2021 CVEs (page 210)
Page 210 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-26857 | High | 7.8 | 2021-03-03 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2021-26855 | Critical | 9.1 | 2021-03-03 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2021-26854 | Medium | 6.6 | 2021-03-03 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2021-26412 | Critical | 9.1 | 2021-03-03 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2021-21258 | Medium | 6.8 | 2021-03-02 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI from… |
CVE-2021-21255 | Medium | 5.8 | 2021-03-02 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI vers… |
CVE-2021-27885 | High | 8.8 | 2021-03-02 | usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism. |
CVE-2021-22296 | Medium | 5.5 | 2021-03-02 | A component of HarmonyOS 2.0 has a DoS vulnerability. Local attackers may exploit this vulnerability to mount a file system to the target device, causing DoS o… |
CVE-2021-22294 | Low | 3.3 | 2021-03-02 | A component API of the HarmonyOS 2.0 has a permission bypass vulnerability. Local attackers may exploit this vulnerability to issue commands repeatedly, exhaus… |
CVE-2021-22187 | Medium | 4.3 | 2021-03-02 | An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7. A potential resource exhaustion issue that allowed running or pend… |
CVE-2021-3384 | Medium | 5.3 | 2021-03-02 | A vulnerability in Stormshield Network Security could allow an attacker to trigger a protection related to ARP/NDP tables management, which would temporarily p… |
CVE-2021-25330 | High | 7.5 | 2021-03-02 | Calling of non-existent provider in MobileWips application prior to SMR Feb-2021 Release 1 allows unauthorized actions including denial of service attack by hi… |
CVE-2021-21514 | Medium | 4.9 | 2021-03-02 | Dell EMC OpenManage Server Administrator (OMSA) versions 9.5 and prior contain a path traversal vulnerability. A remote user with admin privileges could potent… |
CVE-2021-21513 | High | 8.6 | 2021-03-02 | Dell EMC OpenManage Server Administrator (OMSA) version 9.5 Microsoft Windows installations with Distributed Web Server (DWS) enabled configuration contains an… |
CVE-2021-27904 | Medium | 5.5 | 2021-03-02 | An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139. In the implementation of Sharing Groups, the "all org" flag sometimes provided vie… |
CVE-2021-27901 | Medium | 6.8 | 2021-03-02 | An issue was discovered on LG mobile devices with Android OS 11 software. They mishandle fingerprint recognition because local high beam mode (LHBM) does not f… |
CVE-2021-21322 | Critical | 10.0 | 2021-03-02 | fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is… |
CVE-2021-21321 | Critical | 10.0 | 2021-03-02 | fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0… |
CVE-2021-21320 | Low | 2.6 | 2021-03-02 | matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content sandbox can be abuse… |
CVE-2021-27730 | Critical | 9.8 | 2021-03-02 | Accellion FTA 9_12_432 and earlier is affected by argument injection via a crafted POST request to an admin endpoint. The fixed version is FTA_9_12_444 and lat… |
CVE-2021-27888 | Medium | 6.1 | 2021-03-02 | ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters. |
CVE-2021-27804 | Critical | 9.8 | 2021-03-02 | JPEG XL (aka jpeg-xl) through 0.3.2 allows writable memory corruption. |
CVE-2021-27731 | Medium | 6.1 | 2021-03-02 | Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed version is FTA_9_12_444 and later. |
CVE-2021-25309 | Critical | 9.8 | 2021-03-02 | The telnet administrator service running on port 650 on Gigaset DX600A v41.00-175 devices does not implement any lockout or throttling functionality. This situ… |
CVE-2021-25306 | High | 7.5 | 2021-03-02 | A buffer overflow vulnerability in the AT command interface of Gigaset DX600A v41.00-175 devices allows remote attackers to force a device reboot by sending re… |
CVE-2021-27886 | Critical | 9.8 | 2021-03-02 | rakibtg Docker Dashboard before 2021-02-28 allows command injection in backend/utilities/terminal.js via shell metacharacters in the command parameter of an AP… |
CVE-2021-27884 | Medium | 5.1 | 2021-03-01 | Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in… |
CVE-2021-3342 | Critical | 9.8 | 2021-03-01 | EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted LaTeX input to a cgi/latex2png?latex= URI. |
CVE-2021-27878 | High | 8.8 | 2021-03-01 | An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typica… |
CVE-2021-27877 | High | 8.2 | 2021-03-01 | An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authenticatio… |
