2021 CVEs (page 209)
Page 209 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-28032 | Critical | 9.8 | 2021-03-05 | An issue was discovered in the nano_arena crate before 0.5.2 for Rust. There is an aliasing violation in split_at because two mutable references can exist for… |
CVE-2021-28031 | Critical | 9.8 | 2021-03-05 | An issue was discovered in the scratchpad crate before 1.3.1 for Rust. The move_elements function can have a double-free upon a panic in a user-provided f func… |
CVE-2021-28030 | High | 7.5 | 2021-03-05 | An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Rea… |
CVE-2021-28029 | High | 7.5 | 2021-03-05 | An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read the contents of uninitialized memory loca… |
CVE-2021-28028 | Critical | 9.8 | 2021-03-05 | An issue was discovered in the toodee crate before 0.3.0 for Rust. Row insertion can cause a double free upon an iterator panic. |
CVE-2021-28027 | Critical | 9.8 | 2021-03-05 | An issue was discovered in the bam crate before 0.1.3 for Rust. There is an integer underflow and out-of-bounds write during the loading of a bgzip block. |
CVE-2021-25313 | High | 7.1 | 2021-03-05 | A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rancher allows remote attackers to execute JavaScript v… |
CVE-2021-27965 | Critical | 9.8 | 2021-03-05 | The MsIo64.sys driver before 1.1.19.1016 in MSI Dragon Center before 2.0.98.0 has a buffer overflow that allows privilege escalation via a crafted 0x80102040… |
CVE-2021-27964 | Critical | 9.8 | 2021-03-05 | SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Config/SaveUploadedHotspotLogoFile without… |
CVE-2021-27963 | High | 8.2 | 2021-03-05 | SonLogger before 6.4.1 is affected by user creation with any user permissions profile (e.g., SuperAdmin). An anonymous user can send a POST request to /User/sa… |
CVE-2021-27314 | Critical | 9.8 | 2021-03-05 | SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via username parameter at login… |
CVE-2021-3404 | High | 7.8 | 2021-03-04 | In ytnef 1.9.3, the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potentially code execution) due to a heap buffer… |
CVE-2021-3403 | High | 7.8 | 2021-03-04 | In ytnef 1.9.3, the TNEFSubjectHandler function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potentially code execution) due to a d… |
CVE-2021-25348 | Low | 2.1 | 2021-03-04 | Improper permission grant check in Samsung Internet prior to version 13.0.1.60 allows access to files in internal storage without authorized STORAGE permission. |
CVE-2021-25347 | Medium | 5.3 | 2021-03-04 | Hijacking vulnerability in Samsung Email application version prior to SMR Feb-2021 Release 1 allows attackers to intercept when the provider is executed. |
CVE-2021-25346 | High | 7.1 | 2021-03-04 | A possible arbitrary memory overwrite vulnerabilities in quram library version prior to SMR Jan-2021 Release 1 allow arbitrary code execution. |
CVE-2021-25345 | Medium | 4.0 | 2021-03-04 | Graphic format mismatch while converting video format in hwcomposer prior to SMR Mar-2021 Release 1 results in kernel panic due to unsupported format. |
CVE-2021-25344 | Medium | 6.2 | 2021-03-04 | Missing permission check in knox_custom service prior to SMR Mar-2021 Release 1 allows attackers to gain access to device's serial number without permission. |
CVE-2021-25343 | Medium | 4.0 | 2021-03-04 | Calling of non-existent provider in Samsung Members prior to version 2.4.81.13 (in Android O(8.1) and below) and 3.8.00.13 (in Android P(9.0) and above) allows… |
CVE-2021-25342 | Medium | 4.0 | 2021-03-04 | Calling of non-existent provider in SMP sdk prior to version 3.0.9 allows unauthorized actions including denial of service attack by hijacking the provider. |
CVE-2021-25341 | Medium | 4.0 | 2021-03-04 | Calling of non-existent provider in S Assistant prior to version 6.5.01.22 allows unauthorized actions including denial of service attack by hijacking the prov… |
CVE-2021-25340 | Medium | 5.1 | 2021-03-04 | Improper access control vulnerability in Samsung keyboard version prior to SMR Feb-2021 Release 1 allows physically proximate attackers to change in arbitrary… |
CVE-2021-26989 | Medium | 6.5 | 2021-03-04 | Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P9 and 9.8 are susceptible to a vulnerability which could allow a remote authenticated attack… |
CVE-2021-26988 | Low | 3.5 | 2021-03-04 | Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P8 and 9.8 are susceptible to a vulnerability which could allow unauthorized tenant users to… |
CVE-2021-26293 | Critical | 9.8 | 2021-03-04 | An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new fil… |
CVE-2021-25339 | Medium | 4.4 | 2021-03-04 | Improper address validation in HArx in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kernel, to corrupt EL2 me… |
CVE-2021-25338 | Medium | 4.4 | 2021-03-04 | Improper memory access control in RKP in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kernel, to write certai… |
