2023-01-05 | DES cipher, which has inadequate encryption strength, is used Hitachi Energy FOXMAN-UN to encrypt user credentials used to access the Network Elements. Success… |
CVE-2021-4305 | Low | 3.5 | 2023-01-05 | A vulnerability was found in Woorank robots-txt-guard. It has been rated as problematic. Affected by this issue is the function makePathPattern of the file lib… |
CVE-2021-4304 | Medium | 6.3 | 2023-01-05 | A vulnerability was found in eprintsug ulcc-core. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file cgi/… |
CVE-2021-4303 | Low | 2.0 | 2023-01-05 | A vulnerability, which was classified as problematic, has been found in shannah Xataface up to 2.x. Affected by this issue is the function testftp of the file… |
CVE-2021-4302 | Low | 3.5 | 2023-01-04 | A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handl… |
CVE-2021-4300 | Medium | 6.3 | 2023-01-04 | A vulnerability has been found in ghostlander Halcyon and classified as critical. Affected by this vulnerability is the function CBlock::AddToBlockIndex of the… |
CVE-2021-38928 | Medium | 5.4 | 2023-01-04 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privi… |
CVE-2021-32824 | Critical | 9.8 | 2023-01-03 | Apache Dubbo is a java based, open source RPC framework. Versions prior to 2.6.10 and 2.7.10 are vulnerable to pre-auth remote code execution via arbitrary bea… |
CVE-2021-32821 | Medium | 6.2 | 2023-01-03 | MooTools is a collection of JavaScript utilities for JavaScript developers. All known versions include a CSS selector parser that is vulnerable to Regular Expr… |
CVE-2021-30558 | High | 8.8 | 2023-01-02 | Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy v… |
CVE-2021-21200 | Medium | 5.4 | 2023-01-02 | Out of bounds read in WebUI Settings in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTM… |
CVE-2021-4299 | Medium | 4.3 | 2023-01-02 | A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7. This vulnerability affects the function naturalSort of the file lib/nat… |
CVE-2021-4298 | Medium | 5.5 | 2023-01-02 | A vulnerability classified as critical has been found in Hesburgh Libraries of Notre Dame Sipity. This affects the function SearchCriteriaForWorksParameter of… |
CVE-2021-4297 | Medium | 5.5 | 2023-01-01 | A vulnerability has been found in trampgeek jobe up to 1.6.4 and classified as problematic. This vulnerability affects the function runs_post of the file appli… |
CVE-2021-41823 | Medium | 6.1 | 2023-01-01 | The Web Application Firewall (WAF) in Kemp LoadMaster 7.2.54.1 allows certain uses of onmouseover to bypass an XSS protection mechanism. |
CVE-2021-4296 | Low | 3.5 | 2022-12-29 | A vulnerability, which was classified as problematic, has been found in w3c Unicorn. This issue affects the function ValidatorNuMessage of the file src/org/w3c… |
CVE-2021-4295 | Medium | 5.5 | 2022-12-29 | A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabularyValidationConfigu… |
CVE-2021-4294 | Low | 2.6 | 2022-12-28 | A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipu… |
CVE-2021-4293 | Low | 3.5 | 2022-12-28 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in gnuboard youngcart5 up to 5.4.5.1. Affected is an unknown function… |
CVE-2021-4292 | Low | 3.5 | 2022-12-27 | A vulnerability was found in OpenMRS Admin UI Module up to 1.4.x. It has been rated as problematic. This issue affects some unknown processing of the file omod… |
CVE-2021-4291 | Low | 3.5 | 2022-12-27 | A vulnerability was found in OpenMRS Admin UI Module up to 1.5.x. It has been declared as problematic. This vulnerability affects unknown code of the file omod… |
CVE-2021-4290 | Medium | 5.5 | 2022-12-27 | A vulnerability was found in DHBW Fallstudie. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file app/conf… |
CVE-2021-4239 | High | 7.5 | 2022-12-27 | The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of service attack. After… |
CVE-2021-4238 | Critical | 9.1 | 2022-12-27 | Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always… |
CVE-2021-4236 | Critical | 9.8 | 2022-12-27 | Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to… |
CVE-2021-4235 | Medium | 5.5 | 2022-12-27 | Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may b… |
CVE-2021-4289 | Low | 3.5 | 2022-12-27 | A vulnerability classified as problematic was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. Affected by this vulnerability is the function… |
CVE-2021-4288 | Low | 3.5 | 2022-12-27 | A vulnerability was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. It has been rated as problematic. This issue affects some unknown proces… |
CVE-2021-4287 | Medium | 5.0 | 2022-12-27 | A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unknown function of the file src/binwalk/mod… |
CVE-2021-4286 | Low | 2.6 | 2022-12-27 | A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16. This issue affects the function calculate_x of the file srp… |
CVE-2021-4285 | Low | 3.5 | 2022-12-27 | A vulnerability classified as problematic was found in Nagios NCPA. This vulnerability affects unknown code of the file agent/listener/templates/tail.html. The… |
CVE-2021-4284 | Low | 3.5 | 2022-12-27 | A vulnerability classified as problematic has been found in OpenMRS HTML Form Entry UI Framework Integration Module up to 1.x. This affects an unknown part. Th… |
CVE-2021-4283 | Low | 2.4 | 2022-12-27 | A vulnerability was found in FreeBPX voicemail. It has been rated as problematic. Affected by this issue is some unknown functionality of the file views/ssetti… |
CVE-2021-4282 | Low | 3.5 | 2022-12-27 | A vulnerability was found in FreePBX voicemail. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file pag… |
CVE-2021-4281 | Medium | 4.6 | 2022-12-26 | A vulnerability was found in Brave UX for-the-badge and classified as critical. Affected by this issue is some unknown functionality of the file .github/workfl… |
CVE-2021-24942 | High | 7.2 | 2022-12-26 | The Menu Item Visibility Control WordPress plugin through 0.5 doesn't sanitize and validate the "Visibility logic" option for WordPress menu items, which could… |
CVE-2021-35065 | High | 7.5 | 2022-12-26 | The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression. |
CVE-2021-30134 | Medium | 6.1 | 2022-12-26 | php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimen… |
CVE-2021-44856 | Medium | 5.3 | 2022-12-26 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A title blocked by AbuseFilter can be created via Special:C… |