2021 CVEs (page 208)
Page 208 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21164 | Medium | 6.5 | 2021-03-09 | Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2021-21163 | Medium | 6.5 | 2021-03-09 | Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTM… |
CVE-2021-21162 | High | 8.8 | 2021-03-09 | Use after free in WebRTC in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21161 | High | 8.8 | 2021-03-09 | Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2021-21160 | High | 8.8 | 2021-03-09 | Heap buffer overflow in WebAudio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2021-21159 | High | 8.8 | 2021-03-09 | Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2021-20268 | High | 7.8 | 2021-03-09 | An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user running the eBPF script calls dev_map_i… |
CVE-2021-20263 | Low | 3.3 | 2021-03-09 | A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the gue… |
CVE-2021-20262 | Medium | 6.8 | 2021-03-09 | A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. This flaw allows an attacker to take over an account if… |
CVE-2021-20253 | Medium | 6.7 | 2021-03-09 | A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low priv… |
CVE-2021-20243 | Medium | 5.5 | 2021-03-09 | A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavio… |
CVE-2021-20241 | Medium | 5.5 | 2021-03-09 | A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in th… |
CVE-2021-3417 | Medium | 4.9 | 2021-03-09 | An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), if added as a Resourc… |
CVE-2021-27592 | High | 7.8 | 2021-03-09 | When a user opens manipulated Universal 3D (.U3D) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes… |
CVE-2021-27591 | High | 7.8 | 2021-03-09 | When a user opens manipulated Portable Document Format (.PDF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the ap… |
CVE-2021-27590 | High | 7.8 | 2021-03-09 | When a user opens manipulated Tag Image File Format (.TIFF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the appl… |
CVE-2021-27589 | High | 7.8 | 2021-03-09 | When a user opens manipulated Scalable Vector Graphics (.SVG) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the ap… |
CVE-2021-27588 | High | 7.8 | 2021-03-09 | When a user opens manipulated HPGL format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becom… |
CVE-2021-27587 | High | 7.8 | 2021-03-09 | When a user opens manipulated Jupiter Tessellation (.JT) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the applica… |
CVE-2021-27586 | High | 7.8 | 2021-03-09 | When a user opens manipulated Interchange File Format (.IFF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the app… |
CVE-2021-27585 | High | 7.8 | 2021-03-09 | When a user opens manipulated Computer Graphics Metafile (.CGM) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the… |
CVE-2021-27584 | Low | 3.3 | 2021-03-09 | When a user opens manipulated PhotoShop Document (.PSD) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the applicat… |
CVE-2021-25915 | Critical | 9.8 | 2021-03-09 | Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead to remote code execu… |
CVE-2021-21493 | Low | 3.3 | 2021-03-09 | When a user opens manipulated Graphics Interchange Format (.GIF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the… |
CVE-2021-21488 | Medium | 6.5 | 2021-03-09 | Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without ver… |
CVE-2021-21487 | High | 8.8 | 2021-03-09 | SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2021-21486 | High | 8.8 | 2021-03-09 | SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization chec… |
CVE-2021-21484 | Critical | 9.8 | 2021-03-09 | LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthenticated bind. |
CVE-2021-21481 | High | 8.8 | 2021-03-09 | The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might all… |
CVE-2021-21480 | High | 8.8 | 2021-03-09 | SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). An attacker can intercept a request to… |
CVE-2021-20341 | Medium | 5.3 | 2021-03-09 | IBM Cloud Pak for Multicloud Management Monitoring 2.2 returns potentially sensitive information in headers which could lead to further attacks against the sys… |
CVE-2021-28006 | Medium | 6.1 | 2021-03-09 | Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in admin.php through the options parameter. |
CVE-2021-20276 | High | 7.5 | 2021-03-09 | A flaw was found in privoxy before 3.0.32. Invalid memory access with an invalid pattern passed to pcre_compile() may lead to denial of service. |
CVE-2021-20275 | High | 7.5 | 2021-03-09 | A flaw was found in privoxy before 3.0.32. A invalid read of size two may occur in chunked_body_is_complete() leading to denial of service. |