CVE-2021-25337 | Medium | 4.4 | 2021-03-04 | Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain l… |
CVE-2021-25336 | Low | 2.8 | 2021-03-04 | Improper access control in NotificationManagerService in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to acquire notifi… |
CVE-2021-25335 | Low | 2.5 | 2021-03-04 | Improper lockscreen status check in cocktailbar service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows unauthenticated users to access hidden… |
CVE-2021-25334 | Medium | 5.5 | 2021-03-04 | Improper input check in wallpaper service in Samsung mobile devices prior to SMR Feb-2021 Release 1 allows untrusted application to cause permanent denial of s… |
CVE-2021-25333 | Low | 3.2 | 2021-03-04 | Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscreen via scanning spe… |
CVE-2021-25332 | Low | 3.2 | 2021-03-04 | Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to contacts information over the lockscreen in specific con… |
CVE-2021-25331 | Low | 3.2 | 2021-03-04 | Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscreen in specific cond… |
CVE-2021-24032 | Medium | 4.7 | 2021-03-04 | Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default perm… |
CVE-2021-24031 | Medium | 5.5 | 2021-03-04 | In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would… |
CVE-2021-20351 | Medium | 5.4 | 2021-03-04 | IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2021-20350 | Medium | 5.4 | 2021-03-04 | IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2021-20340 | Medium | 5.4 | 2021-03-04 | IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2021-27217 | Medium | 4.4 | 2021-03-04 | An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3. The function does not correctly validate the embedded length… |
CVE-2021-26029 | Medium | 5.3 | 2021-03-04 | An issue was discovered in Joomla! 1.6.0 through 3.9.24. Inadequate filtering of form contents could allow to overwrite the author field. |
CVE-2021-26028 | Medium | 5.5 | 2021-03-04 | An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path. |
CVE-2021-26027 | Medium | 5.3 | 2021-03-04 | An issue was discovered in Joomla! 3.0.0 through 3.9.24. Incorrect ACL checks could allow unauthorized change of the category for an article. |
CVE-2021-23132 | High | 7.5 | 2021-03-04 | An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intended for image uploads |
CVE-2021-23131 | High | 7.5 | 2021-03-04 | An issue was discovered in Joomla! 3.2.0 through 3.9.24. Missing input validation within the template manager. |
CVE-2021-23130 | Medium | 6.1 | 2021-03-04 | An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues. |
CVE-2021-23129 | Medium | 6.1 | 2021-03-04 | An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of messages showed to users that could lead to xss issues. |
CVE-2021-23128 | Critical | 9.1 | 2021-03-04 | An issue was discovered in Joomla! 3.2.0 through 3.9.24. The core shipped but unused randval implementation within FOF (FOFEncryptRandval) used an potential in… |
CVE-2021-23127 | Critical | 9.1 | 2021-03-04 | An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes. |
CVE-2021-23126 | Medium | 5.3 | 2021-03-04 | An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand() function within the process of generating the 2FA secret. |
CVE-2021-22128 | High | 7.1 | 2021-03-04 | An improper access control vulnerability in FortiProxy SSL VPN portal 2.0.0, 1.2.9 and below versions may allow an authenticated, remote attacker to access int… |
CVE-2021-23346 | Medium | 4.8 | 2021-03-04 | This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular… |
CVE-2021-23344 | Critical | 9.8 | 2021-03-04 | The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set. |
CVE-2021-22189 | Medium | 5.9 | 2021-03-04 | Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that… |
CVE-2021-22183 | Medium | 4.1 | 2021-03-04 | An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS in the epics page, which could be explo… |
CVE-2021-21331 | Low | 3.0 | 2021-03-03 | The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the AP… |
CVE-2021-27940 | Medium | 6.1 | 2021-03-03 | resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter. |
CVE-2021-27935 | High | 7.5 | 2021-03-03 | An issue was discovered in AdGuard before 0.105.2. An attacker able to get the user's cookie is able to bruteforce their password offline, because the hash of… |
CVE-2021-27931 | Critical | 9.1 | 2021-03-03 | LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request craf… |
CVE-2021-21314 | Medium | 5.4 | 2021-03-03 | GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before… |
CVE-2021-21313 | Medium | 4.9 | 2021-03-03 | GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before… |
CVE-2021-21312 | Medium | 5.4 | 2021-03-03 | GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before… |
CVE-2021-27839 | Medium | 4.4 | 2021-03-03 | A CSV injection vulnerability found in Online Invoicing System (OIS) 4.3 and below can be exploited by users to perform malicious actions such as redirecting a… |
