2021 CVEs (page 216)
Page 216 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-3033 | Critical | 9.1 | 2021-02-10 | An improper verification of cryptographic signature vulnerability exists in the Palo Alto Networks Prisma Cloud Compute console. This vulnerability enables an… |
CVE-2021-26939 | High | 7.5 | 2021-02-10 | An information disclosure issue exists in henriquedornas 5.2.17 because an attacker can dump phpMyAdmin SQL content. NOTE: third parties report that this is a… |
CVE-2021-26938 | Medium | 5.4 | 2021-02-10 | A stored XSS issue exists in henriquedornas 5.2.17 via online live chat. NOTE: Third parties report that no such product exists. That henriquedornas is the web… |
CVE-2021-26936 | High | 7.8 | 2021-02-10 | The replay-sorcery program in ReplaySorcery 0.4.0 through 0.5.0, when using the default setuid-root configuration, allows a local attacker to escalate privileg… |
CVE-2021-20353 | High | 8.2 | 2021-02-10 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2021-0341 | High | 7.5 | 2021-02-10 | In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could le… |
CVE-2021-0340 | High | 8.8 | 2021-02-10 | In parseNextBox of IsoInterface.java, there is a possible leak of unredacted location information due to improper input validation. This could lead to remote i… |
CVE-2021-0339 | High | 7.8 | 2021-02-10 | In loadAnimation of WindowContainer.java, there is a possible way to keep displaying a malicious app while a target app is brought to the foreground. This coul… |
CVE-2021-0338 | Medium | 5.5 | 2021-02-10 | In SystemSettingsValidators, there is a possible permanent denial of service due to missing bounds checks on UI settings. This could lead to local denial of se… |
CVE-2021-0337 | High | 7.8 | 2021-02-10 | In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lead to local escalation of privilege with… |
CVE-2021-0336 | High | 7.8 | 2021-02-10 | In onReceive of BluetoothPermissionRequest.java, there is a possible permissions bypass due to a mutable PendingIntent. This could lead to local escalation of… |
CVE-2021-0335 | Medium | 6.5 | 2021-02-10 | In process of C2SoftHevcDec.cpp, there is a possible out of bounds write due to a use after free. This could lead to remote information disclosure with no addi… |
CVE-2021-0334 | High | 7.8 | 2021-02-10 | In onTargetSelected of ResolverActivity.java, there is a possible settings bypass allowing an app to become the default handler for arbitrary domains. This cou… |
CVE-2021-0333 | High | 7.3 | 2021-02-10 | In onCreate of BluetoothPermissionActivity.java, there is a possible permissions bypass due to a tapjacking overlay that obscures the phonebook permissions dia… |
CVE-2021-0332 | High | 7.8 | 2021-02-10 | In bootFinished of SurfaceFlinger.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with Use… |
CVE-2021-0331 | High | 7.3 | 2021-02-10 | In onCreate of NotificationAccessConfirmationActivity.java, there is a possible overlay attack due to an insecure default value. This could lead to local escal… |
CVE-2021-0330 | High | 7.8 | 2021-02-10 | In add_user_ce and remove_user_ce of storaged.cpp, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege… |
CVE-2021-0329 | High | 7.8 | 2021-02-10 | In several native functions called by AdvertiseManager.java, there is a possible out of bounds write due to a missing bounds check. This could lead to local es… |
CVE-2021-0328 | High | 7.8 | 2021-02-10 | In onBatchScanReports and deliverBatchScan of GattService.java, there is a possible way to retrieve Bluetooth scan results without permissions due to a missing… |
CVE-2021-0327 | High | 7.8 | 2021-02-10 | In getContentProviderImpl of ActivityManagerService.java, there is a possible permission bypass due to non-restored binder identities. This could lead to local… |
CVE-2021-0326 | High | 7.5 | 2021-02-10 | In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if the target… |
CVE-2021-0325 | High | 8.8 | 2021-02-10 | In ih264d_parse_pslice of ih264d_parse_pslice.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code executio… |
CVE-2021-0314 | High | 7.3 | 2021-02-10 | In onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed user consent due to a tapjacking/overlay attack. This could le… |
CVE-2021-0305 | High | 7.8 | 2021-02-10 | In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilege and permissions w… |
CVE-2021-0302 | High | 7.8 | 2021-02-10 | In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilege and permissions w… |
CVE-2021-27135 | Critical | 9.8 | 2021-02-10 | xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining chara… |
CVE-2021-23881 | Medium | 4.8 | 2021-02-10 | A stored cross site scripting vulnerability in ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 February 2021 Update allows an ENS ePO administr… |
CVE-2021-23876 | High | 7.8 | 2021-02-10 | Bypass Remote Procedure call in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and perform arbitrary file modif… |
CVE-2021-23874 | High | 8.2 | 2021-02-10 | Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitra… |
CVE-2021-23873 | High | 7.8 | 2021-02-10 | Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and perform arbitrary file… |
