2021 CVEs (page 200)
Page 200 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-27262 | Low | 3.3 | 2021-03-30 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is re… |
CVE-2021-27261 | High | 7.8 | 2021-03-30 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required t… |
CVE-2021-23363 | Medium | 6.3 | 2021-03-30 | This affects the package kill-by-port before 0.0.2. If (attacker-controlled) user input is given to the killByPort function, it is possible for an attacker to… |
CVE-2021-21409 | Medium | 5.9 | 2021-03-30 | Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clie… |
CVE-2021-26810 | Critical | 9.8 | 2021-03-30 | D-link DIR-816 A2 v1.10 is affected by a remote code injection vulnerability. An HTTP request parameter can be used in command string construction in the handl… |
CVE-2021-29343 | Medium | 5.4 | 2021-03-30 | Ovidentia CMS 6.x contains a SQL injection vulnerability in the "id" parameter of index.php. The "checkbox" property into "text" data can be extracted and disp… |
CVE-2021-28935 | Medium | 5.4 | 2021-03-30 | CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field. |
CVE-2021-21638 | High | 8.8 | 2021-03-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-speci… |
CVE-2021-21637 | Medium | 6.5 | 2021-03-30 | A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to connect to an attacker… |
CVE-2021-21636 | Medium | 4.3 | 2021-03-30 | A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to enumerate credentials… |
CVE-2021-21635 | Medium | 5.4 | 2021-03-30 | Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a stored cross-site script… |
CVE-2021-21634 | Medium | 6.5 | 2021-03-30 | Jenkins Jabber (XMPP) notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller wher… |
CVE-2021-21633 | High | 8.8 | 2021-03-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specifi… |
CVE-2021-21632 | Medium | 6.5 | 2021-03-30 | A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-s… |
CVE-2021-21631 | Medium | 4.3 | 2021-03-30 | Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and k… |
CVE-2021-21630 | Medium | 5.4 | 2021-03-30 | Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting (XSS)… |
CVE-2021-21629 | High | 8.8 | 2021-03-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Build With Parameters Plugin 1.5 and earlier allows attackers to build a project with attacker-spe… |
CVE-2021-21628 | Medium | 5.4 | 2021-03-30 | Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnera… |
CVE-2021-26919 | High | 8.8 | 2021-03-30 | Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set… |
CVE-2021-29418 | Medium | 5.3 | 2021-03-30 | The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in some situa… |
CVE-2021-29376 | High | 7.5 | 2021-03-30 | ircII before 20210314 allows remote attackers to cause a denial of service (segmentation fault and client crash, disconnecting the victim from an IRC server) v… |
CVE-2021-25162 | High | 8.1 | 2021-03-30 | A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4… |
CVE-2021-25161 | Medium | 6.1 | 2021-03-30 | A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-… |
CVE-2021-25160 | Medium | 4.9 | 2021-03-30 | A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8… |
CVE-2021-25159 | Medium | 6.5 | 2021-03-30 | A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8… |
CVE-2021-25158 | Medium | 5.9 | 2021-03-30 | A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.18 and be… |
CVE-2021-25157 | Medium | 4.9 | 2021-03-30 | A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.1… |
CVE-2021-25156 | Medium | 4.9 | 2021-03-30 | A remote arbitrary directory create vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-… |
CVE-2021-25155 | Medium | 6.5 | 2021-03-30 | A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8… |
CVE-2021-25150 | High | 8.8 | 2021-03-30 | A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5… |
CVE-2021-25146 | High | 7.2 | 2021-03-30 | A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5… |
CVE-2021-25149 | Critical | 9.8 | 2021-03-30 | A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 an… |
CVE-2021-25148 | High | 8.1 | 2021-03-30 | A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.1… |
CVE-2021-25145 | Medium | 6.5 | 2021-03-30 | A remote unauthorized disclosure of information vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4… |
CVE-2021-28672 | Critical | 9.8 | 2021-03-29 | Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), WorkCentre 6515 before 65.65.51 and 65.59.11 (Bridge), VersaLink B400 before 37.65.51 and 37.59.01 (Br… |
