2021 CVEs (page 21)
Page 21 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-43395 | Medium | 5.5 | 2022-12-26 | An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, OpenIndiana Hipster 2021.04, and SmartOS… |
CVE-2021-39369 | Medium | 6.5 | 2022-12-26 | In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by authenticated users to access files stored… |
CVE-2021-38561 | High | 7.5 | 2022-12-26 | golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mish… |
CVE-2021-35954 | High | 8.1 | 2022-12-26 | fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows physically proximate attackers to dump the firmware, flash custom malicious firmware, and brick… |
CVE-2021-35953 | High | 7.5 | 2022-12-26 | fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service (device outage) via crafted choices of the last… |
CVE-2021-35952 | Medium | 5.3 | 2022-12-26 | fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to change the time, date, and month via Bluetooth LE Characteristics on handl… |
CVE-2021-35951 | High | 7.5 | 2022-12-26 | fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows an Unauthenticated Remote attacker to send a malicious firmware update via BLE and brick the de… |
CVE-2021-45467 | Critical | 9.8 | 2022-12-26 | In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an ar… |
CVE-2021-45466 | Critical | 9.8 | 2022-12-26 | In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_ke… |
CVE-2021-44855 | Medium | 5.4 | 2022-12-26 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. There is Blind Stored XSS via a URL to the Upload Image fea… |
CVE-2021-44854 | Medium | 5.3 | 2022-12-26 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API publicly caches results from private wikis. |
CVE-2021-44758 | High | 7.5 | 2022-12-26 | Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_type of GSS_C_NO_OID and a nonzero initial_… |
CVE-2021-4280 | Medium | 4.3 | 2022-12-25 | A vulnerability was found in styler_praat_scripts. It has been classified as problematic. Affected is an unknown function of the file file_segmenter.praat of t… |
CVE-2021-4279 | Medium | 6.3 | 2022-12-25 | A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulat… |
CVE-2021-4278 | Medium | 5.5 | 2022-12-25 | A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly co… |
CVE-2021-4277 | Low | 2.6 | 2022-12-25 | A vulnerability, which was classified as problematic, has been found in fredsmith utils. This issue affects some unknown processing of the file screenshot_sync… |
CVE-2021-4276 | Medium | 4.1 | 2022-12-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in dns-stats hedgehog. It has been rated as problematic. Affected by this issue is the function DSCIO… |
CVE-2021-32692 | Critical | 9.6 | 2022-12-23 | Activity Watch is a free and open-source automated time tracker. Versions prior to 0.11.0 allow an attacker to execute arbitrary commands on any macOS machine… |
CVE-2021-4221 | Medium | 4.3 | 2022-12-22 | If a domain name contained a RTL character, it would cause the domain to be rendered to the right of the path. This could lead to user confusion and spoofing a… |
CVE-2021-4140 | Critical | 10.0 | 2022-12-22 | It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96… |
CVE-2021-4129 | Critical | 9.8 | 2022-12-22 | Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safe… |
CVE-2021-4128 | Medium | 6.5 | 2022-12-22 | When transitioning in and out of fullscreen mode, a graphics object was not correctly protected; resulting in memory corruption and a potentially exploitable c… |
CVE-2021-4127 | Critical | 9.8 | 2022-12-22 | An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects Thunderbird < 78.9 and… |
CVE-2021-4126 | Medium | 6.5 | 2022-12-22 | When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list… |
CVE-2021-43657 | Medium | 5.4 | 2022-12-22 | A Stored Cross-site scripting (XSS) vulnerability via MAster.php in Sourcecodetester Simple Client Management System (SCMS) 1.0 allows remote attackers to inje… |
CVE-2021-36631 | Medium | 6.7 | 2022-12-22 | Untrusted search path vulnerability in Baidunetdisk Version 7.4.3 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified di… |