CVE-2021-23883 | Medium | 4.0 | 2021-02-10 | A Null Pointer Dereference vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows a local administrator to cau… |
CVE-2021-23882 | High | 8.2 | 2021-02-10 | Improper Access Control vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows local administrators to prevent… |
CVE-2021-23880 | Medium | 6.7 | 2021-02-10 | Improper Access Control in attribute in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows authenticated local administrato… |
CVE-2021-23878 | High | 7.3 | 2021-02-10 | Clear text storage of sensitive Information in memory vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows a… |
CVE-2021-20654 | Medium | 5.4 | 2021-02-10 | Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scripting. This is named 'Fieldbleed' in the… |
CVE-2021-26958 | High | 8.8 | 2021-02-09 | An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because transmutation to the wrong type can happen after xcb… |
CVE-2021-26957 | Critical | 9.8 | 2021-02-09 | An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because there is an out-of-bounds read in xcb::xproto::chang… |
CVE-2021-26956 | Critical | 9.8 | 2021-02-09 | An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because bytes from an X server can be interpreted as any dat… |
CVE-2021-26955 | Critical | 9.8 | 2021-02-09 | An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str… |
CVE-2021-26954 | Medium | 5.3 | 2021-02-09 | An issue was discovered in the qwutils crate before 0.3.1 for Rust. When a Clone panic occurs, insert_slice_clone can perform a double drop. |
CVE-2021-26953 | High | 7.5 | 2021-02-09 | An issue was discovered in the postscript crate before 0.14.0 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory loca… |
CVE-2021-26952 | High | 7.5 | 2021-02-09 | An issue was discovered in the ms3d crate before 0.1.3 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory locations v… |
CVE-2021-26951 | Critical | 9.8 | 2021-02-09 | An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::set_len is used witho… |
CVE-2021-21502 | Critical | 9.8 | 2021-02-09 | Dell PowerScale OneFS versions 8.1.0 – 9.1.0 contain a "use of SSH key past account expiration" vulnerability. A user on the network with the ISI_PRIV_AUTH_SSH… |
CVE-2021-21479 | Critical | 9.1 | 2021-02-09 | In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity of the system. |
CVE-2021-21478 | Medium | 6.1 | 2021-02-09 | SAP Web Dynpro ABAP allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities. |
CVE-2021-21477 | Critical | 9.9 | 2021-02-09 | SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with th… |
CVE-2021-21476 | Medium | 6.1 | 2021-02-09 | SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect users to a malicious… |
CVE-2021-21475 | High | 7.5 | 2021-02-09 | Under specific circumstances SAP Master Data Management, versions - 710, 710.750, allows an unauthorized attacker to exploit insufficient validation of path in… |
CVE-2021-21474 | Medium | 6.5 | 2021-02-09 | SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Assertion issued for a… |
CVE-2021-21472 | High | 8.8 | 2021-02-09 | SAP Software Provisioning Manager 1.0 (SAP NetWeaver Master Data Management Server 7.1) does not have an option to set password during its installation, this a… |
CVE-2021-21444 | Medium | 6.1 | 2021-02-09 | SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictab… |
CVE-2021-26937 | Critical | 9.8 | 2021-02-09 | encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspe… |
CVE-2021-26551 | High | 8.8 | 2021-02-09 | An issue was discovered in SmartFoxServer 2.17.0. An attacker can execute arbitrary Python code, and bypass the javashell.py protection mechanism, by creating… |
CVE-2021-26550 | Medium | 5.5 | 2021-02-09 | An issue was discovered in SmartFoxServer 2.17.0. Cleartext password disclosure can occur via /config/server.xml. |
CVE-2021-26549 | Medium | 5.4 | 2021-02-09 | An XSS issue was discovered in SmartFoxServer 2.17.0. Input passed to the AdminTool console is not properly sanitized before being returned to the user. This c… |
CVE-2021-3191 | High | 8.8 | 2021-02-09 | Idelji Web ViewPoint Suite, as used in conjunction with HPE NonStop, allows Remote Unauthorized Access for T0320L01^ABY and T0320L01^ACD, T0952L01^AAR through… |
CVE-2021-22267 | Medium | 5.9 | 2021-02-09 | Idelji Web ViewPoint Suite, as used in conjunction with HPE NonStop, allows a remote replay attack for T0320L01^ABP through T0320L01^ABZ, T0952L01^AAH through… |
CVE-2021-25666 | Medium | 4.3 | 2021-02-09 | A vulnerability has been identified in SCALANCE W780 and W740 (IEEE 802.11n) family (All versions < V6.3). Sending specially crafted packets through the ARP pr… |
CVE-2021-25141 | Medium | 4.4 | 2021-02-09 | A security vulnerability has been identified in in certain HPE and Aruba L2/L3 switch firmware. A data processing error due to improper handling of an unexpect… |
CVE-2021-25140 | Critical | 9.8 | 2021-02-09 | A potential security vulnerability has been identified in the HPE Moonshot Provisioning Manager v1.20. The HPE Moonshot Provisioning Manager is an application… |
CVE-2021-25139 | Critical | 9.8 | 2021-02-09 | A potential security vulnerability has been identified in the HPE Moonshot Provisioning Manager v1.20. The HPE Moonshot Provisioning Manager is an application… |
