2021 CVEs (page 205)
Page 205 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-20282 | Medium | 5.3 | 2021-03-15 | When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5… |
CVE-2021-20281 | Medium | 5.3 | 2021-03-15 | It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3… |
CVE-2021-20280 | Medium | 5.4 | 2021-03-15 | Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. |
CVE-2021-20279 | Medium | 5.4 | 2021-03-15 | The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. |
CVE-2021-3150 | Medium | 6.1 | 2021-03-15 | A cross-site scripting (XSS) vulnerability on the Delete Personal Data page in Cryptshare Server before 4.8.0 allows an attacker to inject arbitrary web script… |
CVE-2021-23879 | Medium | 6.7 | 2021-03-15 | Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrators to execute arbitrary code, with hig… |
CVE-2021-28363 | Medium | 6.5 | 2021-03-15 | The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to… |
CVE-2021-27949 | Medium | 6.1 | 2021-03-15 | Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools. |
CVE-2021-27948 | High | 7.2 | 2021-03-15 | SQL Injection vulnerability in MyBB before 1.8.26 via User Groups. (issue 3 of 3). |
CVE-2021-27947 | High | 7.2 | 2021-03-15 | SQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management. (issue 2 of 3). |
CVE-2021-27946 | High | 8.8 | 2021-03-15 | SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. (issue 1 of 3). |
CVE-2021-27890 | High | 8.8 | 2021-03-15 | SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files. |
CVE-2021-22191 | Medium | 6.3 | 2021-03-15 | Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet injection or crafted capture file. |
CVE-2021-20286 | Low | 2.7 | 2021-03-15 | A flaw was found in libnbd 1.7.3. An assertion failure in nbd_unlocked_opt_go in ilb/opt.c may lead to denial of service. |
CVE-2021-27889 | Medium | 6.1 | 2021-03-15 | Cross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages. |
CVE-2021-27817 | Critical | 9.8 | 2021-03-15 | A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is upload… |
CVE-2021-27695 | Medium | 6.1 | 2021-03-15 | Multiple stored cross-site scripting (XSS) vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbitrary web script or HTML via any "Add" s… |
CVE-2021-27381 | High | 7.8 | 2021-03-15 | A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3). Affected applications lack… |
CVE-2021-27380 | High | 7.8 | 2021-03-15 | A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP4). Affected applications lack… |
CVE-2021-25676 | High | 7.5 | 2021-03-15 | A vulnerability has been identified in RUGGEDCOM RM1224 (V6.3), SCALANCE M-800 (V6.3), SCALANCE S615 (V6.3), SCALANCE SC-600 (All Versions >= V2.1 and < V2.1.3… |
CVE-2021-25675 | Medium | 5.5 | 2021-03-15 | A vulnerability has been identified in SIMATIC S7-PLCSIM V5.4 (All versions). An attacker with local access to the system could cause a Denial-of-Service condi… |
CVE-2021-25674 | Medium | 5.5 | 2021-03-15 | A vulnerability has been identified in SIMATIC S7-PLCSIM V5.4 (All versions). An attacker with local access to the system could cause a Denial-of-Service condi… |
CVE-2021-25673 | Medium | 5.5 | 2021-03-15 | A vulnerability has been identified in SIMATIC S7-PLCSIM V5.4 (All versions). An attacker with local access to the system could cause a Denial-of-Service condi… |
CVE-2021-25672 | High | 8.8 | 2021-03-15 | A vulnerability has been identified in Mendix Forgot Password Appstore module (All Versions < V3.2.1). The Forgot Password Marketplace module does not properly… |
CVE-2021-25667 | High | 8.8 | 2021-03-15 | A vulnerability has been identified in RUGGEDCOM RM1224 (All versions >= V4.3 and < V6.4), SCALANCE M-800 (All versions >= V4.3 and < V6.4), SCALANCE S615 (All… |
CVE-2021-23357 | Low | 3.3 | 2021-03-15 | All versions of package github.com/tyktechnologies/tyk/gateway are vulnerable to Directory Traversal via the handleAddOrUpdateApi function. This function is ab… |
