2021 CVEs (page 24)
Page 24 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-25657 | High | 7.8 | 2022-09-02 | A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user to escalate privilege… |
CVE-2021-3826 | Medium | 6.5 | 2022-09-01 | Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fau… |
CVE-2021-39045 | Medium | 5.5 | 2022-09-01 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a local attacker to obtain information due to the autocomplete feature on password input fields. IB… |
CVE-2021-39009 | Medium | 5.5 | 2022-09-01 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 21355… |
CVE-2021-29823 | Medium | 6.5 | 2022-09-01 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized… |
CVE-2021-20468 | Medium | 6.5 | 2022-09-01 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized… |
CVE-2021-45027 | High | 7.5 | 2022-09-01 | An arbitrary file download vulnerability in Oliver v5 Library Server Versions < 5.00.008.053 via the FileServlet function allows for arbitrary file download by… |
CVE-2021-29864 | Medium | 6.1 | 2022-08-30 | IBM Security Identity Manager 6.0 and 6.0.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to… |
CVE-2021-46837 | Medium | 6.5 | 2022-08-30 | res_pjsip_t38 in Sangoma Asterisk 16.x before 16.16.2, 17.x before 17.9.3, and 18.x before 18.2.2, and Certified Asterisk before 16.8-cert7, allows an attacker… |
CVE-2021-38934 | Medium | 5.4 | 2022-08-29 | IBM Engineering Test Management 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2021-41785 | High | 7.8 | 2022-08-29 | Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code b… |
CVE-2021-41784 | High | 7.8 | 2022-08-29 | Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code b… |
CVE-2021-41783 | High | 7.8 | 2022-08-29 | Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code b… |
CVE-2021-41782 | High | 7.8 | 2022-08-29 | Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code b… |
CVE-2021-41781 | High | 7.8 | 2022-08-29 | Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code b… |
CVE-2021-41780 | High | 7.8 | 2022-08-29 | Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code b… |
CVE-2021-40326 | Medium | 5.5 | 2022-08-29 | Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle hidden and incremental data in signed documents. An attacker c… |
CVE-2021-4216 | Medium | 5.5 | 2022-08-26 | A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream. |
CVE-2021-3864 | High | 7.0 | 2022-08-26 | A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that s… |
CVE-2021-3859 | High | 7.5 | 2022-08-26 | A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out deni… |
CVE-2021-3856 | Medium | 4.3 | 2022-08-26 | ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme re… |
CVE-2021-3754 | Medium | 5.3 | 2022-08-26 | A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble… |
CVE-2021-3735 | Medium | 4.4 | 2022-08-26 | A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-device Register FIS… |
CVE-2021-3703 | High | 7.5 | 2022-08-26 | It was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196 have been incorrectly mentioned as fixed in RHSA for Serverless 1.16.0 and Serverless c… |
CVE-2021-3688 | Medium | 4.8 | 2022-08-26 | A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a request URL contains… |
CVE-2021-3669 | Medium | 5.5 | 2022-08-26 | A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource… |
CVE-2021-3644 | Low | 3.3 | 2022-08-26 | A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was… |
CVE-2021-3632 | High | 7.5 | 2022-08-26 | A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any u… |
CVE-2021-3585 | Medium | 5.5 | 2022-08-26 | A flaw was found in openstack-tripleo-heat-templates. Plain passwords from RHSM exist in the logs during OSP13 deployment with subscription-manager. |
CVE-2021-3574 | Low | 3.3 | 2022-08-26 | A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks. |
CVE-2021-3563 | High | 7.4 | 2022-08-26 | A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity w… |
CVE-2021-3427 | Medium | 6.1 | 2022-08-26 | The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly a… |
CVE-2021-3414 | High | 8.1 | 2022-08-26 | A flaw was found in satellite. When giving granular permission related to the organization, other permissions allowing a user to view and manage other organiza… |
CVE-2021-35939 | Medium | 6.7 | 2022-08-26 | It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created… |
