2021 CVEs (page 201)
Page 201 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-1626 | Critical | 9.8 | 2021-03-26 | MuleSoft is aware of a Remote Code Execution vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise… |
CVE-2021-3109 | Medium | 4.8 | 2021-03-26 | The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator account. |
CVE-2021-22506 | High | 7.5 | 2021-03-26 | Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerab… |
CVE-2021-3275 | Medium | 6.1 | 2021-03-26 | Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access Points, ADSL + DSL G… |
CVE-2021-23890 | Medium | 6.5 | 2021-03-26 | Information leak vulnerability in the Agent Handler of McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows an unauthenticated user to download McA… |
CVE-2021-23889 | Low | 3.5 | 2021-03-26 | Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows ePO administrators to inject arbitrary web script or HTM… |
CVE-2021-23888 | Medium | 6.3 | 2021-03-26 | Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 could cause an authenticated ePO user to load a… |
CVE-2021-20683 | Medium | 5.4 | 2021-03-26 | Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to i… |
CVE-2021-20682 | High | 7.2 | 2021-03-26 | baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors. |
CVE-2021-20681 | Medium | 5.4 | 2021-03-26 | Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an… |
CVE-2021-20677 | Low | 3.1 | 2021-03-26 | UNIVERGE Aspire series PBX (UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100 from 1.00 to 10.70, and SL2100 from 1.0… |
CVE-2021-28250 | High | 7.8 | 2021-03-26 | CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid (and/or setgid) file. When a component is run as an argument o… |
CVE-2021-28249 | High | 8.8 | 2021-03-26 | CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. To exploit the vulnerabilit… |
CVE-2021-28248 | High | 7.5 | 2021-03-26 | CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempts. An attacker is able to perform an arb… |
CVE-2021-28247 | Medium | 5.4 | 2021-03-26 | CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS). The impact is: An authenticated remote user is able to inject arbitr… |
CVE-2021-28246 | High | 7.8 | 2021-03-26 | CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. A regular user must create… |
CVE-2021-3153 | Medium | 6.5 | 2021-03-26 | HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor au… |
CVE-2021-3027 | Medium | 6.5 | 2021-03-26 | app/views_mod/user/user.py in LibrIT PaSSHport through 2.5 is affected by LDAP Injection. There is an information leak through the crafting of special queries… |
CVE-2021-3119 | High | 7.5 | 2021-03-25 | Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to sqlcipher_export in crypto.c and sqlite3StrICmp in sqlite3.c. This may all… |
CVE-2021-27372 | Critical | 9.8 | 2021-03-25 | Realtek xPON RTL9601D SDK 1.9 stores passwords in plaintext which may allow attackers to possibly gain access to the device with root permissions via the build… |
CVE-2021-29098 | High | 7.8 | 2021-03-25 | Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and… |
CVE-2021-29097 | High | 7.8 | 2021-03-25 | Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS… |
CVE-2021-29095 | Medium | 6.8 | 2021-03-25 | Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacke… |
CVE-2021-29094 | Medium | 6.8 | 2021-03-25 | Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with… |
CVE-2021-29093 | Medium | 6.8 | 2021-03-25 | A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specializ… |
CVE-2021-29010 | Medium | 4.8 | 2021-03-25 | A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the "report_type" parameter. |
CVE-2021-29009 | Medium | 4.8 | 2021-03-25 | A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the "type" parameter. |
CVE-2021-29008 | Medium | 4.8 | 2021-03-25 | A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via webmaster-tools.php in the "to_time" parameter. |
CVE-2021-27454 | High | 7.8 | 2021-03-25 | The software performs an operation at a privilege level higher than the minimum level required, which creates new weaknesses or amplifies the consequences of o… |