CVE-2021-4275 | Medium | 4.3 | 2022-12-21 | A vulnerability, which was classified as problematic, was found in katlings pyambic-pentameter. Affected is an unknown function. The manipulation leads to cros… |
CVE-2021-4274 | Low | 3.5 | 2022-12-21 | A vulnerability, which was classified as problematic, has been found in sileht bird-lg. This issue affects some unknown processing of the file templates/layout… |
CVE-2021-4273 | Medium | 4.3 | 2022-12-21 | A vulnerability classified as problematic was found in studygolang. This vulnerability affects the function Search of the file http/controller/search.go. The m… |
CVE-2021-4272 | Low | 3.5 | 2022-12-21 | A vulnerability classified as problematic has been found in studygolang. This affects an unknown part of the file static/js/topics.js. The manipulation of the… |
CVE-2021-4271 | Low | 3.5 | 2022-12-21 | A vulnerability was found in panicsteve w2wiki. It has been rated as problematic. Affected by this issue is the function toHTML of the file index.php of the co… |
CVE-2021-4270 | Low | 3.5 | 2022-12-21 | A vulnerability was found in Imprint CMS. It has been classified as problematic. Affected is the function SearchForm of the file ImprintCMS/Models/ViewHelpers… |
CVE-2021-4269 | Low | 3.5 | 2022-12-21 | A vulnerability has been found in SimpleRisk and classified as problematic. This vulnerability affects the function checkAndSetValidation of the file simpleris… |
CVE-2021-4268 | Medium | 4.3 | 2022-12-21 | A vulnerability, which was classified as problematic, was found in phpRedisAdmin up to 1.17.3. This affects an unknown part. The manipulation leads to cross-si… |
CVE-2021-4267 | Low | 3.5 | 2022-12-21 | A vulnerability classified as problematic was found in tad_discuss. Affected by this vulnerability is an unknown functionality. The manipulation of the argumen… |
CVE-2021-4266 | Low | 3.5 | 2022-12-21 | A vulnerability classified as problematic has been found in Webdetails cpf up to 9.5.0.0-80. Affected is an unknown function of the file core/src/main/java/pt/… |
CVE-2021-4265 | Low | 3.5 | 2022-12-21 | A vulnerability was found in siwapp-ror. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to cross site scr… |
CVE-2021-4264 | Medium | 6.3 | 2022-12-21 | A vulnerability was found in LinkedIn dustjs up to 2.x and classified as problematic. Affected by this issue is some unknown functionality. The manipulation le… |
CVE-2021-4263 | Low | 3.5 | 2022-12-21 | A vulnerability, which was classified as problematic, has been found in leanote 2.6.1. This issue affects the function define of the file public/js/plugins/his… |
CVE-2021-46856 | High | 7.5 | 2022-12-20 | The multi-screen collaboration module has a path traversal vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2021-33640 | Medium | 6.2 | 2022-12-19 | After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: fre… |
CVE-2021-4262 | Medium | 5.5 | 2022-12-19 | A vulnerability classified as critical was found in laravel-jqgrid. Affected by this vulnerability is the function getRows of the file src/Mgallegos/LaravelJqg… |
CVE-2021-4261 | Medium | 6.3 | 2022-12-19 | A vulnerability classified as critical has been found in pacman-canvas up to 1.0.5. Affected is the function addHighscore of the file data/db-handler.php. The… |
CVE-2021-4260 | Medium | 6.3 | 2022-12-19 | A vulnerability was found in oils-js. It has been declared as critical. This vulnerability affects unknown code of the file core/Web.js. The manipulation leads… |
CVE-2021-4259 | Medium | 5.0 | 2022-12-19 | A vulnerability was found in phpRedisAdmin up to 1.16.1. It has been classified as problematic. This affects the function authHttpDigest of the file includes/l… |
CVE-2021-4258 | Low | 3.7 | 2022-12-19 | A vulnerability was found in whohas. It has been rated as problematic. This issue affects some unknown processing of the component Package Information Handler… |
CVE-2021-4257 | Low | 3.5 | 2022-12-18 | A vulnerability was found in ctrlo lenio. It has been declared as problematic. This vulnerability affects unknown code of the file views/task.tt of the compone… |
CVE-2021-4256 | Low | 3.5 | 2022-12-18 | A vulnerability was found in ctrlo lenio. It has been classified as problematic. This affects an unknown part of the file views/index.tt. The manipulation of t… |