CVE-2021-28671 | Critical | 9.8 | 2021-03-29 | Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), WorkCentre 6515 before 65.65.51 and 65.59.11 (Bridge), VersaLink B400 before 37.65.51 and 37.59.01 (Br… |
CVE-2021-27276 | High | 7.1 | 2021-03-29 | This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although… |
CVE-2021-27275 | High | 8.3 | 2021-03-29 | This vulnerability allows remote attackers to disclose sensitive information and delete arbitrary files on affected installations of NETGEAR ProSAFE Network Ma… |
CVE-2021-27274 | Critical | 9.8 | 2021-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Authentic… |
CVE-2021-27273 | High | 8.8 | 2021-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although… |
CVE-2021-27272 | High | 7.1 | 2021-03-29 | This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although… |
CVE-2021-27245 | High | 8.1 | 2021-03-29 | This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 prior to Archer C7(US)_V5_210125 and Archer A7(US)_V5_200220 AC1750… |
CVE-2021-27244 | Medium | 6.5 | 2021-03-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first… |
CVE-2021-27243 | High | 8.8 | 2021-03-29 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the… |
CVE-2021-27242 | High | 8.8 | 2021-03-29 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the… |
CVE-2021-27241 | Medium | 6.1 | 2021-03-29 | This vulnerability allows local attackers to delete arbitrary directories on affected installations of Avast Premium Security 20.8.2429 (Build 20.8.5653.561)… |
CVE-2021-27240 | High | 7.8 | 2021-03-29 | This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Patch Manager 2020.2.1. An attacker must first obtain… |
CVE-2021-27239 | High | 8.8 | 2021-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400 and R6700 firmware version 1.0.4.98 r… |
CVE-2021-3391 | Medium | 5.3 | 2021-03-29 | MobileIron Mobile@Work through 2021-03-22 allows attackers to distinguish among valid, disabled, and nonexistent user accounts by observing the number of faile… |
CVE-2021-28673 | Critical | 9.8 | 2021-03-29 | Xerox Phaser 6510 before 64.61.23 and 64.59.11 (Bridge), WorkCentre 6515 before 65.61.23 and 65.59.11 (Bridge), VersaLink B400 before 37.61.23 and 37.59.01 (Br… |
CVE-2021-28669 | High | 7.5 | 2021-03-29 | Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 pr… |
CVE-2021-28668 | Critical | 9.8 | 2021-03-29 | Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 ha… |
CVE-2021-26714 | Critical | 9.8 | 2021-03-29 | The Enterprise License Manager portal in Mitel MiContact Center Enterprise before 9.4 could allow a user to access restricted files and folders due to insuffic… |
CVE-2021-25144 | High | 8.8 | 2021-03-29 | A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 an… |
CVE-2021-25143 | High | 7.5 | 2021-03-29 | A remote denial of service (dos) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 8.3.x: 8.3.0.12 an… |
CVE-2021-29417 | Critical | 9.8 | 2021-03-29 | gitjacker before 0.1.0 allows remote attackers to execute arbitrary code via a crafted .git directory because of directory traversal. |
CVE-2021-29416 | Medium | 6.5 | 2021-03-29 | An issue was discovered in PortSwigger Burp Suite before 2021.2. During viewing of a malicious request, it can be manipulated into issuing a request that does… |
CVE-2021-28670 | Critical | 9.1 | 2021-03-29 | Xerox AltaLink B8045/B8090 before 103.008.030.32000, C8030/C8035 before 103.001.030.32000, C8045/C8055 before 103.002.030.32000 and C8070 before 103.003.030.32… |
CVE-2021-29267 | Medium | 6.1 | 2021-03-29 | Sherlock SherlockIM through 2021-03-29 allows Cross Site Scripting (XSS) by leveraging the api/Files/Attachment URI to attack help-desk staff via the chatbot f… |
CVE-2021-27352 | Medium | 5.4 | 2021-03-29 | An open redirect vulnerability in Ilch CMS version 2.1.42 allows attackers to redirect users to an attacker's site after a successful login. |
CVE-2021-21727 | High | 7.5 | 2021-03-29 | A ZTE product has a DoS vulnerability. A remote attacker can amplify traffic by sending carefully constructed IPv6 packets to the affected devices, which event… |
CVE-2021-23358 | Low | 3.3 | 2021-03-29 | The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, pa… |
CVE-2021-28937 | High | 7.5 | 2021-03-29 | The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) contains the administrator account password… |
CVE-2021-28936 | High | 7.5 | 2021-03-29 | The Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) Web management administrator password can be changed by sending a specially crafted HTTP GET request. T… |
CVE-2021-29274 | Medium | 6.1 | 2021-03-29 | Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip. |