CVE-2021-27876 | High | 8.1 | 2021-03-01 | An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typica… |
CVE-2021-26704 | High | 8.8 | 2021-03-01 | EPrints 3.4.2 allows remote attackers to execute arbitrary commands via crafted input to the verb parameter in a cgi/toolbox/toolbox URI. |
CVE-2021-26703 | Critical | 9.8 | 2021-03-01 | EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted JSON/XML input to a cgi/ajax/phrase URI. |
CVE-2021-26702 | Medium | 6.1 | 2021-03-01 | EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/dataset_dictionary URI. |
CVE-2021-26476 | Critical | 9.8 | 2021-03-01 | EPrints 3.4.2 allows remote attackers to execute OS commands via crafted LaTeX input to a cgi/cal?year= URI. |
CVE-2021-26475 | Medium | 6.1 | 2021-03-01 | EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI. |
CVE-2021-3332 | Medium | 5.3 | 2021-03-01 | WPS Hide Login 1.6.1 allows remote attackers to bypass a protection mechanism via post_password. |
CVE-2021-27318 | Medium | 6.1 | 2021-03-01 | Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web script or HTML via t… |
CVE-2021-27317 | Medium | 6.1 | 2021-03-01 | Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web script or HTML via t… |
CVE-2021-21517 | High | 7.2 | 2021-03-01 | SRS Policy Manager 6.X is affected by an XML External Entity Injection (XXE) vulnerability due to a misconfigured XML parser that processes user-supplied DTD i… |
CVE-2021-21515 | Critical | 9.0 | 2021-03-01 | Dell EMC SourceOne, versions 7.2SP10 and prior, contain a Stored Cross-Site Scripting vulnerability. A remote low privileged attacker may potentially exploit t… |
CVE-2021-25914 | Critical | 9.8 | 2021-03-01 | Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code ex… |
CVE-2021-22114 | Medium | 5.3 | 2021-03-01 | Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved us… |
CVE-2021-25833 | Critical | 9.8 | 2021-03-01 | A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file extension is controlled by an attacker… |
CVE-2021-25832 | Critical | 9.8 | 2021-03-01 | A heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v6.0.0. Using this vulnera… |
CVE-2021-25831 | Critical | 9.8 | 2021-03-01 | A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. An attacker must request the conversion of the crafted… |
CVE-2021-25830 | Critical | 9.8 | 2021-03-01 | A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. An attacker must request the conversion of the cr… |
CVE-2021-25829 | High | 7.5 | 2021-03-01 | An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. Using this bug, an attacker is able… |
CVE-2021-25329 | High | 7.0 | 2021-03-01 | The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configu… |
CVE-2021-25122 | High | 7.5 | 2021-03-01 | When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request head… |
CVE-2021-27225 | Medium | 5.4 | 2021-03-01 | In Dataiku DSS before 8.0.6, insufficient access control in the Jupyter notebooks integration allows users (who have coding permissions) to read and overwrite… |
CVE-2021-27132 | Critical | 9.8 | 2021-02-27 | SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header. |
CVE-2021-3197 | Critical | 9.8 | 2021-02-27 | An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument… |
CVE-2021-3151 | Medium | 5.4 | 2021-02-27 | i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or… |
CVE-2021-3148 | Critical | 9.8 | 2021-02-27 | An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injectio… |
CVE-2021-3144 | Critical | 9.1 | 2021-02-27 | In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.) |
CVE-2021-25284 | Medium | 4.4 | 2021-02-27 | An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level. |
CVE-2021-25283 | Critical | 9.8 | 2021-02-27 | An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks. |
CVE-2021-25282 | Critical | 9.1 | 2021-02-27 | An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal. |
CVE-2021-25281 | Critical | 9.8 | 2021-02-27 | An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can re… |
CVE-2021-27803 | High | 7.5 | 2021-02-26 | A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in… |
CVE-2021-27198 | Critical | 9.8 | 2021-02-26 | An issue was discovered in Visualware MyConnection Server before v11.1a. Unauthenticated Remote Code Execution can occur via Arbitrary File Upload in the web s… |
CVE-2021-27799 | High | 7.5 | 2021-02-26 | ean_leading_zeroes in backend/upcean.c in Zint Barcode Generator 2.9.1 has a stack-based buffer overflow that is reachable from the C API through an applicatio… |