CVE-2021-20260 | High | 7.8 | 2022-08-26 | A flaw was found in the Foreman project. The Datacenter plugin exposes the password through the API to an authenticated local attacker with view_hosts permissi… |
CVE-2021-40285 | High | 8.1 | 2022-08-26 | htmly v2.8.1 was discovered to contain an arbitrary file deletion vulnerability via the component \views\backup.html.php. |
CVE-2021-39394 | Medium | 6.5 | 2022-08-26 | mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add user accounts and modify user informatio… |
CVE-2021-39393 | Medium | 6.1 | 2022-08-26 | mm-wiki v0.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the markdown editor. |
CVE-2021-3020 | High | 8.8 | 2022-08-26 | An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended t… |
CVE-2021-32570 | Medium | 4.9 | 2022-08-26 | In Ericsson Network Manager (ENM) releases before 21.2, users belonging to the same AMOS authorization group can retrieve the data from certain log files. All… |
CVE-2021-43329 | Critical | 9.8 | 2022-08-25 | A SQL injection vulnerability in license_update.php in Mumara Classic through 2.93 allows a remote unauthenticated attacker to execute arbitrary SQL commands v… |
CVE-2021-4112 | High | 8.8 | 2022-08-25 | A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege f… |
CVE-2021-3979 | Medium | 6.5 | 2022-08-25 | A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to c… |
CVE-2021-3929 | High | 8.2 | 2022-08-25 | A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reent… |
CVE-2021-3914 | Medium | 6.1 | 2022-08-25 | It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to conduct cross-site sc… |
CVE-2021-35938 | Medium | 6.7 | 2022-08-25 | A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user coul… |
CVE-2021-35937 | Medium | 6.4 | 2022-08-25 | A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-201… |
CVE-2021-33844 | Medium | 5.5 | 2022-08-25 | A floating point exception (divide-by-zero) issue was discovered in SoX in functon startread() of wav.c file. An attacker with a crafted wav file, could cause… |
CVE-2021-23210 | Medium | 5.5 | 2022-08-25 | A floating point exception (divide-by-zero) issue was discovered in SoX in functon read_samples() of voc.c file. An attacker with a crafted file, could cause a… |
CVE-2021-23172 | Medium | 5.5 | 2022-08-25 | A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function startread() in hcom.c file. The vulnerability is exploitable with a crafted h… |
CVE-2021-23159 | Medium | 5.5 | 2022-08-25 | A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function lsx_read_w_buf() in formats_i.c file. The vulnerability is exploitable with a… |
CVE-2021-20224 | Medium | 5.5 | 2022-08-25 | An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() function in MagickCore/quantum-export.c. Function calls to GetPixelIndex() could… |
CVE-2021-4022 | Medium | 5.5 | 2022-08-25 | A vulnerability was found in rizin. The bug involves an ELF64 binary for the HPPA architecture. When a specially crafted binarygets analysed by rizin, it cause… |
CVE-2021-43767 | Medium | 5.9 | 2022-08-25 | Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication… |
CVE-2021-43766 | High | 8.1 | 2022-08-25 | Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication, a man-in… |
CVE-2021-42523 | High | 7.5 | 2022-08-25 | There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist… |
CVE-2021-42522 | High | 7.5 | 2022-08-25 | There is a Information Disclosure vulnerability in anjuta/plugins/document-manager/anjuta-bookmarks.c. This issue was caused by the incorrect use of libxml2 AP… |
CVE-2021-42521 | High | 7.5 | 2022-08-25 | There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value… |
CVE-2021-25642 | High | 8.8 | 2022-08-25 | ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attac… |
CVE-2021-4218 | Medium | 5.5 | 2022-08-24 | A flaw was found in the Linux kernel’s implementation of reading the SVC RDMA counters. Reading the counter sysctl panics the system. This flaw allows a local… |
CVE-2021-4217 | Low | 3.3 | 2022-08-24 | A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows… |
CVE-2021-4214 | Medium | 5.5 | 2022-08-24 | A heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to t… |
CVE-2021-4213 | High | 7.5 | 2022-08-24 | A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM… |
CVE-2021-4209 | Medium | 6.5 | 2022-08-24 | A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined… |
CVE-2021-4204 | High | 7.1 | 2022-08-24 | An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation. This flaw allows a local attacker with a sp… |