CVE-2021-29272 | Medium | 6.1 | 2021-03-27 | bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism against the "scrip… |
CVE-2021-29271 | Medium | 6.1 | 2021-03-27 | remark42 before 1.6.1 allows XSS, as demonstrated by "Locator: Locator{URL:" followed by an XSS payload. This is related to backend/app/store/comment.go and ba… |
CVE-2021-29249 | High | 7.5 | 2021-03-26 | BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability. |
CVE-2021-29266 | High | 7.8 | 2021-03-26 | An issue was discovered in the Linux kernel before 5.11.9. drivers/vhost/vdpa.c has a use-after-free because v->config_ctx has an invalid value upon re-opening… |
CVE-2021-29265 | Medium | 4.7 | 2021-03-26 | An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GP… |
CVE-2021-29264 | Medium | 5.5 | 2021-03-26 | An issue was discovered in the Linux kernel through 5.11.10. drivers/net/ethernet/freescale/gianfar.c in the Freescale Gianfar Ethernet driver allows attackers… |
CVE-2021-21396 | Medium | 6.5 | 2021-03-26 | wire-server is an open-source back end for Wire, a secure collaboration platform. In wire-server from version 2021-02-16 and before version 2021-03-02, the cli… |
CVE-2021-21374 | High | 8.1 | 2021-03-26 | Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimb… |
CVE-2021-21373 | High | 7.5 | 2021-03-26 | Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimb… |
CVE-2021-21372 | High | 8.3 | 2021-03-26 | Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places… |
CVE-2021-20206 | High | 7.2 | 2021-03-26 | An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field… |
CVE-2021-21411 | Medium | 5.5 | 2021-03-26 | OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The `--gitlab-group` flag for group-based aut… |
CVE-2021-21389 | High | 8.1 | 2021-03-26 | BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged… |
CVE-2021-22194 | Medium | 5.7 | 2021-03-26 | In all versions of GitLab, marshalled session keys were being stored in Redis. |
CVE-2021-22184 | Medium | 6.2 | 2021-03-26 | An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to see sensitive information that wasn't pro… |
CVE-2021-22180 | Medium | 4.3 | 2021-03-26 | An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauthorized users to access details on analyt… |
CVE-2021-22172 | Medium | 4.3 | 2021-03-26 | Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page |
CVE-2021-21333 | Medium | 6.1 | 2021-03-26 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2021-21332 | Medium | 6.9 | 2021-03-26 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2021-25372 | Medium | 6.1 | 2021-03-26 | An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access. |
CVE-2021-25371 | Medium | 6.1 | 2021-03-26 | A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP. |
CVE-2021-25370 | Medium | 6.1 | 2021-03-26 | An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic. |
CVE-2021-25369 | Medium | 6.2 | 2021-03-26 | An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace. |
CVE-2021-22886 | Medium | 6.1 | 2021-03-26 | Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to i… |
CVE-2021-29255 | High | 7.5 | 2021-03-26 | MicroSeven MYM71080i-B 2.0.5 through 2.0.20 devices send admin credentials in cleartext to pnp.microseven.com TCP port 7007. An attacker on the same network as… |
CVE-2021-21403 | High | 7.5 | 2021-03-26 | In github.com/kongchuanhujiao/server before version 1.3.21 there is an authentication Bypass by Primary Weakness vulnerability. All users are impacted. This is… |
CVE-2021-20289 | Medium | 5.3 | 2021-03-26 | A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response… |
CVE-2021-20285 | Medium | 6.6 | 2021-03-26 | A flaw was found in upx canPack in p_lx_elf.cpp in UPX 3.96. This flaw allows attackers to cause a denial of service (SEGV or buffer overflow and application c… |
CVE-2021-20284 | Medium | 5.5 | 2021-03-26 | A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of sy… |
CVE-2021-20271 | High | 7.0 | 2021-03-26 | A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemin… |
CVE-2021-20197 | Medium | 6.3 | 2021-03-26 | There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these uti… |
CVE-2021-20193 | Low | 3.3 | 2021-03-26 | A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consu… |
CVE-2021-1629 | Medium | 6.1 | 2021-03-26 | Tableau Server fails to validate certain URLs that are embedded in emails sent to Tableau Server users. |
CVE-2021-1628 | Critical | 9.8 | 2021-03-26 | MuleSoft is aware of a XML External Entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-prem… |
CVE-2021-1627 | Critical | 9.8 | 2021-03-26 | MuleSoft is aware of a Server Side Request Forgery vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-pr… |