CVE-2021-23356 | Medium | 5.6 | 2021-03-15 | This affects all versions of package kill-process-by-name. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary co… |
CVE-2021-23355 | Medium | 5.6 | 2021-03-15 | This affects all versions of package ps-kill. If (attacker-controlled) user input is given to the kill function, it is possible for an attacker to execute arbi… |
CVE-2021-3167 | Medium | 6.5 | 2021-03-15 | In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs. |
CVE-2021-20440 | Medium | 4.3 | 2021-03-15 | IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member registration to the intended recepient. An attacker who is a valid user i… |
CVE-2021-27893 | High | 7.0 | 2021-03-15 | SSH Tectia Client and Server before 6.4.19 on Windows allow local privilege escalation in nonstandard conditions. ConnectSecure on Windows is affected. |
CVE-2021-27892 | High | 7.8 | 2021-03-15 | SSH Tectia Client and Server before 6.4.19 on Windows allow local privilege escalation. ConnectSecure on Windows is affected. |
CVE-2021-27891 | High | 8.8 | 2021-03-15 | SSH Tectia Client and Server before 6.4.19 on Windows have weak key generation. ConnectSecure on Windows is affected. |
CVE-2021-26924 | Medium | 6.1 | 2021-03-15 | An issue was discovered in Argo CD before 1.8.4. Browser XSS protection is not activated due to the missing XSS protection header. |
CVE-2021-26923 | High | 7.5 | 2021-03-15 | An issue was discovered in Argo CD before 1.8.4. Accessing the endpoint /api/version leaks internal information for the system, and this endpoint is not protec… |
CVE-2021-27208 | Medium | 6.8 | 2021-03-15 | When booting a Zync-7000 SOC device from nand flash memory, the nand driver in the ROM does not validate the inputs when reading in any parameters in the nand’… |
CVE-2021-20179 | High | 8.1 | 2021-03-15 | A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again… |
CVE-2021-27576 | High | 7.5 | 2021-03-15 | If was found that the NetTest web service can be used to overload the bandwidth of a Apache OpenMeetings server. This issue was addressed in Apache OpenMeeting… |
CVE-2021-28379 | High | 8.8 | 2021-03-15 | web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin. |
CVE-2021-28378 | Low | 3.7 | 2021-03-15 | Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations. |
CVE-2021-28375 | High | 7.8 | 2021-03-15 | An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending k… |
CVE-2021-28374 | High | 7.5 | 2021-03-15 | The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak permissions, allowi… |
CVE-2021-28373 | High | 7.5 | 2021-03-13 | The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) before 2021-03-12 allows an attacker to log in via the OTP code without a valid password. NOTE: this iss… |
CVE-2021-28361 | High | 7.5 | 2021-03-13 | An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is exp… |
CVE-2021-20018 | Medium | 4.9 | 2021-03-13 | A post-authenticated vulnerability in SonicWall SMA100 allows an attacker to export the configuration file to the specified email address. This vulnerability i… |
CVE-2021-20017 | High | 8.8 | 2021-03-13 | A post-authenticated command injection vulnerability in SonicWall SMA100 allows an authenticated attacker to execute OS commands as a 'nobody' user. This vulne… |
CVE-2021-28162 | Medium | 6.1 | 2021-03-12 | In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run. |
CVE-2021-28161 | Medium | 6.1 | 2021-03-12 | In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected. |
CVE-2021-28092 | High | 7.5 | 2021-03-12 | The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker… |
CVE-2021-27290 | High | 7.5 | 2021-03-12 | ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely… |
CVE-2021-21518 | High | 7.8 | 2021-03-12 | Dell SupportAssist Client for Consumer PCs versions 3.7.x, 3.6.x, 3.4.x, 3.3.x, Dell SupportAssist Client for Business PCs versions 2.0.x, 2.1.x, 2.2.x, and De… |
