2021 CVEs (page 223)
Page 223 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-22850 | Medium | 5.3 | 2021-01-19 | HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions. |
CVE-2021-3178 | Medium | 6.5 | 2021-01-19 | fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, allows remote attackers to traverse to oth… |
CVE-2021-3177 | Critical | 9.8 | 2021-01-19 | Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications tha… |
CVE-2021-20619 | Medium | 6.1 | 2021-01-19 | Cross-site scripting vulnerability in GROWI (v4.2 Series) versions prior to v4.2.3 allows remote attackers to inject an arbitrary script via unspecified vector… |
CVE-2021-25178 | High | 7.8 | 2021-01-18 | An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A stack-based buffer overflow vulnerability exists when the recover operation is r… |
CVE-2021-25177 | High | 7.8 | 2021-01-18 | An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A Type Confusion issue exists when rendering malformed .DXF and .DWG files. This c… |
CVE-2021-25176 | High | 7.8 | 2021-01-18 | An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A NULL pointer dereference exists when rendering malformed .DXF and .DWG files. Th… |
CVE-2021-25175 | High | 7.8 | 2021-01-18 | An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A Type Conversion issue exists when rendering malformed .DXF and .DWG files. This… |
CVE-2021-25174 | High | 7.8 | 2021-01-18 | An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory corruption vulnerability exists when reading malformed DGN files. It can… |
CVE-2021-25173 | High | 7.8 | 2021-01-18 | An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory allocation with excessive size vulnerability exists when reading malforme… |
CVE-2021-25295 | Medium | 6.1 | 2021-01-18 | OpenCATS through 0.9.5-3 has multiple Cross-site Scripting (XSS) issues. |
CVE-2021-25294 | Critical | 9.8 | 2021-01-18 | OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unse… |
CVE-2021-3166 | High | 7.5 | 2021-01-18 | An issue was discovered on ASUS DSL-N14U-B1 1.1.2.3_805 devices. An attacker can upload arbitrary file content as a firmware update when the filename Settings_… |
CVE-2021-3113 | High | 7.5 | 2021-01-17 | Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For exam… |
CVE-2021-3162 | High | 7.8 | 2021-01-15 | Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation. |
CVE-2021-21251 | High | 7.7 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3 there is a critical "zip slip" vulnerability. This issue may lead to arbitrary file wri… |
CVE-2021-21250 | High | 7.7 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which may lead to arbitrary file read. When BuildSpe… |
CVE-2021-21249 | Critical | 9.6 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execu… |
CVE-2021-21248 | Critical | 9.6 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec i… |
CVE-2021-21247 | Critical | 9.6 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the application's BasePage registers an AJAX event listener (`AbstractPostAjaxBehavior… |
CVE-2021-21246 | High | 8.6 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only admini… |
CVE-2021-21245 | Critical | 10.0 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) t… |
CVE-2021-21242 | Critical | 10.0 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. At… |
CVE-2021-21244 | Critical | 10.0 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean… |
CVE-2021-21243 | Critical | 10.0 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from th… |
CVE-2021-21237 | High | 7.2 | 2021-01-15 | Git LFS is a command line extension for managing large files with Git. On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file… |
CVE-2021-0223 | High | 7.8 | 2021-01-15 | A local privilege escalation vulnerability in telnetd.real of Juniper Networks Junos OS may allow a locally authenticated shell user to escalate privileges and… |
CVE-2021-0222 | High | 7.4 | 2021-01-15 | A vulnerability in Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the device by sending certain crafted protocol packets fr… |
CVE-2021-0221 | Medium | 6.5 | 2021-01-15 | In an EVPN/VXLAN scenario, if an IRB interface with a virtual gateway address (VGA) is configured on a PE, a traffic loop may occur upon receipt of specific IP… |
CVE-2021-0220 | Medium | 6.8 | 2021-01-15 | The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who… |
CVE-2021-0219 | Medium | 6.7 | 2021-01-15 | A command injection vulnerability in install package validation subsystem of Juniper Networks Junos OS that may allow a locally authenticated attacker with pri… |
CVE-2021-0218 | High | 7.8 | 2021-01-15 | A command injection vulnerability in the license-check daemon of Juniper Networks Junos OS that may allow a locally authenticated attacker with low privileges… |
