2021 CVEs (page 219)
Page 219 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-25765 | High | 8.8 | 2021-02-03 | In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible. |
CVE-2021-25763 | Medium | 5.3 | 2021-02-03 | In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default. |
CVE-2021-25762 | Medium | 5.3 | 2021-02-03 | In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible. |
CVE-2021-25761 | Medium | 5.3 | 2021-02-03 | In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible. |
CVE-2021-25760 | Medium | 5.3 | 2021-02-03 | In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible. |
CVE-2021-25759 | Medium | 6.5 | 2021-02-03 | In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user. |
CVE-2021-25758 | High | 7.8 | 2021-02-03 | In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to local code execution. |
CVE-2021-25757 | Medium | 6.1 | 2021-02-03 | In JetBrains Hub before 2020.1.12629, an open redirect was possible. |
CVE-2021-25756 | Medium | 5.3 | 2021-02-03 | In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS. |
CVE-2021-25755 | Low | 2.5 | 2021-02-03 | In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to the encrypted traffic. |
CVE-2021-0365 | Medium | 6.7 | 2021-02-03 | In display driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privil… |
CVE-2021-0364 | Medium | 6.7 | 2021-02-03 | In mobile_log_d, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution… |
CVE-2021-0363 | Medium | 6.7 | 2021-02-03 | In mobile_log_d, there is a possible command injection due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2021-0362 | Medium | 6.7 | 2021-02-03 | In aee, there is a possible memory corruption due to a stack buffer overflow. This could lead to local escalation of privilege with System execution privileges… |
CVE-2021-0361 | Medium | 6.7 | 2021-02-03 | In kisd, there is a possible out of bounds read due to improper input validation. This could lead to local escalation of privilege with System execution privil… |
CVE-2021-0360 | Medium | 6.7 | 2021-02-03 | In netdiag, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2021-0359 | Medium | 6.7 | 2021-02-03 | In netdiag, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privi… |
CVE-2021-0358 | Medium | 6.7 | 2021-02-03 | In netdiag, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution priv… |
CVE-2021-0357 | Medium | 6.7 | 2021-02-03 | In netdiag, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privi… |
CVE-2021-0356 | Medium | 6.7 | 2021-02-03 | In netdiag, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution priv… |
CVE-2021-0355 | Medium | 6.7 | 2021-02-03 | In kisd, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges… |
CVE-2021-0354 | Medium | 6.7 | 2021-02-03 | In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges n… |
CVE-2021-0353 | Medium | 6.7 | 2021-02-03 | In kisd, there is a possible memory corruption due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges… |
CVE-2021-0352 | Medium | 4.4 | 2021-02-03 | In RT regmap driver, there is a possible memory corruption due to type confusion. This could lead to local denial of service with System execution privileges n… |
CVE-2021-21043 | Medium | 6.1 | 2021-02-02 | ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JC… |
CVE-2021-21294 | High | 7.5 | 2021-02-02 | Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnera… |
CVE-2021-21293 | High | 7.5 | 2021-02-02 | blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by… |
CVE-2021-3395 | Medium | 5.4 | 2021-02-02 | A cross-site scripting (XSS) vulnerability in Pryaniki 6.44.3 allows remote authenticated users to upload an arbitrary file. The JavaScript code will execute w… |
CVE-2021-21292 | Medium | 5.5 | 2021-02-02 | Traccar is an open source GPS tracking system. In Traccar before version 4.12 there is an unquoted Windows binary path vulnerability. Only Windows versions are… |
CVE-2021-25912 | Critical | 9.8 | 2021-02-02 | Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution. |
CVE-2021-23271 | High | 8.0 | 2021-02-02 | The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows a low privileged attacker with network… |
CVE-2021-21291 | Medium | 4.7 | 2021-02-02 | OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accou… |
CVE-2021-21289 | High | 7.4 | 2021-02-02 | Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command… |
CVE-2021-20199 | Medium | 5.9 | 2021-02-02 | Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applic… |