CVE-2021-21726 | Low | 2.3 | 2021-03-12 | Some ZTE products have an input verification vulnerability in the diagnostic function interface. Due to insufficient verification of some parameters input by u… |
CVE-2021-21085 | High | 7.8 | 2021-03-12 | Adobe Connect version 11.0.7 (and earlier) is affected by an Input Validation vulnerability in the export feature. An attacker could exploit this vulnerability… |
CVE-2021-21082 | High | 7.8 | 2021-03-12 | Adobe Photoshop versions 21.2.5 (and earlier) and 22.2 (and earlier) are affected by a Memory Corruption vulnerability when parsing a specially crafted file. A… |
CVE-2021-21080 | Medium | 6.1 | 2021-03-12 | Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to… |
CVE-2021-21079 | Medium | 6.1 | 2021-03-12 | Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to… |
CVE-2021-21078 | Medium | 6.5 | 2021-03-12 | Adobe Creative Cloud Desktop Application version 5.3 (and earlier) is affected by an Unquoted Service Path vulnerability in CCXProcess that could allow an atta… |
CVE-2021-21077 | High | 7.8 | 2021-03-12 | Adobe Animate version 21.0.3 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability. An unauthenticated attacker could leverage this vulnerabi… |
CVE-2021-21076 | High | 7.1 | 2021-03-12 | Adobe Animate version 21.0.3 (and earlier) is affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to… |
CVE-2021-21075 | High | 7.1 | 2021-03-12 | Adobe Animate version 21.0.3 (and earlier) is affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to… |
CVE-2021-21074 | High | 7.1 | 2021-03-12 | Adobe Animate version 21.0.3 (and earlier) is affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to… |
CVE-2021-21073 | High | 7.1 | 2021-03-12 | Adobe Animate version 21.0.3 (and earlier) is affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to… |
CVE-2021-21072 | High | 7.1 | 2021-03-12 | Adobe Animate version 21.0.3 (and earlier) is affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to… |
CVE-2021-21071 | High | 7.8 | 2021-03-12 | Adobe Animate version 21.0.3 (and earlier) is affected by a Memory Corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to a… |
CVE-2021-21069 | High | 7.8 | 2021-03-12 | Adobe Creative Cloud Desktop Application version 5.3 (and earlier) is affected by a local privilege escalation vulnerability that could allow an attacker to ca… |
CVE-2021-21068 | Medium | 6.1 | 2021-03-12 | Adobe Creative Cloud Desktop Application version 5.3 (and earlier) is affected by a file handling vulnerability that could allow an attacker to cause arbitrary… |
CVE-2021-21067 | High | 7.8 | 2021-03-12 | Adobe Photoshop versions 21.2.5 (and earlier) and 22.2 (and earlier) are affected by an Out-of-bounds Write vulnerability in the CoolType library. An unauthent… |
CVE-2021-21056 | High | 7.8 | 2021-03-12 | Adobe Framemaker version 2020.0.1 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated at… |
CVE-2021-20232 | Critical | 9.8 | 2021-03-12 | A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential conseque… |
CVE-2021-20231 | Critical | 9.8 | 2021-03-12 | A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences. |
CVE-2021-21379 | High | 7.7 | 2021-03-12 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the `{{wikimac… |
CVE-2021-21368 | Medium | 6.7 | 2021-03-12 | msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a "Prototype Poisoning" vulne… |
CVE-2021-21367 | Medium | 6.1 | 2021-03-12 | Switchboard Bluetooth Plug for elementary OS from version 2.3.0 and before version version 2.3.5 has an incorrect authorization vulnerability. When the Bluetoo… |
CVE-2021-21366 | Medium | 4.3 | 2021-03-12 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly pres… |
CVE-2021-28302 | High | 7.5 | 2021-03-12 | A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser_parseDocument() function. ixmlNode_free() will release a chi… |
