2021 CVEs (page 202)
Page 202 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-1442 | High | 7.8 | 2021-03-24 | A vulnerability in a diagnostic command for the Plug-and-Play (PnP) subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate… |
CVE-2021-1441 | Medium | 6.7 | 2021-03-24 | A vulnerability in the hardware initialization routines of Cisco IOS XE Software for Cisco 1100 Series Industrial Integrated Services Routers and Cisco ESR6300… |
CVE-2021-1439 | High | 7.4 | 2021-03-24 | A vulnerability in the multicast DNS (mDNS) gateway feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, adjacent attacker to… |
CVE-2021-1437 | High | 7.5 | 2021-03-24 | A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to obtain con… |
CVE-2021-1436 | Medium | 4.4 | 2021-03-24 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to conduct path traversal attacks and obtain read acces… |
CVE-2021-1435 | High | 7.2 | 2021-03-24 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that can be executed as the r… |
CVE-2021-1434 | Medium | 4.4 | 2021-03-24 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying file sys… |
CVE-2021-1433 | High | 8.1 | 2021-03-24 | A vulnerability in the vDaemon process in Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affecte… |
CVE-2021-1432 | High | 7.3 | 2021-03-24 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operati… |
CVE-2021-1431 | High | 7.5 | 2021-03-24 | A vulnerability in the vDaemon process of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to cause a device to reload, resulting a… |
CVE-2021-1403 | High | 7.4 | 2021-03-24 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site WebSocket hijacking (CSW… |
CVE-2021-1398 | Medium | 6.8 | 2021-03-24 | A vulnerability in the boot logic of Cisco IOS XE Software could allow an authenticated, local attacker with level 15 privileges or an unauthenticated attacker… |
CVE-2021-1394 | Medium | 5.3 | 2021-03-24 | A vulnerability in the ingress traffic manager of Cisco IOS XE Software for Cisco Network Convergence System (NCS) 520 Routers could allow an unauthenticated… |
CVE-2021-1392 | High | 7.8 | 2021-03-24 | A vulnerability in the CLI command permissions of Cisco IOS and Cisco IOS XE Software could allow an authenticated, local attacker to retrieve the password for… |
CVE-2021-1391 | Medium | 5.1 | 2021-03-24 | A vulnerability in the dragonite debugger of Cisco IOS XE Software could allow an authenticated, local attacker to escalate from privilege level 15 to root pri… |
CVE-2021-1390 | Medium | 5.1 | 2021-03-24 | A vulnerability in one of the diagnostic test CLI commands of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary code on a… |
CVE-2021-1385 | Medium | 6.5 | 2021-03-24 | A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticated, remote attacker to conduct directory… |
CVE-2021-1384 | Medium | 6.5 | 2021-03-24 | A vulnerability in Cisco IOx application hosting environment of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands into the… |
CVE-2021-1383 | Medium | 6.0 | 2021-03-24 | Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system with… |
CVE-2021-1382 | Medium | 6.0 | 2021-03-24 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root p… |
CVE-2021-1377 | Medium | 5.8 | 2021-03-24 | A vulnerability in Address Resolution Protocol (ARP) management of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker… |
CVE-2021-22169 | Medium | 4.3 | 2021-03-24 | An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages. |
CVE-2021-22193 | Low | 3.5 | 2021-03-24 | An issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able to validate the use of a specific name fo… |
CVE-2021-22192 | Critical | 9.9 | 2021-03-24 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on t… |
CVE-2021-22186 | Medium | 4.9 | 2021-03-24 | An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners |
CVE-2021-22185 | Medium | 5.4 | 2021-03-24 | Insufficient input sanitization in wikis in GitLab version 13.8 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a speciall… |
CVE-2021-22179 | Medium | 5.4 | 2021-03-24 | A vulnerability was discovered in GitLab versions before 12.2. GitLab was vulnerable to a SSRF attack through the Outbound Requests feature. |
CVE-2021-22178 | Medium | 5.0 | 2021-03-24 | An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration. |
CVE-2021-22176 | Medium | 4.3 | 2021-03-24 | An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on… |
CVE-2021-29002 | Medium | 5.4 | 2021-03-24 | A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter. |
CVE-2021-28362 | High | 7.5 | 2021-03-24 | An issue was discovered in Contiki through 3.0. When sending an ICMPv6 error message because of invalid extension header options in an incoming IPv6 packet, th… |