CVE-2021-27452 | High | 7.8 | 2021-03-25 | The software contains a hard-coded password that could allow an attacker to take control of the merging unit using these hard-coded credentials on the MU320E (… |
CVE-2021-27450 | High | 7.8 | 2021-03-25 | SSH server configuration file does not implement some best practices. This could lead to a weakening of the SSH protocol strength, which could lead to addition… |
CVE-2021-27448 | High | 7.8 | 2021-03-25 | A miscommunication in the file system allows adversaries with access to the MU320E to escalate privileges on the MU320E (all firmware versions prior to v04A00… |
CVE-2021-27440 | Critical | 9.8 | 2021-03-25 | The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60… |
CVE-2021-27438 | High | 8.8 | 2021-03-25 | The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60… |
CVE-2021-22889 | Medium | 6.1 | 2021-03-25 | Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of stats.php (and possibly other scripts) due to… |
CVE-2021-22888 | Medium | 6.1 | 2021-03-25 | Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of campaign-zone-zones.php. An attacker could trick a us… |
CVE-2021-3467 | Medium | 5.5 | 2021-03-25 | A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF box in the JP2 image format decoder. A… |
CVE-2021-3466 | Critical | 9.8 | 2021-03-25 | A flaw was found in libmicrohttpd. A missing bounds check in the post_process_urlencoded function leads to a buffer overflow, allowing a remote attacker to wri… |
CVE-2021-3446 | Medium | 5.5 | 2021-03-25 | A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned I… |
CVE-2021-3443 | Medium | 5.5 | 2021-03-25 | A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially cr… |
CVE-2021-29096 | High | 7.8 | 2021-03-25 | A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (… |
CVE-2021-27195 | Medium | 5.9 | 2021-03-25 | Improper Authorization vulnerability in Netop Vision Pro up to and including to 9.7.1 allows an attacker to replay network traffic. |
CVE-2021-27194 | High | 8.8 | 2021-03-25 | Cleartext transmission of sensitive information in Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacker to gather credentials in… |
CVE-2021-27193 | Critical | 9.8 | 2021-03-25 | Incorrect default permissions vulnerability in the API of Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacker to read and write… |
CVE-2021-27192 | High | 7.8 | 2021-03-25 | Local privilege escalation vulnerability in Windows clients of Netop Vision Pro up to and including 9.7.1 allows a local user to gain administrator privileges… |
CVE-2021-26597 | Medium | 6.5 | 2021-03-25 | An issue was discovered in Nokia NetAct 18A. A remote user, authenticated to the NOKIA NetAct Web Page, can visit the Site Configuration Tool web site section… |
CVE-2021-26596 | Medium | 5.4 | 2021-03-25 | An issue was discovered in Nokia NetAct 18A. A malicious user can change a filename of an uploaded file to include JavaScript code, which is then stored and ex… |
CVE-2021-20217 | High | 7.5 | 2021-03-25 | A flaw was found in Privoxy in versions before 3.0.31. An assertion failure triggered by a crafted CGI request may lead to denial of service. The highest threa… |
CVE-2021-20216 | High | 7.5 | 2021-03-25 | A flaw was found in Privoxy in versions before 3.0.31. A memory leak that occurs when decompression fails unexpectedly may lead to a denial of service. The hig… |
CVE-2021-20215 | High | 7.5 | 2021-03-25 | A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the show-status CGI handler when memory allocations fail can lead to a system crash. |
CVE-2021-20214 | High | 7.5 | 2021-03-25 | A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the client-tags CGI handler when client tags are configured and memory allocations fail… |
CVE-2021-20213 | High | 7.5 | 2021-03-25 | A flaw was found in Privoxy in versions before 3.0.29. Dereference of a NULL-pointer that could result in a crash if accept-intercepted-requests was enabled, P… |
