2021 CVEs (page 214)
Page 214 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-23839 | Low | 3.7 | 2021-02-16 | OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versio… |
CVE-2021-21315 | High | 7.1 | 2021-02-16 | The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system an… |
CVE-2021-20987 | High | 8.6 | 2021-02-16 | A denial of service and memory corruption vulnerability was found in Hilscher EtherNet/IP Core V2 prior to V2.13.0.21that may lead to code injection through ne… |
CVE-2021-20986 | High | 7.5 | 2021-02-16 | A Denial of Service vulnerability was found in Hilscher PROFINET IO Device V3 in versions prior to V3.14.0.7. This may lead to unexpected loss of cyclic commun… |
CVE-2021-27232 | High | 8.8 | 2021-02-16 | The RTSPLive555.dll ActiveX control in Pelco Digital Sentry Server 7.18.72.11464 has a SetCameraConnectionParameter stack-based buffer overflow. This can be ex… |
CVE-2021-25648 | Critical | 9.8 | 2021-02-16 | Mobile application "Testes de Codigo" 11.4 and prior allows an attacker to gain access to the administrative interface and premium features by tampering the bo… |
CVE-2021-27236 | Critical | 9.8 | 2021-02-16 | An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. getfile.asp allows Unauthenticated Local File Inclusion, which can be leveraged to achieve Remo… |
CVE-2021-27235 | Medium | 4.9 | 2021-02-16 | An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. On the admin portal of the web application, there is a functionality at diagzip.asp that allows… |
CVE-2021-27234 | Critical | 9.8 | 2021-02-16 | An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. The web application suffers from SQL injection on Adminlog.asp, Archivemsgs.asp, Deletelog.asp… |
CVE-2021-27233 | Medium | 4.9 | 2021-02-16 | An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. On the admin portal of the web application, password information for external systems is visibl… |
CVE-2021-27231 | Medium | 5.4 | 2021-02-16 | Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different custom… |
CVE-2021-27229 | High | 8.8 | 2021-02-16 | Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text. |
CVE-2021-21511 | High | 8.1 | 2021-02-15 | Dell EMC Avamar Server, versions 19.3 and 19.4 contain an Improper Authorization vulnerability in the web UI. A remote low privileged attacker could potentiall… |
CVE-2021-3239 | Critical | 9.8 | 2021-02-15 | E-Learning System 1.0 suffers from an unauthenticated SQL injection vulnerability, which allows remote attackers to execute arbitrary code on the hosting web s… |
CVE-2021-26822 | Critical | 9.8 | 2021-02-15 | Teachers Record Management System 1.0 is affected by a SQL injection vulnerability in 'searchteacher' POST parameter in search-teacher.php. This vulnerability… |
CVE-2021-26201 | Critical | 9.8 | 2021-02-15 | The Login Panel of CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection authentication bypass. An attacker can obtain access to the admin panel… |
CVE-2021-26200 | Critical | 9.8 | 2021-02-15 | The user area for Library System 1.0 is vulnerable to SQL injection where a user can bypass the authentication and login as the admin user. |
CVE-2021-27211 | High | 7.5 | 2021-02-15 | steghide 0.5.1 relies on a certain 32-bit seed value, which makes it easier for attackers to detect hidden data. |
CVE-2021-27201 | High | 8.8 | 2021-02-15 | Endian Firewall Community (aka EFW) 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment. |
CVE-2021-3375 | Critical | 9.8 | 2021-02-15 | ActivePresenter 6.1.6 is affected by a memory corruption vulnerability that may result in a denial of service (DoS) or arbitrary code execution. |
CVE-2021-27219 | High | 7.5 | 2021-02-15 | An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an im… |
CVE-2021-27218 | High | 7.5 | 2021-02-15 | An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit pl… |
CVE-2021-23338 | Medium | 6.6 | 2021-02-15 | This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function. |
CVE-2021-25299 | Medium | 6.1 | 2021-02-15 | Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to im… |