CVE-2021-21285 | Medium | 6.5 | 2021-02-02 | In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemo… |
CVE-2021-21284 | Medium | 6.8 | 2021-02-02 | In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escal… |
CVE-2021-25310 | High | 8.8 | 2021-02-02 | The administration web interface on Belkin Linksys WRT160NL 1.0.04.002_US_20130619 devices allows remote authenticated attackers to execute system commands wit… |
CVE-2021-3281 | Medium | 5.3 | 2021-02-02 | In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject… |
CVE-2021-3378 | Critical | 9.8 | 2021-02-01 | FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUploadedHotspotLogoFile and then visiting… |
CVE-2021-3340 | Medium | 6.1 | 2021-02-01 | A cross-site scripting (XSS) vulnerability in many forms of Wikindx before 5.7.0 and 6.x through 6.4.0 allows remote attackers to inject arbitrary web script o… |
CVE-2021-21287 | High | 7.7 | 2021-02-01 | MinIO is a High Performance Object Storage released under Apache License v2.0. In MinIO before version RELEASE.2021-01-30T00-20-58Z there is a server-side requ… |
CVE-2021-3283 | High | 7.5 | 2021-02-01 | HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.1… |
CVE-2021-3282 | High | 7.5 | 2021-02-01 | HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in… |
CVE-2021-3024 | Medium | 5.3 | 2021-02-01 | HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed… |
CVE-2021-21286 | High | 7.7 | 2021-02-01 | AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authoriz… |
CVE-2021-23330 | Critical | 9.8 | 2021-02-01 | All versions of package launchpad are vulnerable to Command Injection via stop. |
CVE-2021-21277 | High | 8.5 | 2021-02-01 | angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-expressions before version 1.1.2 there is… |
CVE-2021-21276 | Critical | 9.3 | 2021-02-01 | Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attackers to gain admin access to site instance… |
CVE-2021-21266 | Medium | 6.4 | 2021-02-01 | openHAB is a vendor and technology agnostic open source automation software for your home. In openHAB before versions 2.5.12 and 3.0.1 the XML external entity… |
CVE-2021-3350 | Medium | 6.1 | 2021-02-01 | deleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason parameter. |
CVE-2021-3349 | Low | 3.3 | 2021-02-01 | GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution does not retrieve e… |
CVE-2021-3348 | High | 7.0 | 2021-02-01 | nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with a… |
CVE-2021-23329 | High | 7.5 | 2021-01-31 | The package nested-object-assign before 1.0.4 are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below. |
CVE-2021-21254 | Medium | 6.5 | 2021-01-29 | CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) before v… |
CVE-2021-25646 | High | 8.8 | 2021-01-29 | Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in hig… |
CVE-2021-25138 | High | 7.8 | 2021-01-29 | The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudlin… |
CVE-2021-25137 | High | 7.8 | 2021-01-29 | The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudlin… |
CVE-2021-25136 | High | 7.8 | 2021-01-29 | The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudlin… |
CVE-2021-25135 | High | 7.8 | 2021-01-29 | The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudlin… |
CVE-2021-25134 | High | 7.8 | 2021-01-29 | The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudlin… |
CVE-2021-25133 | High | 7.8 | 2021-01-29 | The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudlin… |
CVE-2021-25132 | High | 7.8 | 2021-01-29 | The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudlin… |
CVE-2021-25131 | High | 7.8 | 2021-01-29 | The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudlin… |
CVE-2021-25130 | High | 7.8 | 2021-01-29 | The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudlin… |
CVE-2021-25129 | High | 7.8 | 2021-01-29 | The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudlin… |
CVE-2021-25128 | High | 7.8 | 2021-01-29 | The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudlin… |
CVE-2021-25127 | High | 7.8 | 2021-01-29 | The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudlin… |
CVE-2021-25126 | High | 7.8 | 2021-01-29 | The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudlin… |
CVE-2021-25125 | High | 7.8 | 2021-01-29 | The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudlin… |
CVE-2021-25124 | High | 7.8 | 2021-01-29 | The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudlin… |
CVE-2021-3347 | High | 7.8 | 2021-01-29 | An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execu… |