CVE-2021-26567 | High | 7.8 | 2021-02-26 | Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via filename and pathname… |
CVE-2021-26566 | High | 8.3 | 2021-02-26 | Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-midd… |
CVE-2021-26565 | High | 8.3 | 2021-02-26 | Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle… |
CVE-2021-26564 | High | 8.3 | 2021-02-26 | Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle… |
CVE-2021-26563 | High | 8.2 | 2021-02-26 | Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary co… |
CVE-2021-26562 | Critical | 9.0 | 2021-02-26 | Out-of-bounds write vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execut… |
CVE-2021-26561 | Critical | 9.0 | 2021-02-26 | Stack-based buffer overflow vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers t… |
CVE-2021-26560 | Critical | 9.0 | 2021-02-26 | Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-th… |
CVE-2021-21309 | Medium | 5.4 | 2021-02-26 | Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer c… |
CVE-2021-0406 | Medium | 6.7 | 2021-02-26 | In cameraisp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pri… |
CVE-2021-0405 | Medium | 6.7 | 2021-02-26 | In performance driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System exec… |
CVE-2021-0404 | Medium | 4.4 | 2021-02-26 | In mobile_log_d, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execu… |
CVE-2021-0403 | Medium | 4.4 | 2021-02-26 | In netdiag, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with System execution… |
CVE-2021-0402 | Medium | 6.7 | 2021-02-26 | In jpeg, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privi… |
CVE-2021-0401 | Medium | 6.4 | 2021-02-26 | In vow, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2021-0367 | Medium | 6.4 | 2021-02-26 | In vpu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2021-0366 | Medium | 6.4 | 2021-02-26 | In vpu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2021-21308 | Medium | 6.1 | 2021-02-26 | PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is ab… |
CVE-2021-21302 | Medium | 6.8 | 2021-02-26 | PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using sho… |
CVE-2021-23345 | Medium | 5.3 | 2021-02-26 | All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endpoint when the src… |
CVE-2021-21274 | Medium | 4.3 | 2021-02-26 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2021-21273 | Low | 3.1 | 2021-02-26 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2021-21298 | Low | 3.5 | 2021-02-26 | Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path… |
CVE-2021-21297 | High | 7.7 | 2021-02-26 | Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in… |
CVE-2021-23979 | High | 8.8 | 2021-02-26 | Mozilla developers reported memory safety bugs present in Firefox 85. Some of these bugs showed evidence of memory corruption and we presume that with enough e… |
CVE-2021-23978 | High | 8.8 | 2021-02-26 | Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evidence of memory corruption and we presu… |
CVE-2021-23965 | High | 8.8 | 2021-02-26 | Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evidence of memory corruption and we presume that with enough e… |
CVE-2021-23964 | High | 8.8 | 2021-02-26 | Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and we presu… |
CVE-2021-3010 | Medium | 5.4 | 2021-02-26 | There are multiple persistent cross-site scripting (XSS) vulnerabilities in the web interface of OpenText Content Server Version 20.3. The application allows a… |
CVE-2021-26904 | Critical | 9.8 | 2021-02-26 | LMA ISIDA Retriever 5.2 allows SQL Injection. |
CVE-2021-26903 | Medium | 6.1 | 2021-02-26 | LMA ISIDA Retriever 5.2 is vulnerable to XSS via query['text']. |
CVE-2021-22661 | High | 7.5 | 2021-02-26 | Changing the password on the module webpage does not require the user to type in the current password first. Thus, the password could be changed by a user or e… |
CVE-2021-23977 | Medium | 5.3 | 2021-02-26 | Firefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a malicious application to read sensitive data from application direct… |
CVE-2021-23963 | Medium | 4.3 | 2021-02-26 | When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control ove… |
CVE-2021-23962 | High | 8.8 | 2021-02-26 | Incorrect use of the '<RowCountChanged>' method could have led to a user-after-poison and a potentially exploitable crash. This vulnerability affects Firefox <… |
CVE-2021-23961 | High | 7.4 | 2021-02-26 | Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as servi… |
CVE-2021-23960 | High | 8.8 | 2021-02-26 | Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. This vulnerability affe… |