CVE-2021-27320 | High | 7.5 | 2021-03-24 | Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname paramete… |
CVE-2021-27319 | High | 7.5 | 2021-03-24 | Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via email parameter. |
CVE-2021-27316 | High | 7.5 | 2021-03-24 | Blind SQL injection in contactus.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via lastname parameter. |
CVE-2021-27315 | High | 7.5 | 2021-03-24 | Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via the comment parame… |
CVE-2021-29033 | Medium | 4.8 | 2021-03-24 | A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/edit_group.php URI. |
CVE-2021-29032 | Medium | 4.8 | 2021-03-24 | A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/preferences.php URI. |
CVE-2021-29031 | Medium | 4.8 | 2021-03-24 | A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/users_import.php URI. |
CVE-2021-29030 | Medium | 4.8 | 2021-03-24 | A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/index.php URI. |
CVE-2021-29029 | Medium | 4.8 | 2021-03-24 | A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/edit_personal_page.php URI. |
CVE-2021-29028 | Medium | 4.8 | 2021-03-24 | A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/user_activity.php URI. |
CVE-2021-29027 | Medium | 4.8 | 2021-03-24 | A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/index.php URI. |
CVE-2021-29026 | Medium | 4.8 | 2021-03-24 | A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/permissions.php URI. |
CVE-2021-29025 | Medium | 4.8 | 2021-03-24 | A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/my_images.php URI. |
CVE-2021-29133 | Medium | 5.5 | 2021-03-24 | Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9.36 allows local users to read the contents of any file on the f… |
CVE-2021-28967 | Critical | 9.8 | 2021-03-24 | The unofficial MATLAB extension before 2.0.1 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace because of lint configur… |
CVE-2021-21380 | High | 7.7 | 2021-03-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform (and only those… |
CVE-2021-22864 | High | 8.8 | 2021-03-23 | A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled con… |
CVE-2021-3409 | Medium | 5.7 | 2021-03-23 | The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously f… |
CVE-2021-28824 | High | 8.8 | 2021-03-23 | The Windows Installation component of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpa… |
CVE-2021-28823 | High | 8.8 | 2021-03-23 | The Windows Installation component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition… |
CVE-2021-28822 | High | 8.8 | 2021-03-23 | The Enterprise Message Service Server (tibemsd), Enterprise Message Service Central Administration (tibemsca), Enterprise Message Service JSON configuration ge… |
CVE-2021-28821 | High | 8.8 | 2021-03-23 | The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Message Service, TIBCO Enterprise Message Service - Community Edition, and TIBCO E… |
CVE-2021-28820 | High | 8.8 | 2021-03-23 | The FTL Server (tibftlserver), FTL C API, FTL Golang API, FTL Java API, and FTL .Net API components of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIB… |
CVE-2021-28819 | High | 8.8 | 2021-03-23 | The Windows Installation component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition co… |
CVE-2021-28818 | High | 8.8 | 2021-03-23 | The Rendezvous Routing Daemon (rvrd), Rendezvous Secure Routing Daemon (rvrsd), Rendezvous Secure Daemon (rvsd), Rendezvous Cache (rvcache), Rendezvous Secure… |
CVE-2021-28817 | High | 8.8 | 2021-03-23 | The Windows Installation component of TIBCO Software Inc.'s TIBCO Rendezvous and TIBCO Rendezvous Developer Edition contains a vulnerability that theoretically… |
CVE-2021-28100 | Medium | 5.5 | 2021-03-23 | Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--. An attacker with read access to the local filesystem can read anything wri… |
CVE-2021-28099 | Medium | 4.4 | 2021-03-23 | In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permission… |
CVE-2021-3392 | Low | 3.2 | 2021-03-23 | A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_requ… |
CVE-2021-27908 | Medium | 5.8 | 2021-03-23 | In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging… |
CVE-2021-21402 | High | 7.7 | 2021-03-23 | Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from… |
CVE-2021-3444 | High | 7.8 | 2021-03-23 | The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker… |
CVE-2021-21401 | High | 7.1 | 2021-03-23 | Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can… |
CVE-2021-23362 | Medium | 5.3 | 2021-03-23 | The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl fun… |