CVE-2021-25298 | High | 8.8 | 2021-02-15 | Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/c… |
CVE-2021-25297 | High | 8.8 | 2021-02-15 | Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/swi… |
CVE-2021-25296 | High | 8.8 | 2021-02-15 | Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi… |
CVE-2021-23337 | High | 7.2 | 2021-02-15 | Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. |
CVE-2021-23336 | Medium | 5.9 | 2021-02-15 | The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to W… |
CVE-2021-21702 | Medium | 5.3 | 2021-02-15 | In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server co… |
CVE-2021-27213 | Critical | 9.8 | 2021-02-14 | config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safe_load are not used. |
CVE-2021-26929 | Medium | 6.1 | 2021-02-14 | An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used). The attacker can send… |
CVE-2021-27212 | High | 7.5 | 2021-02-14 | In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet… |
CVE-2021-27210 | Medium | 6.5 | 2021-02-13 | TP-Link Archer C5v 1.7_181221 devices allows remote attackers to retrieve cleartext credentials via [USER_CFG#0,0,0,0,0,0#0,0,0,0,0,0]0,0 to the /cgi?1&5 URI. |
CVE-2021-27209 | High | 7.1 | 2021-02-13 | In the management interface on TP-Link Archer C5v 1.7_181221 devices, credentials are sent in a base64 format over cleartext HTTP. |
CVE-2021-26753 | Critical | 9.9 | 2021-02-12 | NeDi 1.9C allows an authenticated user to inject PHP code in the System Files function on the endpoint /System-Files.php via the txt HTTP POST parameter. This… |
CVE-2021-26752 | High | 8.8 | 2021-02-12 | NeDi 1.9C allows an authenticated user to execute operating system commands in the Nodes Traffic function on the endpoint /Nodes-Traffic.php via the md or ag H… |
CVE-2021-26751 | High | 8.8 | 2021-02-12 | NeDi 1.9C allows an authenticated user to perform a SQL Injection in the Monitoring History function on the endpoint /Monitoring-History.php via the det HTTP G… |
CVE-2021-22984 | Medium | 6.1 | 2021-02-12 | On BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.x before 13.1.3.4, 12.1.x before 12.1.5.2… |
CVE-2021-22978 | High | 8.3 | 2021-02-12 | On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x and 11.6.x versions, undisclosed e… |
CVE-2021-22977 | High | 7.5 | 2021-02-12 | On BIG-IP version 16.0.0-16.0.1 and 14.1.2.4-14.1.3, cooperation between malicious HTTP client code and a malicious server may cause TMM to restart and generat… |
CVE-2021-22504 | Critical | 9.8 | 2021-02-12 | Arbitrary code execution vulnerability on Micro Focus Operations Bridge Manager product, affecting versions 10.1x, 10.6x, 2018.05, 2018.11, 2019.05, 2019.11, 2… |
CVE-2021-22985 | High | 7.5 | 2021-02-12 | On BIG-IP APM version 16.0.x before 16.0.1.1, under certain conditions, when processing VPN traffic with APM, TMM consumes excessive memory. A malicious, authe… |
CVE-2021-22983 | Medium | 5.4 | 2021-02-12 | On BIG-IP AFM version 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.5, authenticated users accessing the Configuration utility for AFM… |
CVE-2021-22982 | High | 7.2 | 2021-02-12 | On BIG-IP DNS and GTM version 13.1.x before 13.1.0.4, and all versions of 12.1.x and 11.6.x, big3d does not securely handle and parse certain payloads resultin… |
CVE-2021-22981 | Medium | 4.8 | 2021-02-12 | On all versions of BIG-IP 12.1.x and 11.6.x, the original TLS protocol includes a weakness in the master secret negotiation that is mitigated by the Extended M… |
CVE-2021-22980 | High | 7.8 | 2021-02-12 | In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM… |
CVE-2021-22979 | Medium | 6.1 | 2021-02-12 | On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions, a reflected Cross-Site S… |
CVE-2021-22976 | High | 7.5 | 2021-02-12 | On BIG-IP Advanced WAF and ASM version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and all 12.1.x versions, w… |
CVE-2021-22975 | High | 7.5 | 2021-02-12 | On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, and 14.1.x before 14.1.3.1, under some circumstances, Traffic Management Microkernel (TMM) ma… |