CVE-2021-4255 | Low | 3.5 | 2022-12-18 | A vulnerability was found in ctrlo lenio and classified as problematic. Affected by this issue is some unknown functionality of the file views/contractor.tt. T… |
CVE-2021-4254 | Low | 3.5 | 2022-12-18 | A vulnerability has been found in ctrlo lenio and classified as problematic. Affected by this vulnerability is an unknown functionality of the file views/layou… |
CVE-2021-4253 | Low | 3.5 | 2022-12-18 | A vulnerability, which was classified as problematic, was found in ctrlo lenio. Affected is an unknown function in the library lib/Lenio.pm of the component Ti… |
CVE-2021-4252 | Low | 3.5 | 2022-12-18 | A vulnerability, which was classified as problematic, has been found in WP-Ban. This issue affects the function toggle_checkbox of the file ban-options.php. Th… |
CVE-2021-4251 | Low | 3.5 | 2022-12-18 | A vulnerability classified as problematic was found in as. This vulnerability affects the function getFullURL of the file include.cdn.php. The manipulation lea… |
CVE-2021-4250 | Low | 3.5 | 2022-12-18 | A vulnerability classified as problematic has been found in cgriego active_attr up to 0.15.2. This affects the function call of the file lib/active_attr/typeca… |
CVE-2021-4249 | Medium | 4.3 | 2022-12-18 | A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Pa… |
CVE-2021-4248 | Medium | 5.6 | 2022-12-18 | A vulnerability was found in kapetan dns up to 6.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file DNS/Pr… |
CVE-2021-4247 | Medium | 4.3 | 2022-12-18 | A vulnerability has been found in OWASP NodeGoat and classified as problematic. This vulnerability affects unknown code of the file app/routes/research.js of t… |
CVE-2021-4246 | Medium | 6.3 | 2022-12-17 | A vulnerability was found in roxlukas LMeve and classified as critical. Affected by this issue is some unknown functionality of the component Login Page. The m… |
CVE-2021-38241 | Critical | 9.8 | 2022-12-16 | Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework. |
CVE-2021-31650 | Critical | 9.8 | 2022-12-16 | A SQL injection vulnerability in Sourcecodester Online Grading System 1.0 allows remote attackers to execute arbitrary SQL commands via the uname parameter. |
CVE-2021-35252 | High | 7.5 | 2022-12-16 | Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is exposed to an attacker… |
CVE-2021-28655 | Medium | 6.5 | 2022-12-16 | The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files. This issue… |
CVE-2021-4245 | Medium | 5.5 | 2022-12-15 | A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipulation leads to imp… |
CVE-2021-4226 | Critical | 9.8 | 2022-12-15 | RSFirewall tries to identify the original IP address by looking at different HTTP headers. A bypass is possible due to the way it is implemented. |
CVE-2021-39428 | Medium | 5.4 | 2022-12-15 | Cross Site Scripting (XSS) vulnerability in Users.php in eyoucms 1.5.4 allows remote attackers to run arbitrary code and gain escalated privilege via the filen… |
CVE-2021-39427 | Medium | 5.4 | 2022-12-15 | Cross site scripting vulnerability in 188Jianzhan 2.10 allows attackers to execute arbitrary code via the username parameter to /admin/reg.php. |
CVE-2021-39426 | Critical | 9.8 | 2022-12-15 | An issue was discovered in /Upload/admin/admin_notify.php in Seacms 11.4 allows attackers to execute arbitrary php code via the notify1 parameter when the acti… |
CVE-2021-36573 | Medium | 5.4 | 2022-12-15 | File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload. |
CVE-2021-36572 | Medium | 6.1 | 2022-12-15 | Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login page. |
CVE-2021-33420 | Critical | 9.8 | 2022-12-15 | A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializable function in Typed… |
CVE-2021-44695 | Medium | 4.9 | 2022-12-13 | Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in th… |
CVE-2021-44694 | Medium | 5.5 | 2022-12-13 | Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in th… |
CVE-2021-44693 | Medium | 4.9 | 2022-12-13 | Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in th… |
CVE-2021-40365 | High | 7.5 | 2022-12-13 | Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in th… |
CVE-2021-39660 | High | 7.0 | 2022-12-13 | In TBD of TBD, there is a possible way to archive arbitrary code execution in kernel due to a race condition. This could lead to local escalation of privilege… |
