2021 CVEs (page 203)
Page 203 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21359 | Medium | 5.9 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources… |
CVE-2021-21358 | Medium | 5.4 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that the Form Designer backend… |
CVE-2021-21357 | High | 8.3 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 due to improper input validation, att… |
CVE-2021-21355 | High | 8.6 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1, due to the lack of ensuring file ext… |
CVE-2021-21340 | Medium | 5.4 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that database fields used as _… |
CVE-2021-21339 | Medium | 5.9 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 user session identifi… |
CVE-2021-21338 | Medium | 4.7 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovere… |
CVE-2021-21351 | Medium | 5.4 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to… |
CVE-2021-21350 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21349 | Medium | 6.1 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21348 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21347 | Medium | 6.1 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21346 | Medium | 6.1 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21345 | Medium | 5.8 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21344 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21343 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at… |
CVE-2021-21342 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at… |
CVE-2021-21341 | High | 7.5 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacke… |
CVE-2021-25922 | Medium | 6.1 | 2021-03-22 | In OpenEMR, versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly. An attacker could tr… |
CVE-2021-25921 | Medium | 5.4 | 2021-03-22 | In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the `Allergies` s… |
CVE-2021-25920 | Medium | 6.5 | 2021-03-22 | In OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating a new user, which leads to a malicious user able to read and s… |
CVE-2021-25919 | Medium | 4.8 | 2021-03-22 | In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly. A highly privileged att… |
CVE-2021-25918 | Medium | 4.8 | 2021-03-22 | In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the TOTP… |
CVE-2021-25917 | Medium | 4.8 | 2021-03-22 | In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the U2F… |
CVE-2021-22321 | Medium | 5.3 | 2021-03-22 | There is a use-after-free vulnerability in a Huawei product. A module cannot deal with specific operations in special scenarios. Attackers can exploit this vul… |
CVE-2021-22314 | High | 7.8 | 2021-03-22 | There is a local privilege escalation vulnerability in some versions of ManageOne. A local authenticated attacker could perform specific operations to exploit… |
CVE-2021-22320 | High | 7.5 | 2021-03-22 | There is a denial of service vulnerability in Huawei products. A module cannot deal with specific messages correctly. Attackers can exploit this vulnerability… |
CVE-2021-22311 | High | 7.2 | 2021-03-22 | There is an improper permission assignment vulnerability in Huawei ManageOne product. Due to improper security hardening, the process can run with a higher pri… |
CVE-2021-22310 | Medium | 4.4 | 2021-03-22 | There is an information leakage vulnerability in some huawei products. Due to the properly storage of specific information in the log file, the attacker can ob… |
CVE-2021-26578 | High | 7.5 | 2021-03-22 | A potential security vulnerability has been identified in HPE Network Orchestrator (NetO) version(s): Prior to 2.5. The vulnerability could be remotely exploit… |
CVE-2021-25265 | High | 8.8 | 2021-03-22 | A malicious website could execute code remotely in Sophos Connect Client before version 2.1. |
CVE-2021-22309 | High | 7.5 | 2021-03-22 | There is insecure algorithm vulnerability in Huawei products. A module uses less random input in a secure mechanism. Attackers can exploit this vulnerability b… |
CVE-2021-28972 | Medium | 6.7 | 2021-03-22 | In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new… |
CVE-2021-28971 | Medium | 5.5 | 2021-03-22 | In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, userspace applications (such as perf-fuzzer)… |
CVE-2021-27596 | Low | 3.3 | 2021-03-22 | When a user opens manipulated Autodesk 3D Studio for MS-DOS (.3DS) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application cr… |
