2021 CVEs (page 25)
Page 25 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-3714 | Medium | 5.9 | 2022-08-23 | A flaw was found in the Linux kernels memory deduplication mechanism. Previous work has shown that memory deduplication can be attacked via a local exploitatio… |
CVE-2021-3702 | Medium | 6.3 | 2022-08-23 | A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their dir… |
CVE-2021-3701 | Medium | 6.6 | 2022-08-23 | A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an att… |
CVE-2021-3690 | High | 7.5 | 2022-08-23 | A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denia… |
CVE-2021-3670 | Medium | 6.5 | 2022-08-23 | MaxQueryDuration not honoured in Samba AD DC LDAP |
CVE-2021-31566 | High | 7.8 | 2022-08-23 | An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of t… |
CVE-2021-23177 | High | 7.8 | 2022-08-23 | An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may prov… |
CVE-2021-20316 | Medium | 6.8 | 2022-08-23 | A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata… |
CVE-2021-20304 | High | 7.5 | 2022-08-23 | A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR, to trigger an undef… |
CVE-2021-20298 | High | 7.5 | 2022-08-23 | A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by OpenEXR, to exhaust all memory acces… |
CVE-2021-42627 | Critical | 9.8 | 2022-08-23 | The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which can lead to disclose t… |
CVE-2021-42232 | Critical | 9.8 | 2022-08-23 | TP-Link Archer A7 Archer A7(US)_V5_210519 is affected by a command injection vulnerability in /usr/bin/tddp. The vulnerability is caused by the program taking… |
CVE-2021-28861 | High | 7.4 | 2022-08-23 | Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path whic… |
CVE-2021-29891 | Medium | 4.9 | 2022-08-22 | IBM OPENBMC OP910 and OP940 could allow a privileged user to upload an improper site identity certificate that may cause it to lose network services. IBM X-For… |
CVE-2021-3659 | Medium | 5.5 | 2022-08-22 | A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection… |
CVE-2021-3639 | Medium | 6.1 | 2022-08-22 | A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by… |
CVE-2021-3590 | High | 8.8 | 2022-08-22 | A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile password through JSON of the API output. The high… |
CVE-2021-3586 | Critical | 9.8 | 2022-08-22 | A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing acces… |
CVE-2021-3521 | Medium | 4.7 | 2022-08-22 | There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding s… |
CVE-2021-3513 | High | 7.5 | 2022-08-22 | A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message di… |
CVE-2021-3481 | High | 7.1 | 2022-08-22 | A flaw was found in Qt. An out-of-bounds read vulnerability was found in QRadialFetchSimd in qt/qtbase/src/gui/painting/qdrawhelper_p.h in Qt/Qtbase. While ren… |
CVE-2021-3442 | Medium | 5.4 | 2022-08-22 | A flaw was found in the Red Hat OpenShift API Management product. User input is not validated allowing an authenticated user to inject scripts into some text b… |
CVE-2021-37289 | High | 7.2 | 2022-08-22 | Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via etc_ro/web/syscmd.as… |
CVE-2021-36857 | Medium | 4.8 | 2022-08-22 | Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in wpshopmart Testimonial Builder plugin <= 1.6.1 at WordPress. |
CVE-2021-36852 | Medium | 4.3 | 2022-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking plugin <= 1.10.5 at WordPress. |
CVE-2021-36847 | Medium | 4.8 | 2022-08-22 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebbaPlugins Webba Booking plugin <= 4.2.21 at WordPress. |
CVE-2021-24912 | Medium | 5.4 | 2022-08-22 | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could allow attackers to ma… |
CVE-2021-24911 | Medium | 5.4 | 2022-08-22 | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading t… |
CVE-2021-24910 | Medium | 6.1 | 2022-08-22 | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenti… |
CVE-2021-44545 | Medium | 6.5 | 2022-08-18 | Improper input validation for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow an unauthenticated user to potentially enable denial of… |
CVE-2021-44470 | Medium | 5.5 | 2022-08-18 | Incorrect default permissions for the Intel(R) Connect M Android application before version 1.7.4 may allow an authenticated user to potentially enable informa… |
CVE-2021-37409 | High | 7.8 | 2022-08-18 | Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of pri… |
CVE-2021-33847 | High | 7.8 | 2022-08-18 | Improper buffer restrictions in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.120 may allow an authen… |
CVE-2021-33128 | Medium | 4.4 | 2022-08-18 | Improper access control in the firmware for some Intel(R) E810 Ethernet Controllers before version 1.6.0.6 may allow a privileged user to potentially enable de… |