CVE-2021-20212 | High | 7.5 | 2021-03-25 | A flaw was found in Privoxy in versions before 3.0.29. Memory leak if multiple filters are executed and the last one is skipped due to a pcre error leading to… |
CVE-2021-20211 | High | 7.5 | 2021-03-25 | A flaw was found in Privoxy in versions before 3.0.29. Memory leak when client tags are active can cause a system crash. |
CVE-2021-20210 | High | 7.5 | 2021-03-25 | A flaw was found in Privoxy in versions before 3.0.29. Memory leak in the show-status CGI handler when no filter files are configured can lead to a system cras… |
CVE-2021-25368 | Low | 3.3 | 2021-03-25 | Hijacking vulnerability in Samsung Cloud prior to version 4.7.0.3 allows attackers to intercept when the provider is executed. |
CVE-2021-25367 | Low | 3.7 | 2021-03-25 | Path Traversal vulnerability in Samsung Notes prior to version 4.2.00.22 allows attackers to access local files without permission. |
CVE-2021-25366 | Low | 3.2 | 2021-03-25 | Improper access control in Samsung Internet prior to version 13.2.1.70 allows physically proximate attackers to bypass the secret mode's authentication. |
CVE-2021-25355 | Medium | 5.5 | 2021-03-25 | Using unsafe PendingIntent in Samsung Notes prior to version 4.2.00.22 allows local attackers unauthorized action without permission via hijacking the PendingI… |
CVE-2021-25354 | Low | 3.3 | 2021-03-25 | Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in Samsung Browser via malicious deeplink. |
CVE-2021-25353 | Medium | 5.5 | 2021-03-25 | Using empty PendingIntent in Galaxy Themes prior to version 5.2.00.1215 allows local attackers to read/write private file directories of Galaxy Themes applicat… |
CVE-2021-25352 | Medium | 5.5 | 2021-03-25 | Using PendingIntent with implicit intent in Bixby Voice prior to version 3.0.52.14 allows attackers to execute privileged action by hijacking and modifying the… |
CVE-2021-25351 | Low | 3.2 | 2021-03-25 | Improper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and 12.1.1.3 allows physically proximate attackers to log out user… |
CVE-2021-25350 | Low | 2.0 | 2021-03-25 | Information Exposure vulnerability in Samsung Account prior to version 12.1.1.3 allows physically proximate attackers to access user information via log. |
CVE-2021-25349 | Medium | 5.5 | 2021-03-25 | Using unsafe PendingIntent in Slow Motion Editor prior to version 3.5.18.5 allows local attackers unauthorized action without permission via hijacking the Pend… |
CVE-2021-21783 | Critical | 9.8 | 2021-03-25 | A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote c… |
CVE-2021-22659 | High | 8.6 | 2021-03-25 | Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus packet allowing the a… |
CVE-2021-22496 | High | 7.5 | 2021-03-25 | Authentication Bypass Vulnerability in Micro Focus Access Manager Product, affects all version prior to version 4.5.3.3. The vulnerability could cause informat… |
CVE-2021-3450 | High | 7.4 | 2021-03-25 | The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from… |
CVE-2021-3449 | Medium | 5.9 | 2021-03-25 | An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the… |
CVE-2021-1492 | Medium | 6.6 | 2021-03-25 | The Duo Authentication Proxy installer prior to 5.2.1 did not properly validate file installation paths. This allows an attacker with local user privileges to… |
CVE-2021-29156 | High | 7.5 | 2021-03-25 | ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character re… |
CVE-2021-26715 | Critical | 9.1 | 2021-03-25 | The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arise… |
CVE-2021-20679 | High | 7.5 | 2021-03-25 | Fuji Xerox multifunction devices and printers (DocuCentre-VII C7773/C6673/C5573/C4473/C3373/C3372/C2273, DocuCentre-VII C7788/C6688/C5588, ApeosPort-VII C7773/… |
CVE-2021-21386 | Critical | 9.3 | 2021-03-24 | APKLeaks is an open-source project for scanning APK file for URIs, endpoints & secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary O… |
