2021 CVEs (page 213)
Page 213 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-27509 | High | 7.5 | 2021-02-19 | In Visualware MyConnection Server before 11.0b build 5382, each published report is not associated with its own access code. |
CVE-2021-26713 | Medium | 6.5 | 2021-02-19 | A stack-based buffer overflow in res_rtp_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk befor… |
CVE-2021-20588 | High | 7.5 | 2021-02-19 | Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool version… |
CVE-2021-20587 | High | 7.5 | 2021-02-19 | Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions 1.112R and prior, CW Co… |
CVE-2021-27351 | Medium | 5.3 | 2021-02-19 | The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently act… |
CVE-2021-27328 | Medium | 6.5 | 2021-02-19 | Yeastar NeoGate TG400 91.3.0.3 devices are affected by Directory Traversal. An authenticated user can decrypt firmware and can read sensitive information, such… |
CVE-2021-27214 | Medium | 6.1 | 2021-02-19 | A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenti… |
CVE-2021-23342 | High | 8.6 | 2021-02-19 | This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the fol… |
CVE-2021-21512 | High | 7.9 | 2021-02-19 | Dell EMC PowerProtect Cyber Recovery, version 19.7.0.1, contains an Information Disclosure vulnerability. A locally authenticated high privileged Cyber Recover… |
CVE-2021-22703 | High | 7.5 | 2021-02-19 | A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION90… |
CVE-2021-22702 | High | 7.5 | 2021-02-19 | A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/85xx/8600, ION8650… |
CVE-2021-22701 | Medium | 4.5 | 2021-02-19 | A CWE-352: Cross-Site Request Forgery vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see not… |
CVE-2021-3210 | Critical | 9.6 | 2021-02-19 | components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound <= 4.0.1 allows remote attackers to execute arbitrary system commands when the victim impor… |
CVE-2021-3204 | Medium | 6.5 | 2021-02-19 | SSRF in the document conversion component of Webware Webdesktop 5.1.15 allows an attacker to read all files from the server. |
CVE-2021-26296 | High | 7.5 | 2021-02-19 | In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically wea… |
CVE-2021-3339 | Medium | 4.3 | 2021-02-19 | ModernFlow before 1.3.00.208 does not constrain web-page access to members of a security group, as demonstrated by the Search Screen and the Profile Screen. |
CVE-2021-27405 | High | 7.5 | 2021-02-19 | A ReDoS (regular expression denial of service) flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for Node.js. |
CVE-2021-26746 | Medium | 6.1 | 2021-02-19 | Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI. |
CVE-2021-27404 | Medium | 6.1 | 2021-02-19 | Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow injection of a Host HTTP header. |
CVE-2021-27403 | Medium | 6.1 | 2021-02-19 | Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow cgi-bin/te_acceso_router.cgi curWebPage XSS. |
CVE-2021-26747 | Critical | 9.8 | 2021-02-18 | Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code execution. |
CVE-2021-26712 | High | 7.5 | 2021-02-18 | Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a remote unauthenticat… |
CVE-2021-26906 | Medium | 5.9 | 2021-02-18 | An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through… |
CVE-2021-26717 | High | 7.5 | 2021-02-18 | An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-n… |
CVE-2021-3271 | Medium | 4.8 | 2021-02-18 | PressBooks 5.17.3 contains a cross-site scripting (XSS). Stored XSS can be submitted via the Book Info's Long Description Body, and all actions to open or prev… |
CVE-2021-27335 | Critical | 9.8 | 2021-02-18 | KollectApps before 4.8.16c is affected by insecure Java deserialization, leading to Remote Code Execution via a ysoserial.payloads.CommonsCollections parameter. |
CVE-2021-27329 | Critical | 10.0 | 2021-02-18 | Friendica 2021.01 allows SSRF via parse_url?binurl= for DNS lookups or HTTP requests to arbitrary domain names. |
CVE-2021-21318 | Medium | 5.4 | 2021-02-18 | Opencast is a free, open-source platform to support the management of educational audio and video content. In Opencast before version 9.2 there is a vulnerabil… |
CVE-2021-27379 | High | 7.8 | 2021-02-18 | An issue was discovered in Xen through 4.11.x, allowing x86 Intel HVM guest OS users to achieve unintended read/write DMA access, and possibly cause a denial o… |
CVE-2021-23341 | High | 7.5 | 2021-02-18 | The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel… |
CVE-2021-23340 | High | 7.1 | 2021-02-18 | This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportControl… |
CVE-2021-20446 | Medium | 5.4 | 2021-02-18 | IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2021-20445 | Medium | 6.5 | 2021-02-18 | IBM Maximo for Civil Infrastructure 7.6.2 could allow a user to obtain sensitive information due to insecure storeage of authentication credentials. IBM X-Forc… |