CVE-2021-0217 | High | 7.4 | 2021-01-15 | A vulnerability in processing of certain DHCP packets from adjacent clients on EX Series and QFX Series switches running Juniper Networks Junos OS with DHCP lo… |
CVE-2021-0215 | Medium | 6.5 | 2021-01-15 | On Juniper Networks Junos EX series, QFX Series, MX Series and SRX branch series devices, a memory leak occurs every time the 802.1X authenticator port interfa… |
CVE-2021-0212 | Medium | 5.0 | 2021-01-15 | An Information Exposure vulnerability in Juniper Networks Contrail Networking allows a locally authenticated attacker able to read files to retrieve administra… |
CVE-2021-0211 | Critical | 10.0 | 2021-01-15 | An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing Protocol Daemon (RPD) service allows an attac… |
CVE-2021-0210 | Medium | 6.8 | 2021-01-15 | An Information Exposure vulnerability in J-Web of Juniper Networks Junos OS allows an unauthenticated attacker to elevate their privileges over the target syst… |
CVE-2021-0209 | Medium | 6.5 | 2021-01-15 | In Juniper Networks Junos OS Evolved an attacker sending certain valid BGP update packets may cause Junos OS Evolved to access an uninitialized pointer causing… |
CVE-2021-0208 | High | 8.8 | 2021-01-15 | An improper input validation vulnerability in the Routing Protocol Daemon (RPD) service of Juniper Networks Junos OS allows an attacker to send a malformed RSV… |
CVE-2021-0207 | High | 7.5 | 2021-01-15 | An improper interpretation conflict of certain data between certain software components within the Juniper Networks Junos OS devices does not allow certain tra… |
CVE-2021-0206 | High | 7.5 | 2021-01-15 | A NULL Pointer Dereference vulnerability in Juniper Networks Junos OS allows an attacker to send a specific packet causing the packet forwarding engine (PFE) t… |
CVE-2021-0205 | Medium | 5.8 | 2021-01-15 | When the "Intrusion Detection Service" (IDS) feature is configured on Juniper Networks MX series with a dynamic firewall filter using IPv6 source or destinatio… |
CVE-2021-0204 | High | 7.8 | 2021-01-15 | A sensitive information disclosure vulnerability in delta-export configuration utility (dexp) of Juniper Networks Junos OS may allow a locally authenticated sh… |
CVE-2021-0203 | High | 8.6 | 2021-01-15 | On Juniper Networks EX and QFX5K Series platforms configured with Redundant Trunk Group (RTG), Storm Control profile applied on the RTG interface might not tak… |
CVE-2021-0202 | High | 7.5 | 2021-01-15 | On Juniper Networks MX Series and EX9200 Series platforms with Trio-based MPC (Modular Port Concentrator) where Integrated Routing and Bridging (IRB) interface… |
CVE-2021-22171 | High | 7.3 | 2021-01-15 | Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if they click on a malic… |
CVE-2021-22168 | Medium | 4.3 | 2021-01-15 | A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8. |
CVE-2021-22167 | Medium | 5.3 | 2021-01-15 | An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attacker to have a temporar… |
CVE-2021-22166 | Medium | 5.3 | 2021-01-15 | An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method |
CVE-2021-23838 | Medium | 4.8 | 2021-01-15 | An issue was discovered in flatCore before 2.0.0 build 139. A reflected XSS vulnerability was identified in the media_filter HTTP request body parameter for th… |
CVE-2021-23837 | Medium | 6.5 | 2021-01-15 | An issue was discovered in flatCore before 2.0.0 build 139. A time-based blind SQL injection was identified in the selected_folder HTTP request body parameter… |
CVE-2021-23836 | Medium | 4.8 | 2021-01-15 | An issue was discovered in flatCore before 2.0.0 build 139. A stored XSS vulnerability was identified in the prefs_smtp_psw HTTP request body parameter for the… |
CVE-2021-23835 | Medium | 4.9 | 2021-01-15 | An issue was discovered in flatCore before 2.0.0 build 139. A local file disclosure vulnerability was identified in the docs_file HTTP request body parameter f… |
CVE-2021-22132 | Medium | 4.8 | 2021-01-14 | Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store… |
CVE-2021-21261 | High | 7.3 | 2021-01-14 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that… |
CVE-2021-21722 | Medium | 4.4 | 2021-01-14 | A ZTE Smart STB is impacted by an information leak vulnerability. The device did not fully verify the log, so attackers could use this vulnerability to obtain… |
CVE-2021-24122 | Medium | 5.9 | 2021-01-14 | When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 a… |
CVE-2021-23926 | Critical | 9.1 | 2021-01-14 | The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include po… |
CVE-2021-20618 | Critical | 9.8 | 2021-01-14 | Privilege chaining vulnerability in acmailer ver. 4.0.2 and earlier, and acmailer DB ver. 1.1.4 and earlier allows remote attackers to bypass authentication an… |
CVE-2021-20617 | Critical | 9.8 | 2021-01-14 | Improper access control vulnerability in acmailer ver. 4.0.1 and earlier, and acmailer DB ver. 1.1.3 and earlier allows remote attackers to execute an arbitrar… |
