2021 CVEs (page 217)
Page 217 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-26925 | Medium | 5.4 | 2021-02-09 | Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering. |
CVE-2021-23327 | Medium | 6.3 | 2021-02-09 | The package apexcharts before 3.24.0 are vulnerable to Cross-site Scripting (XSS) via lack of sanitization of graph legend fields. |
CVE-2021-26918 | Critical | 9.8 | 2021-02-09 | The ProBot bot through 2021-02-08 for Discord might allow attackers to interfere with the intended purpose of the "Send an image when a user joins the server"… |
CVE-2021-3294 | Medium | 5.4 | 2021-02-09 | CASAP Automated Enrollment System 1.0 is affected by cross-site scripting (XSS) in users.php. An attacker can steal a cookie to perform user redirection to a m… |
CVE-2021-26917 | Medium | 5.5 | 2021-02-08 | PyBitmessage through 0.6.3.2 allows attackers to write screen captures to Potentially Unwanted Directories via a crafted apinotifypath value. NOTE: the discove… |
CVE-2021-26916 | Medium | 6.1 | 2021-02-08 | In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML through the Filters/… |
CVE-2021-26915 | High | 8.1 | 2021-02-08 | NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserializati… |
CVE-2021-26914 | High | 8.1 | 2021-02-08 | NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserializati… |
CVE-2021-26913 | High | 8.1 | 2021-02-08 | NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserializati… |
CVE-2021-26912 | High | 8.1 | 2021-02-08 | NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserializati… |
CVE-2021-25913 | Critical | 9.8 | 2021-02-08 | Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code exec… |
CVE-2021-22502 | Critical | 9.8 | 2021-02-08 | Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to al… |
CVE-2021-21306 | Medium | 5.3 | 2021-02-08 | Marked is an open-source markdown parser and compiler (npm package "marked"). In marked from version 1.1.1 and before version 2.0.0, there is a Regular express… |
CVE-2021-26576 | High | 7.8 | 2021-02-08 | The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability in libifc.so uploads… |
CVE-2021-26530 | Critical | 9.1 | 2021-02-08 | The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OOB write attack via connection request a… |
CVE-2021-26529 | Critical | 9.1 | 2021-02-08 | The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write attack via connect… |
CVE-2021-26528 | Critical | 9.1 | 2021-02-08 | The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connection request after exhausting memory poo… |
CVE-2021-26222 | High | 8.1 | 2021-02-08 | The ezxml_new function in ezXML 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool. |
CVE-2021-26221 | High | 8.1 | 2021-02-08 | The ezxml_new function in ezXML 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool. |
CVE-2021-26220 | High | 8.1 | 2021-02-08 | The ezxml_toxml function in ezxml 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool. |
CVE-2021-26910 | High | 7.8 | 2021-02-08 | Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an Overl… |
CVE-2021-26905 | Medium | 6.5 | 2021-02-08 | 1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key. |
CVE-2021-26577 | High | 7.8 | 2021-02-08 | The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so uploadsshkey func… |
CVE-2021-26575 | High | 7.8 | 2021-02-08 | The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a path traversal vulnerability in libifc.so webdeletes… |
CVE-2021-26574 | High | 7.8 | 2021-02-08 | The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a path traversal vulnerability in libifc.so webdeletev… |
CVE-2021-26573 | High | 7.8 | 2021-02-08 | The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webgeneratesslcfg… |
CVE-2021-25172 | High | 7.8 | 2021-02-08 | The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability in libifc.so websetd… |
CVE-2021-21305 | High | 7.4 | 2021-02-08 | CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and… |
CVE-2021-21290 | Medium | 6.2 | 2021-02-08 | Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clie… |
CVE-2021-21288 | Medium | 4.3 | 2021-02-08 | CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and… |
CVE-2021-21240 | High | 7.5 | 2021-02-08 | httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" cha… |
CVE-2021-26572 | High | 7.8 | 2021-02-08 | The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webgetactivexcfg… |
CVE-2021-26571 | High | 7.8 | 2021-02-08 | The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webgetactivexcfg… |
CVE-2021-26570 | High | 7.8 | 2021-02-08 | The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webifc_setadconfi… |
CVE-2021-25171 | High | 7.8 | 2021-02-08 | The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so websetlicensecfg… |
CVE-2021-25170 | High | 7.8 | 2021-02-08 | The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so websetremoteimage… |
CVE-2021-25169 | High | 7.8 | 2021-02-08 | The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so websetservicecfg… |
CVE-2021-25168 | High | 7.8 | 2021-02-08 | The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webupdatecomponen… |
CVE-2021-25837 | High | 7.5 | 2021-02-08 | Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. Due to the inconsistency between the Storage caching cycle a… |