CVE-2021-27595 | Low | 3.3 | 2021-03-22 | When a user opens manipulated Portable Document Format (.PDF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes… |
CVE-2021-27594 | Low | 3.3 | 2021-03-22 | When a user opens manipulated Windows Bitmap (.BMP) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becom… |
CVE-2021-27593 | Low | 3.3 | 2021-03-22 | When a user opens manipulated Graphics Interchange Format (.GIF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application cras… |
CVE-2021-28968 | Medium | 5.4 | 2021-03-22 | An issue was discovered in PunBB before 1.4.6. An XSS vulnerability in the [email] BBcode tag allows (with authentication) injecting arbitrary JavaScript into… |
CVE-2021-28148 | High | 7.5 | 2021-03-22 | One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authen… |
CVE-2021-28147 | Medium | 6.5 | 2021-03-22 | The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana inst… |
CVE-2021-27308 | Medium | 4.8 | 2021-03-22 | A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" para… |
CVE-2021-28146 | Medium | 6.5 | 2021-03-22 | The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication se… |
CVE-2021-27962 | High | 7.1 | 2021-03-22 | Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they sh… |
CVE-2021-26295 | Critical | 9.8 | 2021-03-22 | Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz. |
CVE-2021-28964 | Medium | 4.7 | 2021-03-22 | A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG)… |
CVE-2021-21438 | Low | 3.5 | 2021-03-22 | Agents are able to see linked FAQ articles without permissions (defined in FAQ Category). This issue affects: FAQ version 6.0.29 and prior versions, OTRS versi… |
CVE-2021-21437 | Low | 3.5 | 2021-03-22 | Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and… |
CVE-2021-28963 | Medium | 5.3 | 2021-03-22 | Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters. |
CVE-2021-28956 | High | 8.8 | 2021-03-22 | The unofficial vscode-sass-lint (aka Sass Lint) extension through 1.0.7 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens… |
CVE-2021-28955 | Critical | 9.8 | 2021-03-22 | git-bug before 0.7.2 has an Uncontrolled Search Path Element. It will execute git.bat from the current directory in certain PATH situations (most often seen on… |
CVE-2021-26070 | High | 7.2 | 2021-03-22 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resources via a Broken… |
CVE-2021-26069 | Medium | 5.3 | 2021-03-22 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate project keys via an… |
CVE-2021-23360 | High | 7.5 | 2021-03-21 | This affects the package killport before 1.0.2. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. Thi… |
CVE-2021-28961 | High | 8.8 | 2021-03-21 | applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary command… |
CVE-2021-28957 | Medium | 6.1 | 2021-03-21 | An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner cl… |
CVE-2021-28954 | High | 7.8 | 2021-03-21 | In Chris Walz bit before 1.0.5 on Windows, attackers can run arbitrary code via a .exe file in a crafted repository. |
CVE-2021-28953 | High | 7.8 | 2021-03-21 | The unofficial C/C++ Advanced Lint extension before 1.9.0 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted rep… |
CVE-2021-28952 | High | 7.8 | 2021-03-20 | An issue was discovered in the Linux kernel through 5.11.8. The sound/soc/qcom/sdm845.c soundwire device driver has a buffer overflow when an unexpected port I… |
CVE-2021-28117 | High | 7.5 | 2021-03-20 | libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https… |
CVE-2021-28951 | Medium | 5.5 | 2021-03-20 | An issue was discovered in fs/io_uring.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (deadlock) because exit may be wa… |
CVE-2021-28950 | Medium | 5.5 | 2021-03-20 | An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A "stall on CPU" can occur because a retry loop continually finds the same bad i… |
CVE-2021-21267 | High | 7.5 | 2021-03-19 | Schema-Inspector is an open-source tool to sanitize and validate JS objects (npm package schema-inspector). In before version 2.0.0, email address validation i… |
CVE-2021-27520 | Medium | 6.1 | 2021-03-19 | A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "author" parameter. |
CVE-2021-27519 | Medium | 6.1 | 2021-03-19 | A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "srch" parameter. |
CVE-2021-26992 | High | 7.5 | 2021-03-19 | Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability which could allow a remote attacker to cause a Denial of Service (DoS). |
CVE-2021-26991 | High | 7.5 | 2021-03-19 | Cloud Manager versions prior to 3.9.4 contain an insecure Cross-Origin Resource Sharing (CORS) policy which could allow a remote attacker to interact with Clou… |
CVE-2021-26990 | Critical | 9.1 | 2021-03-19 | Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability that could allow a remote attacker to overwrite arbitrary system files. |
CVE-2021-20077 | Medium | 6.7 | 2021-03-19 | Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessu… |
CVE-2021-25278 | Medium | 4.8 | 2021-03-19 | FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor. |
CVE-2021-25277 | Medium | 6.1 | 2021-03-19 | FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the alternative text hover box in the file submission component. |
CVE-2021-27906 | Medium | 5.5 | 2021-03-19 | A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versi… |
CVE-2021-27807 | Medium | 5.5 | 2021-03-19 | A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions. |
CVE-2021-21390 | Medium | 6.5 | 2021-03-19 | MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE… |
CVE-2021-21387 | High | 8.1 | 2021-03-19 | Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of v… |
CVE-2021-27506 | Medium | 5.5 | 2021-03-19 | The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing of malformed png f… |
CVE-2021-28834 | Critical | 9.8 | 2021-03-19 | Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated. |
CVE-2021-28831 | High | 7.5 | 2021-03-19 | decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, v… |
CVE-2021-28090 | Medium | 5.3 | 2021-03-19 | Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002. |
CVE-2021-28089 | High | 7.5 | 2021-03-19 | Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001. |
CVE-2021-28126 | Medium | 6.1 | 2021-03-19 | index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerability |
CVE-2021-28110 | High | 7.5 | 2021-03-19 | /exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in its XML parser. |
CVE-2021-25293 | High | 7.5 | 2021-03-19 | An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c. |
CVE-2021-25292 | Medium | 6.5 | 2021-03-19 | An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic… |
CVE-2021-25291 | High | 7.5 | 2021-03-19 | An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries. |
CVE-2021-25290 | High | 7.5 | 2021-03-19 | An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size. |
CVE-2021-25289 | Critical | 9.8 | 2021-03-19 | An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation… |
CVE-2021-3327 | Medium | 5.4 | 2021-03-19 | Ovation Dynamic Content 1.10.1 for Elementor allows XSS via the post_title parameter. |
CVE-2021-28109 | Medium | 6.1 | 2021-03-19 | TranzWare (POI) FIMI before 4.2.20.4.2 allows login_tw.php reflected Cross-Site Scripting (XSS). |
CVE-2021-27928 | High | 7.2 | 2021-03-19 | A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server t… |
CVE-2021-27221 | High | 8.1 | 2021-03-19 | MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. NOTE: the vendor's position… |
CVE-2021-28653 | Medium | 6.5 | 2021-03-19 | The iOS and macOS apps before 1.4.1 for the Western Digital G-Technology ArmorLock NVMe SSD store keys insecurely. They choose a non-preferred storage mechanis… |
CVE-2021-26275 | Critical | 9.8 | 2021-03-19 | The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function. NOTE: This vulnerability only affects… |
CVE-2021-21384 | Medium | 6.3 | 2021-03-19 | shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still… |
CVE-2021-27436 | Medium | 6.1 | 2021-03-18 | WebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code to an unsuspecting… |
CVE-2021-3416 | Medium | 6.0 | 2021-03-18 | A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopba… |
CVE-2021-27358 | High | 7.5 | 2021-03-18 | The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a com… |
CVE-2021-25764 | Medium | 5.3 | 2021-03-18 | In JetBrains PhpStorm before 2020.3, source code could be added to debug logs. |
CVE-2021-28160 | Medium | 6.1 | 2021-03-18 | Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) suffers from a reflected XSS vulnerability due to unsanitized SSID value when the latter is displayed in the /rep… |
CVE-2021-1287 | High | 7.2 | 2021-03-18 | A vulnerability in the web-based management interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow… |