CVE-2021-23274 | Critical | 9.8 | 2021-03-23 | The Config UI component of TIBCO Software Inc.'s TIBCO API Exchange Gateway and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vuln… |
CVE-2021-20270 | High | 7.5 | 2021-03-23 | An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source… |
CVE-2021-20227 | Medium | 5.5 | 2021-03-23 | A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLit… |
CVE-2021-20222 | High | 7.5 | 2021-03-23 | A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this… |
CVE-2021-20219 | Medium | 5.5 | 2021-03-23 | A denial of service vulnerability was found in n_tty_receive_char_special in drivers/tty/n_tty.c of the Linux kernel. In this flaw a local attacker with a norm… |
CVE-2021-21377 | Medium | 4.8 | 2021-03-23 | OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after perfor… |
CVE-2021-21376 | Medium | 6.4 | 2021-03-23 | OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 loads various information about the current user… |
CVE-2021-27969 | Medium | 4.8 | 2021-03-23 | Dolphin CMS 7.4.2 is vulnerable to stored XSS via the Page Builder "width" parameter. |
CVE-2021-27531 | Medium | 4.8 | 2021-03-23 | A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "query" parameter. |
CVE-2021-27530 | Medium | 4.8 | 2021-03-23 | A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allow remote attacker to inject javascript via URI in /index.php. |
CVE-2021-27529 | Medium | 4.8 | 2021-03-23 | A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "limit" parameter. |
CVE-2021-27528 | Medium | 4.8 | 2021-03-23 | A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "refID" parameter. |
CVE-2021-27527 | Medium | 4.8 | 2021-03-23 | A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "valueID" parameter. |
CVE-2021-27526 | Medium | 4.8 | 2021-03-23 | A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "page" parameter. |
CVE-2021-27310 | Medium | 6.1 | 2021-03-23 | Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "language" parameter. |
CVE-2021-27309 | Medium | 6.1 | 2021-03-23 | Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "module" parameter. |
CVE-2021-29082 | Critical | 9.6 | 2021-03-23 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects RBW30 before 2.6.1.4, RBS40V before 2.6.1.4, RBK752 before 3.2.15.25… |
CVE-2021-29081 | High | 8.4 | 2021-03-23 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects RBW30 before 2.6.2.2, RBK852 before 3.2.17.1… |
CVE-2021-29080 | High | 8.1 | 2021-03-23 | Certain NETGEAR devices are affected by password reset by an unauthenticated attacker. This affects RBK852 before 3.2.10.11, RBK853 before 3.2.10.11, RBR854 be… |
CVE-2021-29079 | Critical | 9.6 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854… |
CVE-2021-29078 | Critical | 9.6 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854… |
CVE-2021-29077 | Critical | 9.6 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBW30 before 2.6.2.2, RBS40V before 2.6.2.4, RBK852 befo… |
CVE-2021-29076 | Critical | 9.6 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854… |
CVE-2021-29075 | High | 8.4 | 2021-03-23 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects RBW30 before 2.6.2.2, RBK852 before 3.2.17.12, RBK… |
CVE-2021-29074 | High | 8.4 | 2021-03-23 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects RBW30 before 2.6.2.2, RBK852 before 3.2.17.12, RBK… |
CVE-2021-29073 | High | 7.6 | 2021-03-23 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R8000P before 1.4.1.66, MK62 before 1.0.6.110, MR6… |
CVE-2021-29072 | High | 8.4 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 befor… |
CVE-2021-29071 | Critical | 9.6 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 befor… |
CVE-2021-29070 | High | 8.4 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 befor… |
CVE-2021-29069 | High | 7.3 | 2021-03-23 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects XR450 before 2.3.2.114, XR500 before 2.3.2.114, and WNR2000v5… |
CVE-2021-29068 | Critical | 9.9 | 2021-03-23 | Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects R6700v3 before 1.0.4.98, R6400v2 before 1.0.4.98, R7000 before… |
CVE-2021-29067 | Critical | 9.6 | 2021-03-23 | Certain NETGEAR devices are affected by authentication bypass. This affects RBW30 before 2.6.2.2, RBS40V before 2.6.2.4, RBK852 before 3.2.17.12, RBK853 before… |
CVE-2021-29066 | Critical | 9.6 | 2021-03-23 | Certain NETGEAR devices are affected by authentication bypass. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 before 3.2.17.12, RBR850 b… |
CVE-2021-29065 | Critical | 9.6 | 2021-03-23 | NETGEAR RBR850 devices before 3.2.10.11 are affected by authentication bypass. |
CVE-2021-21370 | Medium | 5.4 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that c… |