CVE-2021-20274 | High | 7.5 | 2021-03-09 | A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks server misbehaves. |
CVE-2021-20273 | High | 7.5 | 2021-03-09 | A flaw was found in privoxy before 3.0.32. A crash can occur via a crafted CGI request if Privoxy is toggled off. |
CVE-2021-20272 | High | 7.5 | 2021-03-09 | A flaw was found in privoxy before 3.0.32. An assertion failure could be triggered with a crafted CGI request leading to server crash. |
CVE-2021-24033 | Medium | 5.6 | 2021-03-09 | react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This func… |
CVE-2021-21361 | Medium | 5.3 | 2021-03-09 | The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables… |
CVE-2021-21360 | Medium | 5.3 | 2021-03-09 | Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before… |
CVE-2021-21510 | Medium | 6.1 | 2021-03-08 | Dell iDRAC8 versions prior to 2.75.100.75 contain a host header injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnera… |
CVE-2021-21506 | High | 8.8 | 2021-03-08 | PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in its API handler. An un-authtenticated with ISI_PRIV_SYS_SUPPORT and ISI… |
CVE-2021-21503 | High | 7.8 | 2021-03-08 | PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in a command. The Compadmin user could potentially exploit this vulnerabil… |
CVE-2021-22134 | Medium | 4.3 | 2021-03-08 | A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not… |
CVE-2021-21337 | Medium | 5.7 | 2021-03-08 | Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an… |
CVE-2021-21336 | Medium | 6.5 | 2021-03-08 | Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an… |
CVE-2021-21335 | Medium | 5.3 | 2021-03-08 | In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentication can be bypassed using a malformed… |
CVE-2021-21362 | High | 7.7 | 2021-03-08 | MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE… |
CVE-2021-21354 | High | 7.4 | 2021-03-08 | Pollbot is open source software which "frees its human masters from the toilsome task of polling for the state of things during the Firefox release process." I… |
CVE-2021-21329 | High | 8.7 | 2021-03-08 | RATCF is an open-source framework for hosting Cyber-Security Capture the Flag events. In affected versions of RATCF users with multi factor authentication enab… |
CVE-2021-21327 | Medium | 6.8 | 2021-03-08 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI befo… |
CVE-2021-21326 | High | 7.7 | 2021-03-08 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI befo… |
CVE-2021-21325 | Medium | 6.2 | 2021-03-08 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI befo… |
CVE-2021-21324 | Medium | 6.8 | 2021-03-08 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI befo… |
CVE-2021-27222 | Medium | 5.4 | 2021-03-08 | In the "Time in Status" app before 4.13.0 for Jira, remote authenticated attackers can cause Stored XSS. |
CVE-2021-26788 | High | 7.5 | 2021-03-08 | Oryx Embedded CycloneTCP 1.7.6 to 2.0.0, fixed in 2.0.2, is affected by incorrect input validation, which may cause a denial of service (DoS). To exploit the v… |
CVE-2021-23351 | Medium | 4.4 | 2021-03-08 | The package github.com/pires/go-proxyproto before 0.5.0 are vulnerable to Denial of Service (DoS) via the parseVersion1() function. The reader in this package… |
CVE-2021-27365 | High | 7.8 | 2021-03-07 | An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed… |
CVE-2021-27364 | High | 7.1 | 2021-03-07 | An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to… |
CVE-2021-27363 | Medium | 4.4 | 2021-03-07 | An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When a… |
CVE-2021-26294 | High | 7.5 | 2021-03-07 | An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings… |
CVE-2021-26814 | High | 8.8 | 2021-03-06 | Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. An authentic… |
CVE-2021-27581 | Critical | 9.8 | 2021-03-05 | The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter. |
CVE-2021-28042 | High | 7.8 | 2021-03-05 | Deutsche Post Mailoptimizer 4.3 before 2020-11-09 allows Directory Traversal via a crafted ZIP archive to the Upload feature or the MO Connect component. This… |
CVE-2021-3420 | Critical | 9.8 | 2021-03-05 | A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions mEMALIGn, pvALLOc, nano_memalign, nano_v… |
CVE-2021-3377 | Medium | 6.1 | 2021-03-05 | The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL s… |
CVE-2021-28041 | High | 7.1 | 2021-03-05 | ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy op… |
CVE-2021-27257 | Medium | 6.5 | 2021-03-05 | This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R7800 firmware… |
