2021 CVEs (page 26)
Page 26 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-38417 | High | 7.4 | 2022-07-27 | VISAM VBASE version 11.6.0.6 is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user viewing access to fo… |
CVE-2021-38410 | High | 7.3 | 2022-07-27 | AVEVA Software Platform Common Services (PCS) Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to DLL hijacking through an uncontrolled search pat… |
CVE-2021-40180 | High | 7.5 | 2022-07-26 | In the WeChat application 8.0.10 for Android and iOS, a mini program can obtain sensitive information from a user's address book via wx.searchContacts. |
CVE-2021-33057 | High | 7.5 | 2022-07-26 | The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) for determining the d… |
CVE-2021-33468 | Medium | 5.5 | 2022-07-26 | An issue was discovered in yasm version 1.3.0. There is a use-after-free in error() in modules/preprocs/nasm/nasm-pp.c. |
CVE-2021-33467 | Medium | 5.5 | 2022-07-26 | An issue was discovered in yasm version 1.3.0. There is a use-after-free in pp_getline() in modules/preprocs/nasm/nasm-pp.c. |
CVE-2021-33466 | Medium | 5.5 | 2022-07-26 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_smacro() in modules/preprocs/nasm/nasm-pp.c. |
CVE-2021-33465 | Medium | 5.5 | 2022-07-26 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmacro() in modules/preprocs/nasm/nasm-pp.c. |
CVE-2021-33464 | Medium | 5.5 | 2022-07-26 | An issue was discovered in yasm version 1.3.0. There is a heap-buffer-overflow in inc_fopen() in modules/preprocs/nasm/nasm-pp.c. |
CVE-2021-33463 | Medium | 5.5 | 2022-07-26 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr__copy_except() in libyasm/expr.c. |
CVE-2021-33462 | Medium | 5.5 | 2022-07-26 | An issue was discovered in yasm version 1.3.0. There is a use-after-free in expr_traverse_nodes_post() in libyasm/expr.c. |
CVE-2021-33461 | Medium | 5.5 | 2022-07-26 | An issue was discovered in yasm version 1.3.0. There is a use-after-free in yasm_intnum_destroy() in libyasm/intnum.c. |
CVE-2021-33460 | Medium | 5.5 | 2022-07-26 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in if_condition() in modules/preprocs/nasm/nasm-pp.c. |
CVE-2021-33459 | Medium | 5.5 | 2022-07-26 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in nasm_parser_directive() in modules/parsers/nasm/nasm-parse.c. |
CVE-2021-33458 | Medium | 5.5 | 2022-07-26 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in find_cc() in modules/preprocs/nasm/nasm-pp.c. |
CVE-2021-33457 | Medium | 5.5 | 2022-07-26 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmac_params() in modules/preprocs/nasm/nasm-pp.c. |
CVE-2021-33456 | Medium | 5.5 | 2022-07-26 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in hash() in modules/preprocs/nasm/nasm-pp.c. |
CVE-2021-33455 | Medium | 5.5 | 2022-07-26 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in do_directive() in modules/preprocs/nasm/nasm-pp.c. |
CVE-2021-33454 | Medium | 5.5 | 2022-07-26 | An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr_get_intnum() in libyasm/expr.c. |
CVE-2021-33453 | High | 7.8 | 2022-07-26 | An issue was discovered in lrzip version 0.641. There is a use-after-free in ucompthread() in stream.c:1538. |
CVE-2021-33452 | Medium | 5.5 | 2022-07-26 | An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_malloc() in nasmlib/alloc.c. |
CVE-2021-33451 | Medium | 5.5 | 2022-07-26 | An issue was discovered in lrzip version 0.641. There are memory leaks in fill_buffer() in stream.c. |
CVE-2021-33450 | Medium | 5.5 | 2022-07-26 | An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c. |
CVE-2021-33449 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_part_get_by_offs… |
CVE-2021-33448 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs(mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow at 0x7fffe9049390. |
CVE-2021-33447 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_print() in mjs.c. |
CVE-2021-33446 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_next() in mjs.c. |
CVE-2021-33445 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_string_char_code_at()… |
CVE-2021-33444 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in getprop_builtin_foreign()… |
CVE-2021-33443 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow in mjs_execute() in mjs.c. |
CVE-2021-33442 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in json_printf() in mjs.c. |
CVE-2021-33441 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in exec_expr() in mjs.c. |
CVE-2021-33440 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_commit() in mjs… |
CVE-2021-33439 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is Integer overflow in gc_compact_strings() in mjs.c. |
CVE-2021-33438 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow in json_parse_array() in mjs.c. |
CVE-2021-33437 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There are memory leaks in frozen_cb() in mjs.c. |