CVE-2021-22663 | High | 7.8 | 2021-02-09 | Cscape (All versions prior to 9.90 SP3.5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds read. A… |
CVE-2021-26676 | Medium | 6.5 | 2021-02-09 | gdhcp in ConnMan before 1.39 could be used by network-adjacent attackers to leak sensitive stack information, allowing further exploitation of bugs in gdhcp. |
CVE-2021-26675 | High | 8.8 | 2021-02-09 | A stack-based buffer overflow in dnsproxy in ConnMan before 1.39 could be used by network adjacent attackers to execute code. |
CVE-2021-21148 | High | 8.8 | 2021-02-09 | Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-3394 | High | 8.8 | 2021-02-09 | Millennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1 has insecure folder permissions allowing a malicious user for… |
CVE-2021-26921 | Medium | 6.5 | 2021-02-09 | In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled. |
CVE-2021-21147 | Medium | 4.3 | 2021-02-09 | Inappropriate implementation in Skia in Google Chrome prior to 88.0.4324.146 allowed a local attacker to spoof the contents of the Omnibox (URL bar) via a craf… |
CVE-2021-21146 | Critical | 9.6 | 2021-02-09 | Use after free in Navigation in Google Chrome prior to 88.0.4324.146 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2021-21145 | High | 8.8 | 2021-02-09 | Use after free in Fonts in Google Chrome prior to 88.0.4324.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21144 | High | 8.8 | 2021-02-09 | Heap buffer overflow in Tab Groups in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious extension to potenti… |
CVE-2021-21143 | High | 8.8 | 2021-02-09 | Heap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious extension to potenti… |
CVE-2021-21142 | Critical | 9.6 | 2021-02-09 | Use after free in Payments in Google Chrome on Mac prior to 88.0.4324.146 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML… |
CVE-2021-26719 | Medium | 6.5 | 2021-02-09 | A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and… |
CVE-2021-21141 | Medium | 6.5 | 2021-02-09 | Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass file extension policy via a craft… |
CVE-2021-21140 | Medium | 6.8 | 2021-02-09 | Uninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially perform out of bounds memory access via via a USB devic… |
CVE-2021-21139 | Medium | 6.5 | 2021-02-09 | Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass navigation restrictions via a crafted… |
CVE-2021-21138 | High | 8.6 | 2021-02-09 | Use after free in DevTools in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially perform a sandbox escape via a crafted file. |
CVE-2021-21137 | Medium | 6.5 | 2021-02-09 | Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to obtain potentially sensitive information from disk… |
CVE-2021-21136 | Medium | 6.5 | 2021-02-09 | Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2021-21135 | Medium | 6.5 | 2021-02-09 | Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML p… |
CVE-2021-21134 | Medium | 6.5 | 2021-02-09 | Incorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2021-21133 | Medium | 6.5 | 2021-02-09 | Insufficient policy enforcement in Downloads in Google Chrome prior to 88.0.4324.96 allowed an attacker who convinced a user to download files to bypass naviga… |
CVE-2021-21132 | Critical | 9.6 | 2021-02-09 | Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted… |
CVE-2021-21131 | Medium | 6.5 | 2021-02-09 | Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a cra… |
CVE-2021-21130 | Medium | 6.5 | 2021-02-09 | Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a cra… |
CVE-2021-21129 | Medium | 6.5 | 2021-02-09 | Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a cra… |
CVE-2021-21128 | High | 8.8 | 2021-02-09 | Heap buffer overflow in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21127 | High | 8.8 | 2021-02-09 | Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass content security policy via a crafted… |
CVE-2021-21126 | Medium | 6.5 | 2021-02-09 | Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass site isolation via a crafted Chrome Ex… |
CVE-2021-21125 | High | 8.1 | 2021-02-09 | Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restriction… |
CVE-2021-21124 | Critical | 9.6 | 2021-02-09 | Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox esc… |
CVE-2021-21123 | Medium | 6.5 | 2021-02-09 | Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafte… |
CVE-2021-21122 | High | 8.8 | 2021-02-09 | Use after free in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21121 | Critical | 9.6 | 2021-02-09 | Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML… |
CVE-2021-21120 | High | 8.8 | 2021-02-09 | Use after free in WebSQL in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21119 | High | 8.8 | 2021-02-09 | Use after free in Media in Google Chrome prior to 88.0.4324.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap c… |
CVE-2021-21118 | High | 8.8 | 2021-02-09 | Insufficient data validation in V8 in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform out of bounds memory access via a cr… |
CVE-2021-21117 | High | 7.8 | 2021-02-09 | Insufficient policy enforcement in Cryptohome in Google Chrome prior to 88.0.4324.96 allowed a local attacker to perform OS-level privilege escalation via a cr… |