CVE-2021-25836 | High | 7.5 | 2021-02-08 | Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. The bytecode set in a FAILED transaction wrongfully remains… |
CVE-2021-25835 | High | 7.5 | 2021-02-08 | Cosmos Network Ethermint <= v0.4.0 is affected by a cross-chain transaction replay vulnerability in the EVM module. Since ethermint uses the same chainIDEpoch… |
CVE-2021-25834 | High | 7.5 | 2021-02-08 | Cosmos Network Ethermint <= v0.4.0 is affected by a transaction replay vulnerability in the EVM module. If the victim sends a very large nonce transaction, the… |
CVE-2021-25142 | High | 7.8 | 2021-02-08 | The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webstartflash fun… |
CVE-2021-21304 | High | 7.2 | 2021-02-08 | Dynamoose is an open-source modeling tool for Amazon's DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulne… |
CVE-2021-26541 | Critical | 9.8 | 2021-02-08 | The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability. |
CVE-2021-26540 | Medium | 5.3 | 2021-02-08 | Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRel… |
CVE-2021-26539 | Medium | 5.3 | 2021-02-08 | Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostnam… |
CVE-2021-22122 | Medium | 6.1 | 2021-02-08 | An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthentica… |
CVE-2021-3293 | Medium | 5.3 | 2021-02-08 | emlog v5.3.1 has full path disclosure vulnerability in t/index.php, which allows an attacker to see the path to the webroot/file. |
CVE-2021-26826 | High | 7.8 | 2021-02-08 | A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary checks when loading .TGA image files. Depending on the context of t… |
CVE-2021-26825 | High | 7.8 | 2021-02-08 | An integer overflow issue exists in Godot Engine up to v3.2 that can be triggered when loading specially crafted.TGA image files. The vulnerability exists in I… |
CVE-2021-20359 | Medium | 6.5 | 2021-02-08 | IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 - Business Automation Application Designer Component stores potentially sensitive information in log files th… |
CVE-2021-20358 | Medium | 6.5 | 2021-02-08 | IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 stores potentially sensitive information in clear text in API connection log files. This information could be… |
CVE-2021-21436 | Low | 3.5 | 2021-02-08 | Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7… |
CVE-2021-21435 | Medium | 5.7 | 2021-02-08 | Article Bcc fields and agent personal information are shown when customer prints the ticket (PDF) via external interface. This issue affects: OTRS AG OTRS 7.0… |
CVE-2021-21434 | Low | 3.5 | 2021-02-08 | Survey administrator can craft a survey in such way that malicious code can be executed in the agent interface (i.e. another agent who wants to make changes in… |
CVE-2021-26754 | Critical | 9.8 | 2021-02-08 | wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=get_wdtable order[0][dir] SQL injection. |
CVE-2021-22161 | Medium | 6.5 | 2021-02-07 | In OpenWrt 19.07.x before 19.07.7, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upst… |
CVE-2021-26843 | High | 7.5 | 2021-02-07 | An issue was discovered in sthttpd through 2.27.1. On systems where the strcpy function is implemented with memcpy, the de_dotdot function may cause a Denial-o… |
CVE-2021-3122 | Critical | 9.8 | 2021-02-07 | CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089)… |
CVE-2021-26723 | Medium | 6.1 | 2021-02-06 | Jenzabar 9.2.x through 9.2.2 allows /ics?tool=search&query= XSS. |
CVE-2021-22305 | Low | 3.3 | 2021-02-06 | There is a buffer overflow vulnerability in Mate 30 10.1.0.126(C00E125R5P3). A module does not verify the some input when dealing with messages. Attackers can… |
CVE-2021-22304 | Low | 3.3 | 2021-02-06 | There is a use after free vulnerability in Taurus-AL00A 10.0.0.1(C00E1R1P1). A module may refer to some memory after it has been freed while dealing with some… |
CVE-2021-22302 | High | 7.1 | 2021-02-06 | There is an out-of-bound read vulnerability in Taurus-AL00A 10.0.0.1(C00E1R1P1). A module does not verify the some input. Attackers can exploit this vulnerabil… |
CVE-2021-22293 | High | 7.5 | 2021-02-06 | Some Huawei products have an inconsistent interpretation of HTTP requests vulnerability. Attackers can exploit this vulnerability to cause information leak. Af… |
CVE-2021-22292 | High | 7.5 | 2021-02-06 | There is a denial of service (DoS) vulnerability in eCNS280 versions V100R005C00, V100R005C10. Due to a design defect, remote unauthorized attackers send a lar… |
CVE-2021-22500 | Medium | 6.5 | 2021-02-06 | Cross Site Request Forgery vulnerability in Micro Focus Application Performance Management product, affecting versions 9.40, 9.50 and 9.51. The vulnerability c… |
CVE-2021-22299 | High | 7.8 | 2021-02-06 | There is a local privilege escalation vulnerability in some Huawei products. A local, authenticated attacker could craft specific commands to exploit this vuln… |
CVE-2021-22298 | Medium | 6.5 | 2021-02-06 | There is a logic vulnerability in Huawei Gauss100 OLTP Product. An attacker with certain permissions could perform specific SQL statement to exploit this vulne… |
