2021 CVEs (page 204)
Page 204 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-27656 | Medium | 5.3 | 2021-03-18 | A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-level information about the exacqVision W… |
CVE-2021-22665 | High | 7.8 | 2021-03-18 | Rockwell Automation DriveTools SP v5.13 and below and Drives AOP v4.12 and below both contain a vulnerability that a local attacker with limited privileges may… |
CVE-2021-21383 | High | 7.6 | 2021-03-18 | Wiki.js an open-source wiki app built on Node.js. Wiki.js before version 2.5.191 is vulnerable to stored cross-site scripting through mustache expressions in c… |
CVE-2021-28796 | Medium | 6.1 | 2021-03-18 | Increments Qiita::Markdown before 0.33.0 allows XSS in transformers. |
CVE-2021-28794 | Critical | 9.8 | 2021-03-18 | The unofficial ShellCheck extension before 0.13.4 for Visual Studio Code mishandles shellcheck.executablePath. |
CVE-2021-28792 | High | 7.8 | 2021-03-18 | The unofficial Swift Development Environment extension before 2.12.1 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a… |
CVE-2021-28791 | High | 7.8 | 2021-03-18 | The unofficial SwiftFormat extension before 1.3.7 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspac… |
CVE-2021-28790 | High | 7.8 | 2021-03-18 | The unofficial SwiftLint extension before 1.4.5 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace… |
CVE-2021-28789 | High | 7.8 | 2021-03-18 | The unofficial apple/swift-format extension before 1.1.2 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious w… |
CVE-2021-28145 | Medium | 5.4 | 2021-03-18 | Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Edit… |
CVE-2021-26216 | Medium | 4.3 | 2021-03-18 | SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php. |
CVE-2021-26215 | Medium | 4.3 | 2021-03-18 | SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php. |
CVE-2021-27306 | High | 7.5 | 2021-03-18 | An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authenticated routes without… |
CVE-2021-26935 | High | 7.5 | 2021-03-18 | In WoWonder < 3.1, remote attackers can gain access to the database by exploiting a requests.php?f=search-my-followers SQL Injection vulnerability via the even… |
CVE-2021-24149 | High | 8.8 | 2021-03-18 | Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in the mec_fes_… |
CVE-2021-24148 | Critical | 9.8 | 2021-03-18 | A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated… |
CVE-2021-24147 | Medium | 5.4 | 2021-03-18 | Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment fie… |
CVE-2021-24146 | High | 7.5 | 2021-03-18 | Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files… |
CVE-2021-24145 | High | 7.2 | 2021-03-18 | Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones… |
CVE-2021-24144 | High | 7.8 | 2021-03-18 | Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitrar… |
CVE-2021-24143 | High | 8.8 | 2021-03-18 | Unvalidated input in the AccessPress Social Icons plugin, versions before 1.8.1, did not sanitise its widget attribute, allowing accounts with post permission… |
CVE-2021-24142 | High | 7.2 | 2021-03-18 | Unvaludated input in the 301 Redirects - Easy Redirect Manager WordPress plugin, versions before 2.51, did not sanitise its "Redirect From" column when importi… |
CVE-2021-24141 | High | 7.2 | 2021-03-18 | Unvaludated input in the Advanced Database Cleaner plugin, versions before 3.0.2, lead to SQL injection allowing high privilege users (admin+) to perform SQL a… |
CVE-2021-24140 | High | 7.2 | 2021-03-18 | Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' o… |
CVE-2021-24139 | Critical | 9.8 | 2021-03-18 | Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php… |
CVE-2021-24138 | Medium | 5.5 | 2021-03-18 | Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id". This requires an admin privileg… |
CVE-2021-24137 | High | 8.8 | 2021-03-18 | Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users… |
CVE-2021-24136 | Medium | 5.4 | 2021-03-18 | Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnera… |
CVE-2021-24135 | Medium | 6.1 | 2021-03-18 | Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting… |
CVE-2021-24134 | Medium | 4.8 | 2021-03-18 | Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripti… |
CVE-2021-24133 | Medium | 4.3 | 2021-03-18 | Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make a logged-in adminis… |
CVE-2021-24132 | High | 8.8 | 2021-03-18 | The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulk_action, export_full and save_slider_db functionalities of the plugin were vulnerable… |
CVE-2021-24131 | High | 7.2 | 2021-03-18 | Unvalidated input in the Anti-Spam by CleanTalk WordPress plugin, versions before 5.149, lead to multiple authenticated SQL injection vulnerabilities, however… |
CVE-2021-24130 | High | 7.2 | 2021-03-18 | Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable t… |
CVE-2021-24129 | Medium | 5.4 | 2021-03-18 | Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS)… |
CVE-2021-24128 | Medium | 5.4 | 2021-03-18 | Unvalidated input and lack of output encoding in the Team Members WordPress plugin, versions before 5.0.4, lead to Cross-site scripting vulnerabilities allowin… |
CVE-2021-24127 | Medium | 5.4 | 2021-03-18 | Unvalidated input and lack of output encoding in the ThirstyAffiliates Affiliate Link Manager WordPress plugin, versions before 3.9.3, was vulnerable to authen… |
CVE-2021-24126 | Medium | 5.4 | 2021-03-18 | Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metada… |
CVE-2021-24125 | High | 7.2 | 2021-03-18 | Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7_contact_form GET parameter when submi… |
CVE-2021-24124 | Medium | 6.1 | 2021-03-18 | Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site Scrip… |
CVE-2021-24123 | High | 7.2 | 2021-03-18 | Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images (such as the ones from Podcast… |
CVE-2021-28133 | Medium | 4.3 | 2021-03-18 | Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attempted to share the p… |
CVE-2021-26237 | High | 7.8 | 2021-03-18 | FastStone Image Viewer <= 7.5 is affected by a user mode write access violation at 0x00402d7d, triggered when a user opens or views a malformed CUR file that i… |
CVE-2021-26235 | High | 7.8 | 2021-03-18 | FastStone Image Viewer <= 7.5 is affected by a user mode write access violation near NULL at 0x005bdfc9, triggered when a user opens or views a malformed CUR f… |
CVE-2021-26234 | High | 7.8 | 2021-03-18 | FastStone Image Viewer <= 7.5 is affected by a user mode write access violation at 0x00402d8a, triggered when a user opens or views a malformed CUR file that i… |
CVE-2021-26233 | High | 7.8 | 2021-03-18 | FastStone Image Viewer <= 7.5 is affected by a user mode write access violation near NULL at 0x005bdfcb, triggered when a user opens or views a malformed CUR f… |
CVE-2021-21627 | High | 8.8 | 2021-03-18 | A cross-site request forgery (CSRF) vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier allows attackers to stop hypervisor domains. |
CVE-2021-21626 | Medium | 4.3 | 2021-03-18 | Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with… |
CVE-2021-21625 | Medium | 4.3 | 2021-03-18 | Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Ov… |
CVE-2021-21624 | Medium | 4.3 | 2021-03-18 | An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permission on nested items to… |
CVE-2021-21623 | Medium | 6.5 | 2021-03-18 | An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to a… |
CVE-2021-26236 | High | 7.8 | 2021-03-18 | FastStone Image Viewer v.<= 7.5 is affected by a Stack-based Buffer Overflow at 0x005BDF49, affecting the CUR file parsing functionality (BITMAPINFOHEADER Stru… |
CVE-2021-23359 | High | 7.5 | 2021-03-18 | This affects all versions of package port-killer. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. T… |
CVE-2021-28420 | Medium | 4.8 | 2021-03-18 | A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and the "from_time" parameter. |
CVE-2021-28419 | High | 7.2 | 2021-03-18 | The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to retrieve all databas… |
CVE-2021-28418 | Medium | 4.8 | 2021-03-18 | A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and the "category" parameter. |
CVE-2021-28417 | Medium | 4.8 | 2021-03-18 | A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and the "search_name" parameter. |
CVE-2021-3141 | High | 7.8 | 2021-03-18 | In Unisys Stealth (core) before 6.0.025.0, the Keycloak password is stored in a recoverable format that might be accessible by a local attacker, who could gain… |
CVE-2021-22848 | High | 7.0 | 2021-03-18 | HGiga MailSherlock contains a SQL Injection. Remote attackers can inject SQL syntax and execute SQL commands in a URL parameter of email pages without privileg… |
CVE-2021-28681 | Medium | 5.3 | 2021-03-18 | Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a… |
CVE-2021-28667 | High | 7.5 | 2021-03-18 | StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk space. This can occur if Python 3.x is used, the… |
CVE-2021-20678 | High | 8.8 | 2021-03-18 | SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via uns… |
CVE-2021-20676 | Medium | 4.3 | 2021-03-18 | M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) versions prior to Ver3.0, type D (DL8-D)… |
CVE-2021-20675 | Medium | 6.5 | 2021-03-18 | M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) versions prior to Ver3.0, type D (DL8-D)… |
CVE-2021-20634 | Medium | 4.3 | 2021-03-18 | Improper access control vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain th… |
CVE-2021-20633 | Medium | 4.3 | 2021-03-18 | Improper access control vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the d… |
CVE-2021-20632 | Medium | 4.3 | 2021-03-18 | Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtai… |
CVE-2021-20631 | Medium | 6.5 | 2021-03-18 | Improper input validation vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attacker to alter the data of Custom App via unspe… |
CVE-2021-20630 | Medium | 4.3 | 2021-03-18 | Improper access control vulnerability in Phone Messages of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtai… |
CVE-2021-20629 | Medium | 6.1 | 2021-03-18 | Cross-site scripting vulnerability in E-mail of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors. |
CVE-2021-20628 | Medium | 6.1 | 2021-03-18 | Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vect… |
CVE-2021-20627 | Medium | 6.1 | 2021-03-18 | Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vect… |
CVE-2021-20626 | Medium | 6.5 | 2021-03-18 | Improper access control vulnerability in Workflow of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and alter the d… |
CVE-2021-20625 | Medium | 4.3 | 2021-03-18 | Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access restriction and alt… |
CVE-2021-20624 | Medium | 6.5 | 2021-03-18 | Improper access control vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access restriction and alter th… |
CVE-2021-28660 | High | 8.8 | 2021-03-17 | rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the ->ssid[] array. NOTE… |
CVE-2021-27292 | High | 7.5 | 2021-03-17 | ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header… |
CVE-2021-27291 | High | 7.5 | 2021-03-17 | In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have expo… |
CVE-2021-22860 | Critical | 9.8 | 2021-03-17 | EIC e-document system does not perform completed identity verification for sorting and filtering personnel data. The vulnerability allows remote attacker to ob… |
CVE-2021-22859 | Critical | 9.8 | 2021-03-17 | The users’ data querying function of EIC e-document system does not filter the special characters which resulted in remote attackers can inject SQL syntax and… |
CVE-2021-28650 | Medium | 5.5 | 2021-03-17 | autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction becau… |
CVE-2021-3344 | High | 8.8 | 2021-03-16 | A privilege escalation flaw was found in OpenShift builder. During build time, credentials outside the build context are automatically mounted into the contain… |
CVE-2021-20218 | High | 7.4 | 2021-03-16 | A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric… |
CVE-2021-3127 | High | 7.5 | 2021-03-16 | NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled. |
CVE-2021-28381 | Critical | 9.8 | 2021-03-16 | The vhs (aka VHS: Fluid ViewHelpers) extension before 5.1.1 for TYPO3 allows SQL injection via isLanguageViewHelper. |
CVE-2021-28380 | Medium | 5.4 | 2021-03-16 | The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend user account. |
CVE-2021-28295 | High | 7.5 | 2021-03-16 | Online Ordering System 1.0 is vulnerable to unauthenticated SQL injection through /onlineordering/GPST/admin/design.php, which may lead to database information… |
CVE-2021-28294 | Critical | 9.8 | 2021-03-16 | Online Ordering System 1.0 is vulnerable to arbitrary file upload through /onlineordering/GPST/store/initiateorder.php, which may lead to remote code execution… |
CVE-2021-27938 | Medium | 6.1 | 2021-03-16 | A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module. A Cross Site Scripting vulnerabilit… |
CVE-2021-25916 | Critical | 9.8 | 2021-03-16 | Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code exec… |
CVE-2021-22887 | Low | 2.3 | 2021-03-16 | A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerab… |
CVE-2021-28543 | Medium | 4.0 | 2021-03-16 | Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in some configurations. This does not affect organi… |
CVE-2021-21193 | High | 8.8 | 2021-03-16 | Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21192 | High | 8.8 | 2021-03-16 | Heap buffer overflow in tab groups in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2021-21191 | High | 8.8 | 2021-03-16 | Use after free in WebRTC in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-27230 | High | 8.8 | 2021-03-15 | ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save() to write to an _… |
CVE-2021-3418 | Medium | 6.4 | 2021-03-15 | If certificates that signed grub are installed into db, grub can be booted directly. It will then boot any kernel without signature validation. The booted kern… |
CVE-2021-26987 | Critical | 9.8 | 2021-03-15 | Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability which whe… |
CVE-2021-24029 | High | 7.5 | 2021-03-15 | A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC sp… |
CVE-2021-20283 | Medium | 4.3 | 2021-03-15 | The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in eac… |