CVE-2021-23354 | Medium | 5.3 | 2021-03-12 | The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]… |
CVE-2021-28308 | Critical | 9.1 | 2021-03-12 | An issue was discovered in the fltk crate before 0.15.3 for Rust. There is an out-of bounds read because the pixmap constructor lacks pixmap input validation. |
CVE-2021-28307 | High | 7.5 | 2021-03-12 | An issue was discovered in the fltk crate before 0.15.3 for Rust. There is a NULL pointer dereference during attempted use of a non-raster image for a window i… |
CVE-2021-28306 | High | 7.5 | 2021-03-12 | An issue was discovered in the fltk crate before 0.15.3 for Rust. There is a NULL pointer dereference during attempted use of a multi label type if the image i… |
CVE-2021-28305 | Critical | 9.8 | 2021-03-12 | An issue was discovered in the diesel crate before 1.4.6 for Rust. There is a use-after-free in the SQLite backend because the semantics of sqlite3_column_name… |
CVE-2021-27647 | Critical | 9.8 | 2021-03-12 | Out-of-bounds Read vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbi… |
CVE-2021-27646 | Critical | 9.8 | 2021-03-12 | Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrar… |
CVE-2021-26569 | Critical | 9.8 | 2021-03-12 | Race Condition within a Thread vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to… |
CVE-2021-20674 | High | 7.8 | 2021-03-12 | Untrusted search path vulnerability in Installer of MagicConnect Client program distributed before 2021 March 1 allows an attacker to gain privileges and via a… |
CVE-2021-28154 | Critical | 9.1 | 2021-03-11 | Camunda Modeler (aka camunda-modeler) through 4.6.0 allows arbitrary file access. A remote attacker may send a crafted IPC message to the exposed vulnerable ip… |
CVE-2021-28153 | Medium | 5.3 | 2021-03-11 | An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling… |
CVE-2021-28143 | High | 8.0 | 2021-03-11 | /jsonrpc on D-Link DIR-841 3.03 and 3.04 devices allows authenticated command injection via ping, ping6, or traceroute (under System Tools). |
CVE-2021-22714 | Critical | 9.8 | 2021-03-11 | A CWE-119:Improper restriction of operations within the bounds of a memory buffer vulnerability exists in PowerLogic ION7400, PM8000 and ION9000 (All versions… |
CVE-2021-22713 | High | 7.5 | 2021-03-11 | A CWE-119:Improper restriction of operations within the bounds of a memory buffer vulnerability exists in PowerLogic ION8650, ION8800, ION7650, ION7700/73xx, a… |
CVE-2021-22712 | High | 7.8 | 2021-03-11 | A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition… |
CVE-2021-22711 | High | 7.8 | 2021-03-11 | A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition… |
CVE-2021-22710 | High | 7.8 | 2021-03-11 | A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition… |
CVE-2021-22709 | High | 7.8 | 2021-03-11 | A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition… |
CVE-2021-20261 | Medium | 6.4 | 2021-03-11 | A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software. The impact of this issue is lessened by the… |
CVE-2021-28144 | High | 8.8 | 2021-03-11 | prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root context because SetVi… |
CVE-2021-28141 | Critical | 9.8 | 2021-03-11 | An issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. It allows unauthorized access to MicrosoftAjax.js through the Telerik.Web.UI.WebRes… |
CVE-2021-28088 | Medium | 5.4 | 2021-03-11 | Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbitrary web script or HTML para… |
CVE-2021-27679 | Medium | 5.4 | 2021-03-11 | Cross-site scripting (XSS) vulnerability in Navigation in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name. |
CVE-2021-27678 | Medium | 5.4 | 2021-03-11 | Cross-site scripting (XSS) vulnerability in Snippets in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name. |
CVE-2021-27677 | Medium | 5.4 | 2021-03-11 | Cross-site scripting (XSS) vulnerability in Galleries in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name. |