CVE-2021-43959 | Medium | 5.7 | 2022-07-26 | Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network re… |
CVE-2021-40336 | Medium | 5.0 | 2022-07-25 | A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitti… |
CVE-2021-40335 | Medium | 5.0 | 2022-07-25 | A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intention… |
CVE-2021-23451 | Medium | 6.5 | 2022-07-25 | The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-f… |
CVE-2021-23397 | Medium | 5.6 | 2022-07-25 | All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger inste… |
CVE-2021-23373 | High | 7.5 | 2022-07-25 | All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality. |
CVE-2021-46829 | High | 7.8 | 2022-07-24 | GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-… |
CVE-2021-36200 | Medium | 5.3 | 2022-07-22 | Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 1… |
CVE-2021-36849 | Low | 3.4 | 2022-07-20 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in René Hermenau's Social Media Share Buttons plugin <= 3.8.1 at WordPress. |
CVE-2021-38936 | Medium | 4.9 | 2022-07-20 | IBM QRadar SIEM 7.3, 7.4, and 7.5 could disclose highly sensitive information to a privileged user. IBM X-Force ID: 210893. |
CVE-2021-29755 | High | 7.5 | 2022-07-20 | IBM QRadar SIEM 7.3, 7.4, and 7.5 does not preform proper certificate validation for some inter-host communications. IBM X-Force ID: 202015. |
CVE-2021-31858 | Medium | 5.4 | 2022-07-20 | DotNetNuke (DNN) 9.9.1 CMS is vulnerable to a Stored Cross-Site Scripting vulnerability in the user profile biography section which allows remote authenticated… |
CVE-2021-46828 | High | 7.5 | 2022-07-20 | In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. T… |
CVE-2021-32504 | Medium | 5.3 | 2022-07-19 | Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use t… |
CVE-2021-41031 | High | 7.8 | 2022-07-18 | A relative path traversal vulnerability [CWE-23] in FortiClient for Windows versions 7.0.2 and prior, 6.4.6 and prior and 6.2.9 and below may allow a local unp… |
CVE-2021-38868 | Medium | 6.5 | 2022-07-18 | IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site request forgery which could allow an attacker to execute… |
CVE-2021-29799 | Medium | 6.5 | 2022-07-18 | IBM Engineering Requirements Quality Assistant On-Premises (All versions) could allow an authenticated user to obtain sensitive information due to improper cli… |
CVE-2021-29790 | Medium | 5.4 | 2022-07-18 | IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbit… |
CVE-2021-29788 | Medium | 5.4 | 2022-07-18 | IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbit… |
CVE-2021-22131 | Medium | 6.4 | 2022-07-18 | A improper validation of certificate with host mismatch in Fortinet FortiTokenAndroid version 5.0.3 and below, Fortinet FortiTokeniOS version 5.2.0 and below… |
CVE-2021-44170 | Medium | 6.7 | 2022-07-18 | A stack-based buffer overflow vulnerability [CWE-121] in the command line interpreter of FortiOS before 7.0.4 and FortiProxy before 2.0.8 may allow an authenti… |
CVE-2021-42755 | Medium | 4.3 | 2022-07-18 | An integer overflow / wraparound vulnerability [CWE-190] in FortiSwitch 7.0.2 and below, 6.4.9 and below, 6.2.x, 6.0.x; FortiRecorder 6.4.2 and below, 6.0.10 a… |
CVE-2021-33656 | Medium | 6.8 | 2022-07-18 | When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds. |
CVE-2021-33655 | Medium | 6.7 | 2022-07-18 | When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds. |
CVE-2021-44954 | High | 7.8 | 2022-07-18 | In QVIS NVR DVR before 2021-12-13, an attacker can escalate privileges from a qvisdvr user to the root user by abusing a Sudo misconfiguration. |
CVE-2021-42923 | High | 7.3 | 2022-07-18 | ShowMyPC 3606 on Windows suffers from a DLL hijack vulnerability. If an attacker overwrites the file %temp%\ShowMyPC\-ShowMyPC3606\wodVPN.dll, it will run any… |
CVE-2021-41419 | Critical | 9.8 | 2022-07-18 | QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization. |
CVE-2021-40874 | Critical | 9.8 | 2022-07-18 | An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using the RESTServer plug-in to operate a REST password validation service (for anothe… |
CVE-2021-40150 | High | 7.5 | 2022-07-17 | The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly accessible path. In th… |
CVE-2021-46784 | Medium | 6.5 | 2022-07-17 | In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher… |
CVE-2021-40149 | Medium | 5.9 | 2022-07-17 | The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory. In this way an attacker can download th… |
CVE-2021-24655 | High | 7.5 | 2022-07-17 | The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any… |
CVE-2021-36711 | Critical | 9.8 | 2022-07-16 | WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled. |
CVE-2021-34538 | High | 7.5 | 2022-07-16 | Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found tha… |