CVE-2021-4189 | Medium | 5.3 | 2022-08-24 | A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the… |
CVE-2021-4178 | Medium | 6.7 | 2022-08-24 | A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML par… |
CVE-2021-4159 | Medium | 4.4 | 2022-08-24 | A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace… |
CVE-2021-4158 | Medium | 6.0 | 2022-08-24 | A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to crash the QEMU proces… |
CVE-2021-4155 | Medium | 5.5 | 2022-08-24 | A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker coul… |
CVE-2021-4142 | Medium | 5.5 | 2022-08-24 | The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple conten… |
CVE-2021-4125 | High | 8.1 | 2022-08-24 | It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup… |
CVE-2021-4122 | Medium | 4.3 | 2022-08-24 | It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical… |
CVE-2021-4041 | High | 7.8 | 2022-08-24 | A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters g… |
CVE-2021-4040 | Medium | 5.3 | 2022-08-24 | A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw a… |
CVE-2021-4037 | Medium | 4.4 | 2022-08-24 | A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-syst… |
CVE-2021-4028 | High | 7.8 | 2022-08-24 | A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local access to setup a socket to listen on a… |
CVE-2021-43309 | Medium | 5.9 | 2022-08-24 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary… |
CVE-2021-3999 | High | 7.8 | 2022-08-24 | A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A lo… |
CVE-2021-3998 | High | 7.5 | 2022-08-24 | A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sens… |
CVE-2021-39815 | Critical | 9.8 | 2022-08-24 | The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be freed), and continue using the page in GPU… |
CVE-2021-0947 | High | 7.5 | 2022-08-24 | The method PVRSRVBridgeTLDiscoverStreams allocates puiStreamsInt on the heap, fills the contents of the buffer via TLServerDiscoverStreamsKM, and then copies t… |
CVE-2021-0946 | High | 7.5 | 2022-08-24 | The method PVRSRVBridgePMRPDumpSymbolicAddr allocates puiMemspaceNameInt on the heap, fills the contents of the buffer via PMR_PDumpSymbolicAddr, and then copi… |
CVE-2021-0891 | High | 7.5 | 2022-08-24 | An unprivileged app can trigger PowerVR driver to return an uninitialized heap memory causing information disclosure.Product: AndroidVersions: Android SoCAndro… |
CVE-2021-0887 | Medium | 5.5 | 2022-08-24 | In PVRSRVBridgeHeapCfgHeapConfigName, there is a possible leak of kernel heap content due to uninitialized data. This could lead to local information disclosur… |
CVE-2021-0698 | Medium | 5.5 | 2022-08-24 | In PVRSRVBridgeHeapCfgHeapDetails, there is a possible leak of kernel heap content due to uninitialized data. This could lead to local information disclosure w… |
CVE-2021-3997 | Medium | 5.5 | 2022-08-23 | A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are cr… |
CVE-2021-3996 | Medium | 5.5 | 2022-08-23 | A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows a… |
CVE-2021-3995 | Medium | 5.5 | 2022-08-23 | A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows a… |
CVE-2021-3975 | Medium | 6.5 | 2022-08-23 | A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being… |
CVE-2021-3917 | Medium | 5.5 | 2022-08-23 | A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a l… |
CVE-2021-3905 | High | 7.5 | 2022-08-23 | A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available me… |
CVE-2021-3839 | High | 7.5 | 2022-08-23 | A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out… |
CVE-2021-3827 | Medium | 6.8 | 2022-08-23 | A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can… |
CVE-2021-3800 | Medium | 5.5 | 2022-08-23 | A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones… |
CVE-2021-3798 | Medium | 5.5 | 2022-08-23 | A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_Der… |
CVE-2021-3764 | Medium | 5.5 | 2022-08-23 | A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is si… |
CVE-2021-3763 | Medium | 4.3 | 2022-08-23 | A flaw was found in the Red Hat AMQ Broker management console in version 7.8 where an existing user is able to access some limited information even when the ro… |
CVE-2021-3759 | Medium | 5.5 | 2022-08-23 | A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple… |
CVE-2021-3736 | Medium | 5.5 | 2022-08-23 | A flaw was found in the Linux kernel. A memory leak problem was found in mbochs_ioctl in samples/vfio-mdev/mbochs.c in Virtual Function I/O (VFIO) Mediated dev… |