CVE-2021-33126 | Medium | 4.4 | 2022-08-18 | Improper access control in the firmware for some Intel(R) 700 and 722 Series Ethernet Controllers and Adapters before versions 8.5 and 1.5.5 may allow a privil… |
CVE-2021-33060 | High | 7.8 | 2022-08-18 | Out-of-bounds write in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local a… |
CVE-2021-26950 | Medium | 5.5 | 2022-08-18 | Out of bounds read in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.120 may allow an authenticated us… |
CVE-2021-26257 | Medium | 5.5 | 2022-08-18 | Improper buffer restrictions in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.120 may allow an authen… |
CVE-2021-26254 | Medium | 5.5 | 2022-08-18 | Out of bounds read for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable denial of service via… |
CVE-2021-23223 | High | 7.8 | 2022-08-18 | Improper initialization for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of pri… |
CVE-2021-23188 | Low | 3.3 | 2022-08-18 | Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow an authenticated user to potentially enable information d… |
CVE-2021-23179 | High | 7.1 | 2022-08-18 | Out of bounds read in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.120 may allow a privileged user t… |
CVE-2021-23168 | Medium | 6.5 | 2022-08-18 | Out of bounds read for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow an unauthenticated user to potentially enable denial of servic… |
CVE-2021-32862 | High | 7.5 | 2022-08-18 | The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version… |
CVE-2021-30071 | Medium | 6.1 | 2022-08-18 | A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a cr… |
CVE-2021-30070 | High | 7.5 | 2022-08-18 | An issue was discovered in HestiaCP before v1.3.5. Attackers are able to arbitrarily install packages due to values taken from the pgk [] parameter in the upda… |
CVE-2021-26639 | High | 8.1 | 2022-08-17 | This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can use this vulnerabili… |
CVE-2021-45454 | High | 7.5 | 2022-08-17 | Ampere Altra before SRP 1.08b and Altra Max before SRP 2.05 allow information disclosure of power telemetry via HWmon. |
CVE-2021-42052 | High | 7.5 | 2022-08-16 | IPESA e-Flow 3.3.6 allows path traversal for reading any file within the web root directory via the lib/js/build/STEResource.res path and the R query parameter. |
CVE-2021-39087 | Medium | 6.5 | 2022-08-16 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow an authenticated user to… |
CVE-2021-39086 | Medium | 5.3 | 2022-08-16 | IBM Sterling File Gateway 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow a remote attacker to obtain sensitive infor… |
CVE-2021-39085 | Critical | 9.8 | 2022-08-16 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 is vulnerable to SQL injection. A re… |
CVE-2021-39035 | Medium | 5.4 | 2022-08-16 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 is vulnerable to cross-site scriptin… |
CVE-2021-30490 | High | 7.8 | 2022-08-16 | upsMonitor in ViewPower (aka ViewPowerHTML) 1.04-21012 through 1.04-21353 has insecure permissions for the service binary that enable an Authenticated User to… |
CVE-2021-29118 | Medium | 5.5 | 2022-08-12 | An out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker… |
CVE-2021-29117 | High | 7.8 | 2022-08-12 | A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) allows an unauthenticated attacker to achieve arbit… |
CVE-2021-29112 | Medium | 5.5 | 2022-08-12 | An out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker… |
CVE-2021-42751 | Medium | 4.8 | 2022-08-12 | A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScr… |
CVE-2021-42750 | Medium | 4.8 | 2022-08-12 | A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScr… |
CVE-2021-44720 | High | 7.2 | 2022-08-12 | In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Config… |
CVE-2021-22289 | High | 8.3 | 2022-08-11 | Improper Input Validation vulnerability in the project upload mechanism in B&R Automation Studio version >=4.0 may allow an unauthenticated network attacker to… |
CVE-2021-0975 | Medium | 5.5 | 2022-08-11 | In USB Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This c… |
CVE-2021-0735 | Medium | 5.5 | 2022-08-11 | In PackageManager, there is a possible way to get information about installed packages ignoring limitations introduced in Android 11 due to a missing permissio… |
CVE-2021-0734 | Medium | 5.5 | 2022-08-11 | In Settings, there is a possible way to determine whether an app is installed without query permissions, due to side channel information disclosure. This could… |
CVE-2021-46778 | Medium | 5.6 | 2022-08-10 | Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that us… |
CVE-2021-40040 | High | 7.5 | 2022-08-10 | Vulnerability of writing data to an arbitrary address in the HW_KEYMASTER module. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2021-40034 | High | 7.5 | 2022-08-10 | The video framework has the memory overwriting vulnerability caused by addition overflow. Successful exploitation of this vulnerability may affect the availabi… |
CVE-2021-40030 | High | 7.5 | 2022-08-10 | The My HUAWEI app has a defect in the design. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2021-39696 | High | 7.8 | 2022-08-10 | In Task.java, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege with no additional executi… |
CVE-2021-33646 | High | 7.5 | 2022-08-10 | The th_read() function doesn’t free a variable t->th_buf.gnu_longname after allocating memory, which may cause a memory leak. |
CVE-2021-33645 | High | 7.5 | 2022-08-10 | The th_read() function doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory leak. |
CVE-2021-33644 | High | 8.1 | 2022-08-10 | An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causi… |
CVE-2021-33643 | Critical | 9.1 | 2022-08-10 | An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causi… |
CVE-2021-46304 | High | 7.5 | 2022-08-10 | A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions), CP-802… |
CVE-2021-37150 | High | 7.5 | 2022-08-10 | Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Tr… |
CVE-2021-41615 | Critical | 9.8 | 2022-08-08 | websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which d… |
CVE-2021-28511 | Medium | 5.8 | 2022-08-05 | This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the sec… |
CVE-2021-46681 | Medium | 4.0 | 2022-08-05 | A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via module massive operation name… |
CVE-2021-46680 | Medium | 4.0 | 2022-08-05 | A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the module form name field. |
CVE-2021-46679 | Medium | 4.0 | 2022-08-05 | A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via service elements. |
CVE-2021-46678 | Medium | 4.0 | 2022-08-05 | A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the service name field. |
CVE-2021-46677 | Medium | 4.0 | 2022-08-05 | A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the event filter name field. |
CVE-2021-46676 | Medium | 4.0 | 2022-08-05 | A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the transactional maps name f… |
CVE-2021-36861 | Medium | 5.4 | 2022-08-05 | Cross-Site Request Forgery (CSRF) vulnerability in Rich Reviews by Starfish plugin <= 1.9.14 at WordPress allows an attacker to delete reviews. |
CVE-2021-27798 | Medium | 5.5 | 2022-08-05 | A vulnerability in Brocade Fabric OS versions 7.4.1b and 7.3.1d could allow local users to conduct privileged directory transversal. Brocade Fabric OS versions… |
CVE-2021-32771 | High | 8.1 | 2022-08-04 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflow when copying an I… |
CVE-2021-23385 | Medium | 5.4 | 2022-08-02 | This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass UR… |
CVE-2021-27785 | Low | 3.9 | 2022-07-30 | HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the victim to first perfor… |
CVE-2021-39088 | High | 7.8 | 2022-07-28 | IBM QRadar SIEM 7.3, 7.4, and 7.5 is vulnerable to local privilege escalation if this could be combined with other unknown vulnerabilities then privilege escal… |
CVE-2021-41556 | Critical | 10.0 | 2022-07-28 | sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim e… |
CVE-2021-22650 | High | 7.5 | 2022-07-28 | An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code executio… |
CVE-2021-22648 | High | 8.8 | 2022-07-28 | Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file. |
CVE-2021-22646 | High | 8.8 | 2022-07-28 | The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution. |
CVE-2021-22644 | High | 7.5 | 2022-07-28 | Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key. |
CVE-2021-22642 | High | 7.5 | 2022-07-28 | An attacker could use specially crafted invalid Modbus frames to crash the Ovarro TBox system. |
CVE-2021-22640 | High | 7.5 | 2022-07-28 | An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks. |
CVE-2021-33371 | Medium | 5.4 | 2022-07-28 | A stored cross-site scripting (XSS) vulnerability in /nav_bar_action.php of Student Management System v1.0 allows attackers to execute arbitrary web scripts or… |
CVE-2021-46830 | Medium | 6.5 | 2022-07-27 | A path traversal vulnerability exists within GoAnywhere MFT before 6.8.3 that utilize self-registration for the GoAnywhere Web Client. This vulnerability could… |
CVE-2021-42537 | Medium | 5.9 | 2022-07-27 | VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of cont… |
CVE-2021-42535 | Medium | 5.3 | 2022-07-27 | VISAM VBASE version 11.6.0.6 does not neutralize or incorrectly neutralizes user-controllable input before the data is placed in output used as a public-facing… |