CVE-2021-22884 | High | 7.5 | 2021-03-03 | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not p… |
CVE-2021-22883 | High | 7.5 | 2021-03-03 | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' a… |
CVE-2021-22878 | Medium | 4.8 | 2021-03-03 | Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`. |
CVE-2021-22877 | Medium | 6.5 | 2021-03-03 | A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users external storage configuration when not alre… |
CVE-2021-22681 | Critical | 9.8 | 2021-03-03 | Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communi… |
CVE-2021-22188 | Medium | 5.3 | 2021-03-03 | An issue has been discovered in GitLab affecting all versions starting with 13.0. Confidential issue titles in Gitlab were readable by an unauthorised user via… |
CVE-2021-22182 | Low | 3.5 | 2021-03-03 | An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request. |
CVE-2021-21978 | Critical | 9.8 | 2021-03-03 | VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leadi… |
CVE-2021-27927 | High | 8.8 | 2021-03-03 | In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpd… |
CVE-2021-22683 | High | 7.8 | 2021-03-03 | Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to craft a special proje… |
CVE-2021-22670 | High | 7.8 | 2021-03-03 | An uninitialized pointer may be exploited in Fatek FvDesigner Version 1.5.76 and prior while the application is processing project files, allowing an attacker… |
CVE-2021-22666 | High | 7.8 | 2021-03-03 | Fatek FvDesigner Version 1.5.76 and prior is vulnerable to a stack-based buffer overflow while project files are being processed, allowing an attacker to craft… |
CVE-2021-22662 | High | 7.8 | 2021-03-03 | A use after free issue has been identified in Fatek FvDesigner Version 1.5.76 and prior in the way the application processes project files, allowing an attacke… |
CVE-2021-22638 | High | 7.8 | 2021-03-03 | Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds read while processing project files, allowing an attacker to craft a special projec… |
CVE-2021-21979 | High | 7.3 | 2021-03-03 | In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and 8.5.11-debian-10-r… |
CVE-2021-20442 | High | 7.5 | 2021-03-03 | IBM Security Verify Bridge contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound… |
CVE-2021-20441 | Medium | 5.9 | 2021-03-03 | IBM Security Verify Bridge uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2021-20233 | High | 8.2 | 2021-03-03 | A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assumption that expressi… |
CVE-2021-20225 | Medium | 6.7 | 2021-03-03 | A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain c… |
CVE-2021-20076 | High | 8.8 | 2021-03-03 | Tenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 were found to contain a vulnerability that could allow an authenticated, unprivileged user to per… |
CVE-2021-27215 | Critical | 9.8 | 2021-03-03 | An issue was discovered in genua genugate before 9.0 Z p19, 9.1.x through 9.6.x before 9.6 p7, and 10.x before 10.1 p4. The Web Interfaces (Admin, Userweb, Sid… |
CVE-2021-26813 | High | 7.5 | 2021-03-03 | markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can m… |
CVE-2021-25252 | Medium | 5.5 | 2021-03-03 | Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lead to denial-of-se… |
CVE-2021-25315 | Critical | 9.8 | 2021-03-03 | CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary c… |
CVE-2021-23347 | Medium | 4.7 | 2021-03-03 | The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected… |
CVE-2021-27923 | High | 7.5 | 2021-03-03 | Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked f… |
CVE-2021-27922 | High | 7.5 | 2021-03-03 | Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked f… |
CVE-2021-27921 | High | 7.5 | 2021-03-03 | Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked f… |
CVE-2021-2138 | Medium | 4.6 | 2021-03-03 | Vulnerability in the Oracle Cloud Infrastructure Data Science Notebook Sessions. Easily exploitable vulnerability allows low privileged attacker with access to… |
CVE-2021-22863 | High | 8.1 | 2021-03-03 | An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify… |
CVE-2021-22862 | Medium | 6.5 | 2021-03-03 | An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to… |
CVE-2021-22861 | Medium | 6.5 | 2021-03-03 | An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to un… |
CVE-2021-21353 | Medium | 6.8 | 2021-03-03 | Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option o… |
CVE-2021-21352 | Medium | 6.8 | 2021-03-03 | Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password re… |
CVE-2021-27078 | Critical | 9.1 | 2021-03-03 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2021-27065 | High | 7.8 | 2021-03-03 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2021-26858 | High | 7.8 | 2021-03-03 | Microsoft Exchange Server Remote Code Execution Vulnerability |