CVE-2021-3346 | Critical | 9.8 | 2021-01-29 | Foris before 101.1.1, as used in Turris OS, lacks certain HTML escaping in the login template. |
CVE-2021-23328 | Medium | 5.6 | 2021-01-29 | This affects all versions of package iniparserjs. This vulnerability relates when ini_parser.js is concentrating arrays. Depending on if user input is provided… |
CVE-2021-3345 | High | 7.8 | 2021-01-29 | _gcry_md_block_write in cipher/hash-common.c in Libgcrypt version 1.9.0 has a heap-based buffer overflow when the digest final function sets a large count valu… |
CVE-2021-20586 | High | 7.5 | 2021-01-29 | Resource management errors vulnerability in a robot controller of MELFA FR Series(controller "CR800-*V*D" of RV-*FR***-D-* all versions, controller "CR800-*HD"… |
CVE-2021-25910 | High | 8.0 | 2021-01-29 | Improper Authentication vulnerability in the cookie parameter of ZIV AUTOMATION 4CCT-EA6-334126BF allows a local attacker to perform modifications in several p… |
CVE-2021-25909 | High | 8.6 | 2021-01-29 | ZIV Automation 4CCT-EA6-334126BF firmware version 3.23.80.27.36371, allows an unauthenticated, remote attacker to cause a denial of service condition on the de… |
CVE-2021-25123 | High | 7.8 | 2021-01-29 | The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudlin… |
CVE-2021-3176 | High | 8.0 | 2021-01-29 | The chat window of the Mitel BusinessCTI Enterprise (MBC-E) Client for Windows before 6.4.15 and 7.x before 7.1.2 could allow an attacker to gain access to use… |
CVE-2021-3298 | Medium | 5.4 | 2021-01-29 | Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit page, aka the manageuser.php?action=edi… |
CVE-2021-3336 | High | 8.1 | 2021-01-29 | DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED22519, ED448, ECC, or R… |
CVE-2021-26308 | High | 7.5 | 2021-01-29 | An issue was discovered in the marc crate before 2.0.0 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated mem… |
CVE-2021-26307 | Medium | 5.5 | 2021-01-29 | An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It allows __cpuid_count() calls even if the processor does not support the CPUID instruct… |
CVE-2021-26306 | High | 7.5 | 2021-01-29 | An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It has unsound transmute calls within as_string() methods. |
CVE-2021-26305 | Critical | 9.8 | 2021-01-29 | An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old conten… |
CVE-2021-26304 | Medium | 5.4 | 2021-01-29 | PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the add-expense.php Item parameter. |
CVE-2021-26303 | Medium | 6.1 | 2021-01-29 | PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the user-profile.php Full Name field. |
CVE-2021-3341 | High | 7.5 | 2021-01-29 | A path traversal vulnerability in the DxWebEngine component of DH2i DxEnterprise and DxOdyssey for Windows, version 19.5 through 20.x before 20.0.219.0, allows… |
CVE-2021-3337 | High | 7.5 | 2021-01-28 | The Hide-Thread-Content plugin through 2021-01-27 for MyBB allows remote attackers to bypass intended content-reading restrictions by clicking on reply or quot… |
CVE-2021-3160 | Critical | 9.8 | 2021-01-28 | Deserialization of untrusted data in the login page of ASSUWEB 359.3 build 1 subcomponent of ACA ASSUREX RENTES product allows a remote attacker to inject unse… |
CVE-2021-20185 | Medium | 5.3 | 2021-01-28 | It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result… |
CVE-2021-25647 | Medium | 5.4 | 2021-01-28 | Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to be stored in the r… |
CVE-2021-20187 | High | 7.2 | 2021-01-28 | It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP i… |
CVE-2021-20186 | Medium | 5.4 | 2021-01-28 | It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of TeX content was req… |
CVE-2021-20184 | Medium | 4.3 | 2021-01-28 | It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meant students were able… |
CVE-2021-20183 | Medium | 5.4 | 2021-01-28 | It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of search queries. |
CVE-2021-22875 | Medium | 6.1 | 2021-01-28 | Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter. |
CVE-2021-22874 | Medium | 6.1 | 2021-01-28 | Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the `period_preset` parameter. |
CVE-2021-20622 | Medium | 6.1 | 2021-01-28 | Cross-site scripting vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remote attackers t… |
CVE-2021-20621 | High | 8.8 | 2021-01-28 | Cross-site request forgery (CSRF) vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remot… |