CVE-2021-27256 | High | 8.8 | 2021-03-05 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Although a… |
CVE-2021-27255 | High | 8.8 | 2021-03-05 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Authentication is no… |
CVE-2021-27254 | High | 8.8 | 2021-03-05 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is not required to exp… |
CVE-2021-26705 | Critical | 9.1 | 2021-03-05 | An issue was discovered in SquareBox CatDV Server through 9.2. An attacker can invoke sensitive RMI methods such as getConnections without authentication, the… |
CVE-2021-28040 | High | 7.5 | 2021-03-05 | An issue was discovered in OSSEC 3.6.0. An uncontrolled recursion vulnerability in os_xml.c occurs when a large number of opening and closing XML tags is used… |
CVE-2021-28039 | Medium | 6.5 | 2021-03-05 | An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen. In some less-common configurations, an x86 PV guest OS user can crash a Dom… |
CVE-2021-28038 | Medium | 6.5 | 2021-03-05 | An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such… |
CVE-2021-27099 | Medium | 6.8 | 2021-03-05 | In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node Attestor improperly normalizes the path provided through the agent ID temp… |
CVE-2021-27098 | High | 8.1 | 2021-03-05 | In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy… |
CVE-2021-26971 | Medium | 6.3 | 2021-03-05 | A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabili… |
CVE-2021-26970 | Medium | 6.3 | 2021-03-05 | A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabili… |
CVE-2021-26969 | Medium | 6.5 | 2021-03-05 | A remote authenticated authenticated xml external entity (xxe) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0… |
CVE-2021-26968 | Medium | 4.8 | 2021-03-05 | A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vul… |
CVE-2021-26967 | Medium | 6.1 | 2021-03-05 | A remote reflected cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability… |
CVE-2021-26966 | Medium | 6.5 | 2021-03-05 | A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Multiple vulnerabilities… |
CVE-2021-26965 | Medium | 6.5 | 2021-03-05 | A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Multiple vulnerabilities… |
CVE-2021-26964 | High | 7.1 | 2021-03-05 | A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in… |
CVE-2021-26963 | High | 7.2 | 2021-03-05 | A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabili… |
CVE-2021-21725 | Medium | 5.7 | 2021-03-05 | A ZTE product has an information leak vulnerability. An attacker with higher authority can go beyond their authority to access files in other directories by pe… |
CVE-2021-26962 | High | 7.2 | 2021-03-05 | A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabili… |
CVE-2021-26961 | High | 8.8 | 2021-03-05 | A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A v… |
CVE-2021-26960 | High | 8.8 | 2021-03-05 | A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A v… |
CVE-2021-28026 | High | 7.8 | 2021-03-05 | jpeg-xl v0.3.2 is affected by a heap buffer overflow in /lib/jxl/coeff_order.cc ReadPermutation. When decoding a malicous jxl file using djxl, an attacker can… |
CVE-2021-27907 | Medium | 5.4 | 2021-03-05 | Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing… |
CVE-2021-20665 | Medium | 6.1 | 2021-03-05 | Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced… |
CVE-2021-20664 | Medium | 6.1 | 2021-03-05 | Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705… |
CVE-2021-20663 | Medium | 6.1 | 2021-03-05 | Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r… |
CVE-2021-28037 | Critical | 9.8 | 2021-03-05 | An issue was discovered in the internment crate before 0.4.2 for Rust. There is a data race that can cause memory corruption because of the unconditional imple… |
CVE-2021-28036 | High | 7.5 | 2021-03-05 | An issue was discovered in the quinn crate before 0.7.0 for Rust. It may have invalid memory access for certain versions of the standard library because it rel… |
CVE-2021-28035 | Critical | 9.8 | 2021-03-05 | An issue was discovered in the stack_dst crate before 0.6.1 for Rust. Because of the push_inner behavior, a drop of uninitialized memory can occur upon a val.c… |
CVE-2021-28034 | Critical | 9.8 | 2021-03-05 | An issue was discovered in the stack_dst crate before 0.6.1 for Rust. Because of the push_inner behavior, a double free can occur upon a val.clone() panic. |
CVE-2021-28033 | Critical | 9.8 | 2021-03-05 | An issue was discovered in the byte_struct crate before 0.6.1 for Rust. There can be a drop of uninitialized memory if a certain deserialization method panics. |