2021 CVEs (page 207)
Page 207 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-20205 | Medium | 6.5 | 2021-03-10 | Libjpeg-turbo versions 2.0.91 and 2.0.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted GIF image. |
CVE-2021-0465 | High | 7.8 | 2021-03-10 | In GenerateFaceMask of face.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with… |
CVE-2021-0464 | High | 7.8 | 2021-03-10 | In sound_trigger_event_alloc of platform.h, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privi… |
CVE-2021-0463 | Medium | 5.5 | 2021-03-10 | In convertToHidl of convert.cpp, there is a possible out of bounds read due to uninitialized data from ReturnFrameworkMessage. This could lead to local informa… |
CVE-2021-0462 | Medium | 6.7 | 2021-03-10 | In the NXP NFC firmware, there is a possible insecure firmware update due to a logic error. This could lead to local escalation of privilege with System execut… |
CVE-2021-0461 | Medium | 6.7 | 2021-03-10 | In iaxxx_core_sensor_change_state of iaxxx-module.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation… |
CVE-2021-0460 | Medium | 4.4 | 2021-03-10 | In the FingerTipS touch screen driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with… |
CVE-2021-0459 | Medium | 4.4 | 2021-03-10 | In fts_driver_test_write of fts_proc.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure w… |
CVE-2021-0458 | Medium | 4.4 | 2021-03-10 | In the FingerTipS touch screen driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with… |
CVE-2021-0457 | Medium | 6.7 | 2021-03-10 | In the FingerTipS touch screen driver, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege… |
CVE-2021-0456 | Medium | 6.7 | 2021-03-10 | In the Citadel chip firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with Syst… |
CVE-2021-0455 | Medium | 6.7 | 2021-03-10 | In the Citadel chip firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with Syst… |
CVE-2021-0454 | Medium | 6.7 | 2021-03-10 | In the Citadel chip firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with Syst… |
CVE-2021-0453 | Medium | 4.4 | 2021-03-10 | In the Titan-M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with Sy… |
CVE-2021-0452 | Medium | 4.4 | 2021-03-10 | In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with Sy… |
CVE-2021-0451 | Medium | 4.4 | 2021-03-10 | In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with Sy… |
CVE-2021-0450 | Medium | 4.4 | 2021-03-10 | In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with Sy… |
CVE-2021-0449 | Medium | 4.4 | 2021-03-10 | In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with Sy… |
CVE-2021-0389 | High | 7.8 | 2021-03-10 | In setNightModeActivated of UiModeManagerService.java, there is a missing permission check. This could lead to local escalation of privilege with no additional… |
CVE-2021-0388 | High | 7.8 | 2021-03-10 | In onReceive of ImsPhoneCallTracker.java, there is a possible misattribution of data usage due to an incorrect broadcast handler. This could lead to local esca… |
CVE-2021-0387 | Medium | 6.4 | 2021-03-10 | In FindQuotaDeviceForUuid of QuotaUtils.cpp, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with… |
CVE-2021-0386 | High | 7.8 | 2021-03-10 | In onCreate of UsbConfirmActivity, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of privilege wit… |
CVE-2021-0385 | High | 7.8 | 2021-03-10 | In createConnectToAvailableNetworkNotification of ConnectToNetworkNotificationBuilder.java, there is a possible connection to untrusted WiFi networks due to no… |
CVE-2021-0383 | High | 7.8 | 2021-03-10 | In done of CaptivePortalLoginActivity.java, there is a confused deputy. This could lead to local escalation of privilege in carrier settings with no additional… |
CVE-2021-0382 | Medium | 5.5 | 2021-03-10 | In checkSlicePermission of SliceManagerService.java, there is a possible resource exposure due to an incorrect permission check. This could lead to local infor… |
CVE-2021-0381 | Medium | 5.5 | 2021-03-10 | In updateNotifications of DeviceStorageMonitorService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local info… |
CVE-2021-0380 | High | 7.8 | 2021-03-10 | In onReceive of DcTracker.java, there is a possible way to trigger a provisioning URL and modify other telephony settings due to a missing permission check. Th… |
CVE-2021-0379 | Medium | 6.5 | 2021-03-10 | In getUpTo17bits of pvmp3_getbits.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure w… |
CVE-2021-24030 | Critical | 9.8 | 2021-03-10 | The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable. That allows a malicious URL to… |
CVE-2021-24025 | Critical | 9.8 | 2021-03-10 | Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow leading t… |
CVE-2021-20265 | Medium | 5.5 | 2021-03-10 | A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending. This flaw allows an… |
CVE-2021-0399 | High | 7.8 | 2021-03-10 | In qtaguid_untag of xt_qtaguid.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no addit… |