CVE-2021-22499 | Medium | 4.8 | 2021-02-06 | Persistent Cross-Site scripting vulnerability in Micro Focus Application Performance Management product, affecting versions 9.40, 9.50 and 9.51. The vulnerabil… |
CVE-2021-22306 | Medium | 4.6 | 2021-02-06 | There is an out-of-bound read vulnerability in Mate 30 10.0.0.182(C00E180R6P2). A module does not verify the some input when dealing with messages. Attackers c… |
CVE-2021-22303 | Low | 3.3 | 2021-02-06 | There is a pointer double free vulnerability in Taurus-AL00A 10.0.0.1(C00E1R1P1). There is a lack of muti-thread protection when a function is called. Attacker… |
CVE-2021-22300 | Medium | 4.1 | 2021-02-06 | There is an information leak vulnerability in eCNS280_TD versions V100R005C00 and V100R005C10. A command does not have timeout exit mechanism. Temporary file c… |
CVE-2021-22307 | Medium | 5.5 | 2021-02-06 | There is a weak algorithm vulnerability in Mate 3010.0.0.203(C00E201R7P2). The protection is insufficient for the modules that should be protected. Local attac… |
CVE-2021-22301 | Medium | 6.7 | 2021-02-06 | Mate 30 10.0.0.203(C00E201R7P2) have a buffer overflow vulnerability. After obtaining the root permission, an attacker can exploit the vulnerability to cause b… |
CVE-2021-20176 | Medium | 5.5 | 2021-02-06 | A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file that is processed by I… |
CVE-2021-3229 | High | 7.5 | 2021-02-05 | Denial of service in ASUSWRT ASUS RT-AX3000 firmware versions 3.0.0.4.384_10177 and earlier versions allows an attacker to disrupt the use of device setup serv… |
CVE-2021-21303 | Medium | 5.9 | 2021-02-05 | Helm is open-source software which is essentially "The Kubernetes Package Manager". Helm is a tool for managing Charts. Charts are packages of pre-configured K… |
CVE-2021-1072 | Medium | 6.0 | 2021-02-05 | NVIDIA GeForce Experience, all versions prior to 3.21, contains a vulnerability in GameStream (rxdiag.dll) where an arbitrary file deletion due to improper han… |
CVE-2021-26722 | Medium | 6.1 | 2021-02-05 | LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar. |
CVE-2021-3382 | High | 7.5 | 2021-02-05 | Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors related to a file pa… |
CVE-2021-3258 | Medium | 5.4 | 2021-02-05 | Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting (XSS), which may lead to arbitrary remote code execution. |
CVE-2021-3333 | Medium | 6.1 | 2021-02-05 | Opmantek Open-AudIT 4.0.1 is affected by cross-site scripting (XSS). When outputting SQL statements for debugging, a maliciously crafted query can trigger an X… |
CVE-2021-3311 | Critical | 9.8 | 2021-02-05 | An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: t… |
CVE-2021-26711 | Medium | 5.3 | 2021-02-05 | A frame-injection issue in the online help in Redwood Report2Web 4.3.4.5 allows remote attackers to render an external resource inside a frame via the help/Onl… |
CVE-2021-26710 | Medium | 6.1 | 2021-02-05 | A cross-site scripting (XSS) issue in the login panel in Redwood Report2Web 4.3.4.5 and 4.5.3 allows remote attackers to inject JavaScript via the signIn.do ur… |
CVE-2021-26708 | High | 7.0 | 2021-02-05 | A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong loc… |
CVE-2021-20652 | High | 8.8 | 2021-02-05 | Cross-site request forgery (CSRF) vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack the authentication of administrators via… |
CVE-2021-20623 | Critical | 9.8 | 2021-02-05 | Video Insight VMS versions prior to 7.8 allows a remote attacker to execute arbitrary code with the system user privilege by sending a specially crafted reques… |
CVE-2021-25249 | High | 7.8 | 2021-02-04 | An out-of-bounds write information disclosure vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security (10… |
CVE-2021-25248 | Medium | 5.5 | 2021-02-04 | An out-of-bounds read information disclosure vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security (10… |
CVE-2021-25246 | Medium | 6.5 | 2021-02-04 | An improper access control information disclosure vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG SP1, and Worry-Free Business Secu… |
CVE-2021-25245 | Medium | 5.3 | 2021-02-04 | An improper access control vulnerability in Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain various pieces of settings info… |
CVE-2021-25244 | Medium | 5.3 | 2021-02-04 | An improper access control vulnerability in Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain various pieces of configuration… |
CVE-2021-25243 | Medium | 5.3 | 2021-02-04 | An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow a… |
CVE-2021-25242 | Medium | 5.3 | 2021-02-04 | An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow a… |
CVE-2021-25241 | Medium | 5.3 | 2021-02-04 | A server-side request forgery (SSRF) information disclosure vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an unau… |
CVE-2021-25240 | Medium | 5.3 | 2021-02-04 | An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow a… |
CVE-2021-25239 | Medium | 5.3 | 2021-02-04 | An improper access control vulnerability in Trend Micro Apex One (on-prem), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthe… |
CVE-2021-25238 | Medium | 5.3 | 2021-02-04 | An improper access control information disclosure vulnerability in Trend Micro OfficeScan XG SP1 and Worry-Free Business Security 10.0 SP1 could allow an unaut… |