CVE-2021-20444 | Medium | 6.1 | 2021-02-18 | IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2021-20443 | High | 8.8 | 2021-02-18 | IBM Maximo for Civil Infrastructure 7.6.2 includes executable functionality (such as a library) from a source that is outside of the intended control sphere. I… |
CVE-2021-20354 | High | 7.5 | 2021-02-18 | IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories. An attacker could send a specially-crafted URL reques… |
CVE-2021-27378 | Critical | 9.8 | 2021-02-18 | An issue was discovered in the rand_core crate before 0.6.2 for Rust. Because read_u32_into and read_u64_into mishandle certain buffer-length checks, a random… |
CVE-2021-27377 | Critical | 9.8 | 2021-02-18 | An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydb_subscript_next_st and ydb_subscript_prev_st have a… |
CVE-2021-27376 | Critical | 9.8 | 2021-02-18 | An issue was discovered in the nb-connect crate before 1.0.3 for Rust. It may have invalid memory access for certain versions of the standard library because i… |
CVE-2021-27124 | Medium | 6.5 | 2021-02-18 | SQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0 allows an authenticated patient user to dump the database crede… |
CVE-2021-27375 | Medium | 5.3 | 2021-02-18 | Traefik before 2.4.5 allows the loading of IFRAME elements from other domains. |
CVE-2021-27138 | High | 7.8 | 2021-02-17 | The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT. |
CVE-2021-27097 | High | 7.8 | 2021-02-17 | The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT. |
CVE-2021-27374 | High | 7.5 | 2021-02-17 | VertiGIS WebOffice 10.7 SP1 before patch20210202 and 10.8 SP1 before patch20210207 allows attackers to achieve "Zugriff auf Inhalte der WebOffice Applikation." |
CVE-2021-26720 | High | 7.8 | 2021-02-17 | avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to c… |
CVE-2021-3396 | High | 8.8 | 2021-02-17 | OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect… |
CVE-2021-27367 | High | 7.5 | 2021-02-17 | Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in Bolt before 4.1.13 allow Directory Traversal. |
CVE-2021-26911 | High | 7.4 | 2021-02-17 | core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for IMAP in STARTTLS mode. |
CVE-2021-1416 | Medium | 6.5 | 2021-02-17 | Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive informat… |
CVE-2021-1412 | Medium | 6.5 | 2021-02-17 | Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive informat… |
CVE-2021-1378 | Medium | 5.3 | 2021-02-17 | A vulnerability in the SSH service of the Cisco StarOS operating system could allow an unauthenticated, remote attacker to cause an affected device to stop pro… |
CVE-2021-1372 | Medium | 5.5 | 2021-02-17 | A vulnerability in Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows could allow an authenticated, local attacker to gain access to sen… |
CVE-2021-1366 | High | 7.8 | 2021-02-17 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local atta… |
CVE-2021-1351 | Medium | 6.1 | 2021-02-17 | A vulnerability in the web-based interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) atta… |
CVE-2021-27362 | Critical | 9.8 | 2021-02-17 | The WPG plugin before 3.1.0.0 for IrfanView 4.57 has a Read Access Violation on Control Flow starting at WPG!ReadWPG_W+0x0000000000000133, which might allow re… |
CVE-2021-27224 | High | 7.5 | 2021-02-17 | The WPG plugin before 3.1.0.0 for IrfanView 4.57 has a user-mode write access violation starting at WPG+0x0000000000012ec6, which might allow remote attackers… |
CVE-2021-26809 | Critical | 9.8 | 2021-02-17 | PHPGurukul Car Rental Project version 2.0 suffers from a remote shell upload vulnerability in changeimage1.php. |
CVE-2021-26697 | Medium | 5.3 | 2021-02-17 | The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that en… |
CVE-2021-26559 | Medium | 6.5 | 2021-02-17 | Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations inc… |
CVE-2021-25780 | High | 7.2 | 2021-02-17 | An arbitrary file upload vulnerability has been identified in posts.php in Baby Care System 1.0. The vulnerability could be exploited by an remote attacker to… |
CVE-2021-25779 | Critical | 9.8 | 2021-02-17 | Baby Care System v1.0 is vulnerable to SQL injection via the 'id' parameter on the contentsectionpage.php page. |
CVE-2021-22174 | Low | 3.7 | 2021-02-17 | Crash in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file |
CVE-2021-22173 | Low | 3.7 | 2021-02-17 | Memory leak in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file |
CVE-2021-22855 | Critical | 9.8 | 2021-02-17 | The specific function of HR Portal of Soar Cloud System accepts any type of object to be deserialized. Attackers can send malicious serialized objects to execu… |
CVE-2021-22854 | High | 7.5 | 2021-02-17 | The HR Portal of Soar Cloud System fails to filter specific parameters. Remote attackers can inject SQL syntax and obtain all data in the database without priv… |
CVE-2021-22853 | Medium | 5.4 | 2021-02-17 | The HR Portal of Soar Cloud System fails to manage access control. While obtaining user ID, remote attackers can access sensitive data via a specific data pack… |