CVE-2021-0398 | High | 7.8 | 2021-03-10 | In bindServiceLocked of ActiveServices.java, there is a possible foreground service launch due to a confused deputy. This could lead to local escalation of pri… |
CVE-2021-0397 | Critical | 9.8 | 2021-03-10 | In sdp_copy_raw_data of sdp_discovery.cc, there is a possible system compromise due to a double free. This could lead to remote code execution with no addition… |
CVE-2021-0396 | Critical | 9.8 | 2021-03-10 | In Builtins::Generate_ArgumentsAdaptorTrampoline of builtins-arm.cc and related files, there is a possible out of bounds write due to an incorrect bounds check… |
CVE-2021-0395 | High | 7.8 | 2021-03-10 | In StopServicesAndLogViolations of reboot.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege wi… |
CVE-2021-0394 | Medium | 5.5 | 2021-03-10 | In android_os_Parcel_readString8 of android_os_Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local infor… |
CVE-2021-0393 | High | 7.8 | 2021-03-10 | In Scanner::LiteralBuffer::NewCapacity of scanner.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execut… |
CVE-2021-0392 | High | 7.8 | 2021-03-10 | In main of main.cpp, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with User execution privilege… |
CVE-2021-0391 | High | 7.8 | 2021-03-10 | In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, without permissions, due to a tapjacking/over… |
CVE-2021-0390 | High | 7.8 | 2021-03-10 | In various methods of WifiNetworkSuggestionsManager.java, there is a possible modification of suggested networks due to a missing permission check. This could… |
CVE-2021-0378 | Medium | 6.5 | 2021-03-10 | In getNbits of pvmp3_getbits.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with n… |
CVE-2021-0377 | Medium | 5.5 | 2021-03-10 | In DeltaPerformer::Write of delta_performer.cc, there is a possible use of untrusted input due to improper input validation. This could lead to a local bypass… |
CVE-2021-0376 | High | 7.8 | 2021-03-10 | In checkUriPermission and related functions of MediaProvider.java, there is a possible way to access external files due to a permissions bypass. This could lea… |
CVE-2021-0375 | Medium | 5.5 | 2021-03-10 | In onPackageModified of VoiceInteractionManagerService.java, there is a possible change of default applications due to an insecure default value. This could le… |
CVE-2021-0374 | Medium | 4.4 | 2021-03-10 | In BnAudioPolicyService::onTransact of IAudioPolicyService.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local… |
CVE-2021-0372 | High | 7.8 | 2021-03-10 | In getMediaOutputSliceAction of RemoteMediaSlice.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalatio… |
CVE-2021-0371 | Medium | 6.7 | 2021-03-10 | In nci_proc_rf_management_ntf of nci_hrcv.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of priv… |
CVE-2021-0370 | Medium | 6.7 | 2021-03-10 | In Write of NxpMfcReader.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege in the NFC… |
CVE-2021-0369 | High | 7.8 | 2021-03-10 | In CrossProfileAppsServiceImpl.java, there is the possibility of an application's INTERACT_ACROSS_PROFILES grant state not displaying properly in the setting U… |
CVE-2021-0368 | Medium | 6.5 | 2021-03-10 | In oggpack_look of bitwise.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no ad… |
CVE-2021-28122 | Critical | 9.8 | 2021-03-10 | A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP… |
CVE-2021-21491 | Medium | 6.1 | 2021-03-10 | SAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allow an attacker to redi… |
CVE-2021-3224 | Medium | 5.4 | 2021-03-10 | A stored cross-site scripting (XSS) vulnerability in cszcms 1.2.9 exists in /admin/pages/new via the content parameter. |
CVE-2021-28007 | Medium | 6.1 | 2021-03-10 | Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in register.php through the name parameter. |
CVE-2021-20673 | Medium | 4.8 | 2021-03-10 | Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote authenticated attackers to inject a… |
CVE-2021-20672 | Medium | 6.1 | 2021-03-10 | Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 all… |
CVE-2021-20671 | High | 7.2 | 2021-03-10 | Invalid file validation on the upload feature in GROWI versions v4.2.2 allows a remote attacker with administrative privilege to overwrite the files on the ser… |
CVE-2021-20670 | High | 7.5 | 2021-03-10 | Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to read the user's personal information and… |
CVE-2021-20669 | Medium | 4.7 | 2021-03-10 | Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read and/or delete an arbitrary path via a sp… |
CVE-2021-20668 | Low | 2.7 | 2021-03-10 | Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path via a specially crafte… |
CVE-2021-20667 | Medium | 5.4 | 2021-03-10 | Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and earlier allows remote auth… |
CVE-2021-3310 | High | 7.8 | 2021-03-10 | Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can lead to code execution and information… |
CVE-2021-28119 | Critical | 9.8 | 2021-03-09 | Twinkle Tray (aka twinkle-tray) through 1.13.3 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcR… |