CVE-2021-22974 | High | 7.5 | 2021-02-12 | On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6 and all versions of BIG-IQ 7.x and 6.x, an a… |
CVE-2021-22973 | High | 7.5 | 2021-02-12 | On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x versions, JSON parser function d… |
CVE-2021-20412 | High | 7.5 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbou… |
CVE-2021-20411 | High | 8.1 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user to impersonate another user on the system due to incorrectly updating the session iden… |
CVE-2021-20410 | Medium | 5.3 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 sends user credentials in plain clear text which can be read by an authenticated user using man in the mi… |
CVE-2021-20409 | Medium | 5.9 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable H… |
CVE-2021-20408 | Medium | 5.5 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 could disclose highly sensitive information to a local user due to inproper storage of a plaintext crypto… |
CVE-2021-20407 | Medium | 5.3 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 discloses sensitive information in source code that could be used in further attacks against the system… |
CVE-2021-20406 | Low | 2.2 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti… |
CVE-2021-27197 | High | 8.1 | 2021-02-12 | DSUtility.dll in Pelco Digital Sentry Server before 7.19.67 has an arbitrary file write vulnerability. The AppendToTextFile method doesn't check if it's being… |
CVE-2021-27205 | Medium | 5.5 | 2021-02-12 | Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed messages in a sandbox path, leading to sensitive information disclosure. |
CVE-2021-27204 | Medium | 5.5 | 2021-02-12 | Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure. |
CVE-2021-27188 | High | 7.5 | 2021-02-12 | The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service (access suspended for five hours) by making f… |
CVE-2021-27187 | High | 7.5 | 2021-02-12 | The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 stores authentication credentials in cleartext in login.sav when the Save Password box is c… |
CVE-2021-20651 | Critical | 9.1 | 2021-02-12 | Directory traversal vulnerability in ELECOM File Manager all versions allows remote attackers to create an arbitrary file or overwrite an existing file in a di… |
CVE-2021-20650 | Medium | 6.5 | 2021-02-12 | Cross-site request forgery (CSRF) vulnerability in ELECOM NCC-EWF100RMWH2 allows remote attackers to hijack the authentication of administrators and execute an… |
CVE-2021-20649 | Medium | 4.8 | 2021-02-12 | ELECOM WRC-300FEBK-S contains an improper certificate validation vulnerability. Via a man-in-the-middle attack, an attacker may alter the communication respons… |
CVE-2021-20648 | Medium | 6.8 | 2021-02-12 | ELECOM WRC-300FEBK-S allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors. |
CVE-2021-20647 | Medium | 6.5 | 2021-02-12 | Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-S allows remote attackers to hijack the authentication of administrators and execute an a… |
CVE-2021-20646 | Medium | 6.5 | 2021-02-12 | Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-A allows remote attackers to hijack the authentication of administrators and execute an a… |
CVE-2021-20645 | Medium | 5.4 | 2021-02-12 | Cross-site scripting vulnerability in ELECOM WRC-300FEBK-A allows remote authenticated attackers to inject arbitrary script via unspecified vectors. |
CVE-2021-20644 | Medium | 6.1 | 2021-02-12 | ELECOM WRC-1467GHBK-A allows arbitrary scripts to be executed on the user's web browser by displaying a specially crafted SSID on the web setup page. |
CVE-2021-20643 | High | 7.5 | 2021-02-12 | Improper access control vulnerability in ELECOM LD-PS/U1 allows remote attackers to change the administrative password of the affected device by processing a s… |
CVE-2021-20642 | Medium | 6.5 | 2021-02-12 | Improper check or handling of exceptional conditions in LOGITEC LAN-W300N/RS allows a remote attacker to cause a denial-of-service (DoS) condition by sending a… |