CVE-2021-0934 | Medium | 5.5 | 2022-12-13 | In findAllDeAccounts of AccountsDb.java, there is a possible denial of service due to resource exhaustion. This could lead to local denial of service with no a… |
CVE-2021-32415 | High | 7.8 | 2022-12-13 | EXEMSI MSI Wrapper Versions prior to 10.0.50 and at least since version 6.0.91 will introduce a local privilege escalation vulnerability in installers it creat… |
CVE-2021-41943 | Medium | 6.1 | 2022-12-13 | Logrhythm Web Console 7.4.9 allows for HTML tag injection through Contextualize Action -> Create a new Contextualize Action -> Inject your HTML tag in the name… |
CVE-2021-4244 | Low | 2.6 | 2022-12-12 | A vulnerability classified as problematic has been found in yikes-inc-easy-mailchimp-extender Plugin up to 6.8.5. This affects an unknown part of the file admi… |
CVE-2021-46846 | Medium | 6.4 | 2022-12-12 | Cross Site Scripting vulnerability in Hewlett Packard Enterprise Integrated Lights-Out 5. |
CVE-2021-3942 | Critical | 9.8 | 2022-12-12 | Certain HP Print products and Digital Sending products may be vulnerable to potential remote code execution and buffer overflow with use of Link-Local Multicas… |
CVE-2021-3919 | Critical | 9.8 | 2022-12-12 | A potential security vulnerability has been identified in OMEN Gaming Hub and in HP Command Center which may allow escalation of privilege and/or denial of ser… |
CVE-2021-3821 | Critical | 9.8 | 2022-12-12 | A potential security vulnerability has been identified for certain HP multifunction printers (MFPs). The vulnerability may lead to Denial of Service when runni… |
CVE-2021-3661 | High | 8.4 | 2022-12-12 | A potential security vulnerability has been identified in certain HP Workstation BIOS (UEFI firmware) which may allow arbitrary code execution. HP is releasing… |
CVE-2021-3437 | Critical | 9.8 | 2022-12-12 | Potential security vulnerabilities have been identified in an OMEN Gaming Hub SDK package which may allow escalation of privilege and/or denial of service. HP… |
CVE-2021-38997 | Medium | 5.4 | 2022-12-12 | IBM API Connect V10.0.0.0 through V10.0.5.0, V10.0.1.0 through V10.0.1.7, and V2018.4.1.0 through 2018.4.1.19 is vulnerable to HTTP header injection, caused by… |
CVE-2021-39434 | High | 7.5 | 2022-12-06 | A default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0 through 11.1.0, builds 20180901, 20190510.1, 20200309.3, 2020… |
CVE-2021-34181 | Medium | 5.4 | 2022-12-05 | Cross Site Scripting (XSS) vulnerability in TomExam 3.0 via p_name parameter to list.thtml. |
CVE-2021-37533 | Medium | 6.5 | 2022-12-03 | Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use… |
CVE-2021-31740 | Medium | 6.1 | 2022-11-30 | SEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripting vulnerabilities (XSS). |
CVE-2021-4242 | Medium | 6.3 | 2022-11-30 | A vulnerability was found in Sapido BR270n, BRC76n, GR297 and RB1732 and classified as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2021-31693 | Medium | 6.1 | 2022-11-29 | The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data. NOTE: othe… |
CVE-2021-45036 | High | 8.7 | 2022-11-28 | Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the… |
CVE-2021-25059 | Medium | 4.3 | 2022-11-28 | The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which ma… |
CVE-2021-29334 | High | 8.8 | 2022-11-23 | An issue was discovered in JIZHI CMS 1.9.4. There is a CSRF vulnerability that can add an admin account via index, /admin.php/Admin/adminadd.html |
CVE-2021-43258 | High | 8.8 | 2022-11-23 | CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads. This requires authenticated access tot he ChurchIn… |
CVE-2021-35284 | Critical | 9.8 | 2022-11-23 | SQL Injection vulnerability in function get_user in login_manager.php in rizalafani cms-php v1. |
CVE-2021-35246 | Medium | 5.3 | 2022-11-23 | The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's network traffic could… |
CVE-2021-46854 | High | 7.5 | 2022-11-23 | mod_radius in ProFTPD before 1.3.7c allows memory disclosure to RADIUS servers because it copies blocks of 16 characters. |
CVE-2021-24649 | Critical | 9.8 | 2022-11-21 | The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the acc… |