CVE-2021-21385 | High | 8.8 | 2021-03-24 | Mifos-Mobile Android Application for MifosX is an Android Application built on top of the MifosX Self-Service platform. Mifos-Mobile before commit e505f62 disa… |
CVE-2021-1423 | Medium | 4.4 | 2021-03-24 | A vulnerability in the implementation of a CLI command in Cisco Aironet Access Points (AP) could allow an authenticated, local attacker to overwrite files in t… |
CVE-2021-1418 | Critical | 9.9 | 2021-03-24 | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrar… |
CVE-2021-1417 | Critical | 9.9 | 2021-03-24 | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrar… |
CVE-2021-1411 | Critical | 9.9 | 2021-03-24 | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrar… |
CVE-2021-1381 | Medium | 6.1 | 2021-03-24 | A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker with high privileges or an unauthenticated attacker with physical access… |
CVE-2021-1376 | Medium | 6.7 | 2021-03-24 | Multiple vulnerabilities in the fast reload feature of Cisco IOS XE Software running on Cisco Catalyst 3850, Cisco Catalyst 9300, and Cisco Catalyst 9300L Seri… |
CVE-2021-1375 | Medium | 6.7 | 2021-03-24 | Multiple vulnerabilities in the fast reload feature of Cisco IOS XE Software running on Cisco Catalyst 3850, Cisco Catalyst 9300, and Cisco Catalyst 9300L Seri… |
CVE-2021-1374 | Medium | 4.8 | 2021-03-24 | A vulnerability in the web-based management interface of Cisco IOS XE Wireless Controller software for the Catalyst 9000 Family of switches could allow an auth… |
CVE-2021-1373 | High | 8.6 | 2021-03-24 | A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Wireless Controller Software for the Cis… |
CVE-2021-1371 | Medium | 6.6 | 2021-03-24 | A vulnerability in the role-based access control of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker with read-only privileges to obta… |
CVE-2021-1356 | Medium | 4.3 | 2021-03-24 | Multiple vulnerabilities in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to cause the web UI sof… |
CVE-2021-1352 | High | 7.4 | 2021-03-24 | A vulnerability in the DECnet Phase IV and DECnet/OSI protocol processing of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a… |
CVE-2021-1281 | Medium | 5.1 | 2021-03-24 | A vulnerability in CLI management in Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system as the… |
CVE-2021-1220 | Medium | 4.3 | 2021-03-24 | Multiple vulnerabilities in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to cause the web UI sof… |
CVE-2021-1471 | Critical | 9.9 | 2021-03-24 | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrar… |
CVE-2021-1469 | Critical | 9.9 | 2021-03-24 | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrar… |
CVE-2021-1460 | Medium | 5.3 | 2021-03-24 | A vulnerability in the Cisco IOx Application Framework of Cisco 809 Industrial Integrated Services Routers (Industrial ISRs), Cisco 829 Industrial ISRs, Cisco… |
CVE-2021-1454 | Medium | 6.0 | 2021-03-24 | Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system with… |
CVE-2021-1453 | Medium | 6.8 | 2021-03-24 | A vulnerability in the software image verification functionality of Cisco IOS XE Software for the Cisco Catalyst 9000 Family of switches could allow an unauthe… |
CVE-2021-1452 | Medium | 6.8 | 2021-03-24 | A vulnerability in the ROM Monitor (ROMMON) of Cisco IOS XE Software for Cisco Catalyst IE3200, IE3300, and IE3400 Rugged Series Switches, Cisco Catalyst IE340… |
CVE-2021-1451 | High | 8.1 | 2021-03-24 | A vulnerability in the Easy Virtual Switching System (VSS) feature of Cisco IOS XE Software for Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X S… |
CVE-2021-1449 | Medium | 6.7 | 2021-03-24 | A vulnerability in the boot logic of Cisco Access Points Software could allow an authenticated, local attacker to execute unsigned code at boot time. The vulne… |
CVE-2021-1446 | High | 8.6 | 2021-03-24 | A vulnerability in the DNS application layer gateway (ALG) functionality used by Network Address Translation (NAT) in Cisco IOS XE Software could allow an unau… |
CVE-2021-1443 | Medium | 5.5 | 2021-03-24 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the unde… |