CVE-2021-34987 | High | 8.2 | 2022-07-15 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.5.1 (49187). An attacker must first obtain t… |
CVE-2021-34986 | High | 7.8 | 2022-07-15 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.5.0 (49183). An attacker must first obtain t… |
CVE-2021-36461 | High | 8.8 | 2022-07-15 | An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictur… |
CVE-2021-4135 | Medium | 5.5 | 2022-07-14 | A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that f… |
CVE-2021-26384 | High | 7.8 | 2022-07-14 | A malformed SMI (System Management Interface) command may allow an attacker to establish a corrupted SMI Trigger Info data structure, potentially leading to ou… |
CVE-2021-26382 | Medium | 4.4 | 2022-07-14 | An attacker with root account privileges can load any legitimately signed firmware image into the Audio Co-Processor (ACP,) irrespective of the respective sign… |
CVE-2021-39028 | Medium | 5.4 | 2022-07-14 | IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTTP header injection, caused by improper validation… |
CVE-2021-39019 | Medium | 6.5 | 2022-07-14 | IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose highly sensitive information through an HTTP GET reque… |
CVE-2021-39018 | Medium | 4.3 | 2022-07-14 | IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose sensitive information in a SQL error message that coul… |
CVE-2021-39017 | Medium | 6.5 | 2022-07-14 | IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to upload arbitrary files, caused by im… |
CVE-2021-39016 | Medium | 4.3 | 2022-07-14 | IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 does not sufficiently monitor or control transmitted network traffic… |
CVE-2021-39015 | Medium | 5.4 | 2022-07-14 | IBM Engineering Lifecycle Optimization - Publishing 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbit… |
CVE-2021-45492 | High | 7.8 | 2022-07-14 | In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the system-wide PATH e… |
CVE-2021-46827 | Medium | 6.1 | 2022-07-13 | An issue was discovered in Oxygen XML WebHelp before 22.1 build 2021082006 and 23.x before 23.1 build 2021090310. An XSS vulnerability in search terms proposal… |
CVE-2021-39041 | Medium | 5.3 | 2022-07-12 | IBM QRadar SIEM 7.3, 7.4, and 7.5 may be vulnerable to partial denial of service attack, resulting in some protocols not listening to specified ports. IBM X-Fo… |
CVE-2021-46741 | High | 7.5 | 2022-07-12 | The basic framework and setting module have defects, which were introduced during the design. Successful exploitation of this vulnerability may affect system i… |
CVE-2021-41396 | High | 7.5 | 2022-07-12 | Live555 through 1.08 does not handle socket connections properly. A huge number of incoming socket connections in a short time invokes the error-handling modul… |
CVE-2021-40016 | Medium | 6.5 | 2022-07-12 | Improper permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability will affect confidentiality. |
CVE-2021-40013 | Medium | 6.5 | 2022-07-12 | Improper permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability will affect integrity. |
CVE-2021-40012 | High | 7.5 | 2022-07-12 | Vulnerability of pointers being incorrectly used during data transmission in the video framework. Successful exploitation of this vulnerability may affect conf… |
CVE-2021-39999 | High | 7.5 | 2022-07-12 | There is a buffer overflow vulnerability in eSE620X vESS V100R001C10SPC200 and V100R001C20SPC200. An attacker can exploit this vulnerability by sending a speci… |
CVE-2021-38289 | High | 8.8 | 2022-07-12 | An issue has been discovered in Novastar-VNNOX-iCare Novaicare 7.16.0 that gives attacker privilege escalation and allows attackers to view corporate informati… |
CVE-2021-36668 | High | 7.8 | 2022-07-12 | URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron App. |
CVE-2021-36667 | High | 7.8 | 2022-07-12 | Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server du… |
CVE-2021-36666 | High | 7.8 | 2022-07-12 | An issue was discovered in Druva 6.9.0 for MacOS, allows attackers to gain escalated local privileges via the inSyncDecommission. |
CVE-2021-36665 | High | 7.8 | 2022-07-12 | An issue was discovered in Druva 6.9.0 for macOS, allows attackers to gain escalated local privileges via the inSyncUpgradeDaemon. |
CVE-2021-44222 | Critical | 9.1 | 2022-07-12 | A vulnerability has been identified in SIMATIC eaSie Core Package (All versions < V22.00). The underlying MQTT service of affected systems does not perform aut… |
CVE-2021-44221 | High | 7.5 | 2022-07-12 | A vulnerability has been identified in SIMATIC eaSie Core Package (All versions < V22.00). The affected systems do not properly validate input that is sent to… |
CVE-2021-41037 | Critical | 10.0 | 2022-07-08 | In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoin… |
CVE-2021-41042 | Medium | 5.3 | 2022-07-07 | In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This… |