CVE-2021-20641 | Medium | 6.5 | 2021-02-12 | Cross-site request forgery (CSRF) vulnerability in LOGITEC LAN-W300N/RS allows remote attackers to hijack the authentication of administrators via a specially… |
CVE-2021-20640 | Medium | 6.8 | 2021-02-12 | Buffer overflow vulnerability in LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute an arbitrary OS command via unspecified vec… |
CVE-2021-20639 | Medium | 6.8 | 2021-02-12 | LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors. |
CVE-2021-20638 | Medium | 6.8 | 2021-02-12 | LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors. |
CVE-2021-20637 | Medium | 6.5 | 2021-02-12 | Improper check or handling of exceptional conditions in LOGITEC LAN-W300N/PR5B allows a remote attacker to cause a denial-of-service (DoS) condition by sending… |
CVE-2021-20636 | Medium | 6.5 | 2021-02-12 | Cross-site request forgery (CSRF) vulnerability in LOGITEC LAN-W300N/PR5B allows remote attackers to hijack the authentication of administrators via a speciall… |
CVE-2021-20635 | Medium | 6.5 | 2021-02-12 | Improper restriction of excessive authentication attempts in LOGITEC LAN-WH450N/GR allows an attacker in the wireless range of the device to recover PIN and ac… |
CVE-2021-27190 | Medium | 5.4 | 2021-02-12 | A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input contain… |
CVE-2021-21310 | Medium | 6.1 | 2021-02-11 | NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. In next-auth before version 3.3.0 there is a token verification vul… |
CVE-2021-21976 | High | 7.2 | 2021-02-11 | vSphere Replication 8.3.x prior to 8.3.1.2, 8.2.x prior to 8.2.1.1, 8.1.x prior to 8.1.2.3 and 6.5.x prior to 6.5.1.5 contain a post-authentication command inj… |
CVE-2021-21311 | High | 7.2 | 2021-02-11 | Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulne… |
CVE-2021-21063 | High | 7.8 | 2021-02-11 | Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Memory corrup… |
CVE-2021-21062 | High | 7.8 | 2021-02-11 | Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Memory corrup… |
CVE-2021-21059 | High | 7.8 | 2021-02-11 | Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Memory corrup… |
CVE-2021-21058 | High | 7.8 | 2021-02-11 | Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Memory corrup… |
CVE-2021-21055 | Medium | 6.2 | 2021-02-11 | Adobe Dreamweaver versions 21.0 (and earlier) and 20.2 (and earlier) is affected by an untrusted search path vulnerability that could result in information dis… |
CVE-2021-21054 | High | 7.8 | 2021-02-11 | Adobe Illustrator version 25.1 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could… |
CVE-2021-21053 | High | 7.8 | 2021-02-11 | Adobe Illustrator version 25.1 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could… |
CVE-2021-21052 | High | 7.8 | 2021-02-11 | Adobe Animate version 21.0.2 (and earlier) is affected by an Out-of-bounds Write vulnerability. An unauthenticated attacker could leverage this vulnerability t… |
CVE-2021-21051 | High | 7.8 | 2021-02-11 | Adobe Photoshop versions 21.2.4 (and earlier) and 22.1.1 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted javascr… |
CVE-2021-21050 | High | 7.8 | 2021-02-11 | Adobe Photoshop versions 21.2.4 (and earlier) and 22.1.1 (and earlier) are affected by an Out-of-bounds Read vulnerability when parsing a specially crafted fil… |
CVE-2021-21049 | High | 7.8 | 2021-02-11 | Adobe Photoshop versions 21.2.4 (and earlier) and 22.1.1 (and earlier) are affected by an Out-of-bounds Read vulnerability when parsing a specially crafted fil… |
CVE-2021-21048 | High | 7.8 | 2021-02-11 | Adobe Photoshop versions 21.2.4 (and earlier) and 22.1.1 (and earlier) are affected by a Memory Corruption vulnerability when parsing a specially crafted file… |
CVE-2021-21047 | High | 7.8 | 2021-02-11 | Adobe Photoshop versions 21.2.4 (and earlier) and 22.1.1 (and earlier) are affected by an Out-of-bounds Write vulnerability. An unauthenticated attacker could… |
CVE-2021-21014 | Critical | 9.1 | 2021-02-11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitatio… |
CVE-2021-21061 | Low | 3.3 | 2021-02-11 | Acrobat Pro DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Use-after-free v… |