CVE-2021-28116 | Low | 3.7 | 2021-03-09 | Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This ca… |
CVE-2021-28115 | Medium | 6.1 | 2021-03-09 | The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS via the comment field of feedback during an edit operation. |
CVE-2021-23273 | High | 8.0 | 2021-03-09 | The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, a… |
CVE-2021-3411 | Medium | 6.7 | 2021-03-09 | A flaw was found in the Linux kernel in versions prior to 5.10. A violation of memory access was found while detecting a padding of int3 in the linking state… |
CVE-2021-21300 | High | 8.0 | 2021-03-09 | Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as f… |
CVE-2021-20255 | Medium | 5.5 | 2021-03-09 | A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while processing controlle… |
CVE-2021-23353 | Medium | 5.9 | 2021-03-09 | This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function. |
CVE-2021-23352 | High | 8.6 | 2021-03-09 | This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .s… |
CVE-2021-21295 | Medium | 5.9 | 2021-03-09 | Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clie… |
CVE-2021-20246 | Medium | 5.5 | 2021-03-09 | A flaw was found in ImageMagick in MagickCore/resample.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behav… |
CVE-2021-20245 | Medium | 5.5 | 2021-03-09 | A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in t… |
CVE-2021-20244 | Medium | 5.5 | 2021-03-09 | A flaw was found in ImageMagick in MagickCore/visual-effects.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined… |
CVE-2021-21369 | Medium | 6.5 | 2021-03-09 | Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerabilit… |
CVE-2021-21190 | High | 8.8 | 2021-03-09 | Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2021-21189 | Medium | 4.3 | 2021-03-09 | Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HT… |
CVE-2021-21188 | High | 8.8 | 2021-03-09 | Use after free in Blink in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21187 | Medium | 4.3 | 2021-03-09 | Insufficient data validation in URL formatting in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to perform domain spoofing via IDN homographs v… |
CVE-2021-21186 | Medium | 4.3 | 2021-03-09 | Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an attacker who convinced the user to scan a QR code to by… |
CVE-2021-21185 | Medium | 4.3 | 2021-03-09 | Insufficient policy enforcement in extensions in Google Chrome prior to 89.0.4389.72 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2021-21184 | Medium | 4.3 | 2021-03-09 | Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2021-21183 | Medium | 4.3 | 2021-03-09 | Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2021-21182 | Medium | 6.5 | 2021-03-09 | Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to byp… |
CVE-2021-21181 | Medium | 6.5 | 2021-03-09 | Side-channel information leakage in autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from… |
CVE-2021-21180 | High | 8.8 | 2021-03-09 | Use after free in tab search in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21179 | High | 8.8 | 2021-03-09 | Use after free in Network Internals in Google Chrome on Linux prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a craf… |
CVE-2021-21178 | Medium | 6.5 | 2021-03-09 | Inappropriate implementation in Compositing in Google Chrome on Linux and Windows prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the… |
CVE-2021-21177 | Medium | 6.5 | 2021-03-09 | Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from p… |
CVE-2021-21176 | Medium | 6.5 | 2021-03-09 | Inappropriate implementation in full screen mode in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar… |
CVE-2021-21175 | Medium | 6.5 | 2021-03-09 | Inappropriate implementation in Site isolation in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pa… |
CVE-2021-21174 | High | 8.8 | 2021-03-09 | Inappropriate implementation in Referrer in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2021-21173 | Medium | 6.5 | 2021-03-09 | Side-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2021-21172 | High | 8.1 | 2021-03-09 | Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89.0.4389.72 allowed a remote attacker to bypass filesystem restriction… |
CVE-2021-21171 | Medium | 6.5 | 2021-03-09 | Incorrect security UI in TabStrip and Navigation in Google Chrome on Android prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the Omnib… |
CVE-2021-21170 | Medium | 6.5 | 2021-03-09 | Incorrect security UI in Loader in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to spoof the contents… |
CVE-2021-21169 | High | 8.8 | 2021-03-09 | Out of bounds memory access in V8 in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially perform out of bounds memory access via a cra… |
CVE-2021-21168 | Medium | 6.5 | 2021-03-09 | Insufficient policy enforcement in appcache in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from p… |