CVE-2021-0109 | High | 7.8 | 2021-02-17 | Insecure inherited permissions for the Intel(R) SOC driver package for STK1A32SC before version 604 may allow an authenticated user to potentially enable escal… |
CVE-2021-22553 | Medium | 6.5 | 2021-02-17 | Any git operation is passed through Jetty and a session is created. No expiry is set for the session and Jetty does not automatically dispose of the session. O… |
CVE-2021-22858 | High | 8.8 | 2021-02-17 | Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining use… |
CVE-2021-22857 | High | 7.5 | 2021-02-17 | The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily. |
CVE-2021-22856 | Critical | 9.8 | 2021-02-17 | The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain da… |
CVE-2021-23885 | Critical | 9.0 | 2021-02-17 | Privilege escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.8 allows an authenticated user to gain elevated privileges through the User Interfa… |
CVE-2021-23339 | Medium | 5.0 | 2021-02-17 | This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers. |
CVE-2021-20655 | High | 7.2 | 2021-02-17 | FileZen (V3.0.0 to V4.2.7 and V5.0.0 to V5.0.2) allows a remote attacker with administrator rights to execute arbitrary OS commands via unspecified vectors. |
CVE-2021-20653 | Medium | 5.3 | 2021-02-17 | Calsos CSDJ (CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, CSDJ-D 01.08.00 and earlier, and CSDJ-A 03.08.00 and earlier) allows remote attackers to… |
CVE-2021-26934 | High | 7.8 | 2021-02-17 | An issue was discovered in the Linux kernel 4.18 through 5.10.16, as used by Xen. The backend allocation (aka be-alloc) mode of the drm_xen_front drivers was n… |
CVE-2021-26933 | Medium | 5.5 | 2021-02-17 | An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen n… |
CVE-2021-26932 | Medium | 5.5 | 2021-02-17 | An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of op… |
CVE-2021-26931 | Medium | 5.5 | 2021-02-17 | An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, delibera… |
CVE-2021-26930 | High | 7.8 | 2021-02-17 | An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provi… |
CVE-2021-27104 | Critical | 9.8 | 2021-02-16 | Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380… |
CVE-2021-27103 | Critical | 9.8 | 2021-02-16 | Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later. |
CVE-2021-27102 | High | 7.8 | 2021-02-16 | Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later. |
CVE-2021-27101 | Critical | 9.8 | 2021-02-16 | Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380… |
CVE-2021-27203 | Medium | 5.5 | 2021-02-16 | In Dekart Private Disk 2.15, invalid use of the Type3 user buffer for IOCTL codes using METHOD_NEITHER results in arbitrary memory dereferencing. |
CVE-2021-20075 | High | 7.8 | 2021-02-16 | Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for privilege escalation via configd. |
CVE-2021-20074 | High | 8.8 | 2021-02-16 | Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows users to escape the provided command line interface and execute arbitrary OS commands. |
CVE-2021-20073 | High | 8.8 | 2021-02-16 | Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for cross-site request forgeries. |
CVE-2021-20072 | High | 7.2 | 2021-02-16 | Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to arbitrarily access and delete files via an authenticated directory traveral. |
CVE-2021-20071 | Medium | 4.8 | 2021-02-16 | Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via the sms.php dialogs. |
CVE-2021-20070 | Medium | 4.8 | 2021-02-16 | Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via the virtualization.php dialogs. |
CVE-2021-20069 | Medium | 4.8 | 2021-02-16 | Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scripting attacks via the regionalSettings.php dialogs. |
CVE-2021-20068 | Medium | 4.8 | 2021-02-16 | Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scripting attacks via the error handling functionality of web p… |
CVE-2021-20067 | Medium | 5.3 | 2021-02-16 | Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to view sensitive syslog events without authentication. |
CVE-2021-20066 | Medium | 5.6 | 2021-02-16 | JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled. |
CVE-2021-27237 | Medium | 4.8 | 2021-02-16 | The admin panel in BlackCat CMS 1.3.6 allows stored XSS (by an admin) via the Display Name field to backend/preferences/ajax_save.php. |
CVE-2021-21317 | Medium | 5.3 | 2021-02-16 | uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some reg… |
CVE-2021-21316 | Medium | 6.3 | 2021-02-16 | less-openui5 is an npm package which enables building OpenUI5 themes with Less.js. In less-openui5 before version 0.10., when processing theming resources (i.e… |
CVE-2021-23841 | Medium | 5.9 | 2021-02-16 | The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained withi… |
CVE-2021-23840 | High | 7.5 | 2021-02-16 | Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the… |