CVE-2021-3138 | High | 7.5 | 2021-01-14 | In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms. |
CVE-2021-21013 | High | 8.1 | 2021-01-13 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the cu… |
CVE-2021-21012 | Medium | 5.3 | 2021-01-13 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the ch… |
CVE-2021-21011 | High | 7.0 | 2021-01-13 | Adobe Captivate 2019 version 11.5.1.499 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation… |
CVE-2021-21010 | High | 7.0 | 2021-01-13 | InCopy version 15.1.1 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code execution in the c… |
CVE-2021-21009 | High | 8.6 | 2021-01-13 | Adobe Campaign Classic Gold Standard 10 (and earlier), 20.3.1 (and earlier), 20.2.3 (and earlier), 20.1.3 (and earlier), 19.2.3 (and earlier) and 19.1.7 (and e… |
CVE-2021-21008 | High | 7.0 | 2021-01-13 | Adobe Animate version 21.0 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code execution in the context of the… |
CVE-2021-21007 | High | 7.0 | 2021-01-13 | Adobe Illustrator version 25.0 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code execution in the context of… |
CVE-2021-21006 | High | 8.6 | 2021-01-13 | Adobe Photoshop version 22.1 (and earlier) is affected by a heap buffer overflow vulnerability when handling a specially crafted font file. Successful exploita… |
CVE-2021-1360 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1311 | Medium | 5.4 | 2021-01-13 | A vulnerability in the reclaim host role feature of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an authenticated, remote attacker to take… |
CVE-2021-1310 | Medium | 4.7 | 2021-01-13 | A vulnerability in the web-based management interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to redirect a user to an untruste… |
CVE-2021-1307 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1267 | Medium | 4.3 | 2021-01-13 | A vulnerability in the dashboard widget of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to cause a denial of… |
CVE-2021-1258 | Medium | 5.5 | 2021-01-13 | A vulnerability in the upgrade component of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker with low privileges to read ar… |
CVE-2021-1246 | Medium | 6.5 | 2021-01-13 | Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor Unauthenticated Access Vulnerability A vulnerability in the w… |
CVE-2021-1245 | Medium | 6.5 | 2021-01-13 | Cisco Finesse and Cisco Unified CVP OpenSocial Gadget Editor Cross-Site Scripting Vulnerability A vulnerability in the web-based management interface of Cis… |
CVE-2021-1242 | Medium | 4.3 | 2021-01-13 | A vulnerability in Cisco Webex Teams could allow an unauthenticated, remote attacker to manipulate file names within the messaging interface. The vulnerability… |
CVE-2021-1240 | Medium | 4.8 | 2021-01-13 | A vulnerability in the loading process of specific DLLs in Cisco Proximity Desktop for Windows could allow an authenticated, local attacker to load a malicious… |
CVE-2021-1239 | Medium | 4.8 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to cond… |
CVE-2021-1238 | Medium | 4.8 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to cond… |
CVE-2021-1237 | High | 7.8 | 2021-01-13 | A vulnerability in the Network Access Manager and Web Security Agent components of Cisco AnyConnect Secure Mobility Client for Windows could allow an authentic… |
CVE-2021-1236 | Medium | 5.3 | 2021-01-13 | Multiple Cisco products are affected by a vulnerability in the Snort application detection engine that could allow an unauthenticated, remote attacker to bypas… |
CVE-2021-1226 | Medium | 4.3 | 2021-01-13 | A vulnerability in the audit logging component of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco… |
CVE-2021-1224 | Medium | 5.8 | 2021-01-13 | Multiple Cisco products are affected by a vulnerability with TCP Fast Open (TFO) when used in conjunction with the Snort detection engine that could allow an u… |
CVE-2021-1223 | High | 7.5 | 2021-01-13 | Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configur… |
CVE-2021-1217 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1216 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1215 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1214 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1213 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1212 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1211 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1210 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1209 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1208 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1207 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1206 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1205 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1204 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |