2021 CVEs (page 27)
Page 27 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-35283 | Critical | 9.8 | 2022-07-07 | SQL Injection vulnerability in product_admin.php in atoms183 CMS 1.0, allows attackers to execute arbitrary commands via the Name, Fname, and ID parameters to… |
CVE-2021-29281 | Critical | 9.8 | 2022-07-07 | File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which is affected by CVE-… |
CVE-2021-44791 | Medium | 6.1 | 2022-07-07 | In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possibl… |
CVE-2021-31645 | High | 7.5 | 2022-07-07 | An issue was discovered in glFTPd 2.11a that allows remote attackers to cause a denial of service via exceeding the connection limit. |
CVE-2021-46825 | Critical | 9.1 | 2022-07-07 | Symantec Advanced Secure Gateway (ASG) and ProxySG are susceptible to an HTTP desync vulnerability. When a remote unauthenticated attacker and other web client… |
CVE-2021-4234 | High | 7.5 | 2022-07-06 | OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple packets in a response to a reset packet sent from the client which the clie… |
CVE-2021-3697 | High | 7.0 | 2022-07-06 | A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. To a successful to be perform… |
CVE-2021-3696 | Medium | 4.5 | 2022-07-06 | A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap space. Confidential… |
CVE-2021-3695 | Medium | 4.5 | 2022-07-06 | A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause heap data corruption o… |
CVE-2021-37839 | Medium | 4.3 | 2022-07-06 | Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata includ… |
CVE-2021-31679 | Medium | 6.5 | 2022-07-06 | An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that allows attackers to delete admin and other members' account numbers. |
CVE-2021-31678 | Medium | 6.5 | 2022-07-06 | An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that can delete import information about a user's company. |
CVE-2021-31677 | Medium | 6.5 | 2022-07-06 | An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that can modify admin and other members' passwords. |
CVE-2021-31676 | Medium | 6.1 | 2022-07-06 | A reflected XSS was discovered in PESCMS-V2.3.3. When combined with CSRF in the same file, they can cause bigger destruction. |
CVE-2021-46687 | Medium | 4.9 | 2022-07-06 | JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects… |
CVE-2021-45721 | Medium | 6.1 | 2022-07-06 | JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API… |
CVE-2021-23163 | Low | 3.1 | 2022-07-06 | JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints. This issue affects: JFrog JF… |
CVE-2021-44915 | High | 7.2 | 2022-07-05 | Taocms 3.0.2 was discovered to contain a blind SQL injection vulnerability via the function Edit category. |
CVE-2021-43116 | High | 8.8 | 2022-07-05 | An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change… |
CVE-2021-43702 | Critical | 9.0 | 2022-07-05 | ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attack… |
CVE-2021-25066 | Medium | 4.8 | 2022-07-04 | The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Sit… |
CVE-2021-25056 | Medium | 4.8 | 2022-07-04 | The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scri… |
CVE-2021-37524 | Medium | 6.1 | 2022-07-01 | Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26 allows remote unauthenticated users to inject arbitrary web script or HTML via an unsanitized "pat… |
CVE-2021-32428 | Critical | 9.8 | 2022-07-01 | SQL Injection vulnerability in viaviwebtech Android EBook App (Books App, PDF, ePub, Online Book Reading, Download Books) 10 via the author_id parameter to api… |
CVE-2021-41995 | High | 7.7 | 2022-06-30 | A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass. |
CVE-2021-38954 | Medium | 4.3 | 2022-06-30 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could disclose sensitive version information that could aid in… |
CVE-2021-38941 | High | 8.1 | 2022-06-30 | IBM CloudPak for Multicloud Monitoring 2.0 and 2.3 has a few containers running in privileged mode which is vulnerable to host information leakage or destructi… |
CVE-2021-37791 | Medium | 4.9 | 2022-06-30 | MyAdmin v1.0 is affected by an incorrect access control vulnerability in viewing personal center in /api/user/userData?userCode=admin. |
CVE-2021-37778 | Critical | 9.8 | 2022-06-30 | There is a buffer overflow in gps-sdr-sim v1.0 when parsing long command line parameters, which can lead to DoS or code execution. |
CVE-2021-37770 | High | 7.2 | 2022-06-30 | Nucleus CMS v3.71 is affected by a file upload vulnerability. In this vulnerability, we can use upload to change the upload path to the path without the Htacce… |
CVE-2021-41506 | Critical | 9.8 | 2022-06-30 | Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R11.7601.Nat.Onvif.2… |
CVE-2021-40663 | Critical | 9.8 | 2022-06-30 | deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). |
CVE-2021-40643 | Critical | 9.8 | 2022-06-30 | EyesOfNetwork before 07-07-2021 has a Remote Code Execution vulnerability on the mail options configuration page. In the location of the "sendmail" application… |
CVE-2021-40597 | Critical | 9.8 | 2022-06-29 | The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password. |
CVE-2021-39074 | Medium | 6.1 | 2022-06-29 | IBM Security Guardium 11.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2021-40642 | Medium | 4.3 | 2022-06-29 | Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php… |
CVE-2021-41559 | Medium | 6.5 | 2022-06-28 | Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML document. |
CVE-2021-3435 | Medium | 4.0 | 2022-06-28 | Information leakage in le_ecred_conn_req(). Zephyr versions >= v2.4.0 Use of Uninitialized Resource (CWE-908). For more information, see https://github.com/zep… |
CVE-2021-3434 | Medium | 4.9 | 2022-06-28 | Stack based buffer overflow in le_ecred_conn_req(). Zephyr versions >= v2.5.0 Stack-based Buffer Overflow (CWE-121). For more information, see https://github.c… |
CVE-2021-3433 | Medium | 4.0 | 2022-06-28 | Invalid channel map in CONNECT_IND results to Deadlock. Zephyr versions >= v2.5.0 Improper Check or Handling of Exceptional Conditions (CWE-703). For more info… |
CVE-2021-3432 | Medium | 4.3 | 2022-06-28 | Invalid interval in CONNECT_IND leads to Division by Zero. Zephyr versions >= v1.14.0 Divide By Zero (CWE-369). For more information, see https://github.com/ze… |
CVE-2021-3431 | Medium | 4.3 | 2022-06-28 | Assertion reachable with repeated LL_FEATURE_REQ. Zephyr versions >= v2.5.0 contain Reachable Assertion (CWE-617). For more information, see https://github.com… |
CVE-2021-3430 | Medium | 6.5 | 2022-06-28 | Assertion reachable with repeated LL_CONNECTION_PARAM_REQ. Zephyr versions >= v1.14 contain Reachable Assertion (CWE-617). For more information, see https://gi… |
CVE-2021-40553 | High | 8.8 | 2022-06-28 | piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor. |
CVE-2021-3779 | Medium | 6.5 | 2022-06-28 | A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. Th… |
CVE-2021-41690 | High | 7.5 | 2022-06-28 | DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are no… |
CVE-2021-41689 | High | 7.5 | 2022-06-28 | DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result eve… |
CVE-2021-41688 | High | 7.5 | 2022-06-28 | DCMTK through 3.6.6 does not handle memory free properly. The object in the program is free but its address is still used in other locations. Sending specific… |
CVE-2021-41687 | High | 7.5 | 2022-06-28 | DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sendin… |
CVE-2021-41460 | High | 7.5 | 2022-06-28 | ECShop 4.1.0 has SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information. |
CVE-2021-40944 | Medium | 5.5 | 2022-06-28 | In GPAC MP4Box 1.1.0, there is a Null pointer reference in the function gf_filter_pid_get_packet function in src/filter_core/filter_pid.c:5394, as demonstrated… |
CVE-2021-40943 | Medium | 5.5 | 2022-06-28 | In Bento4 1.6.0-638, there is a null pointer reference in the function AP4_DescriptorListInspector::Action function in Ap4Descriptor.h:124 , as demonstrated by… |
CVE-2021-40609 | Medium | 5.5 | 2022-06-28 | The GetHintFormat function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command. |
CVE-2021-40608 | Medium | 5.5 | 2022-06-28 | The gf_hinter_track_finalize function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command. |
CVE-2021-40607 | Medium | 5.5 | 2022-06-28 | The schm_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command. |
CVE-2021-40606 | Medium | 5.5 | 2022-06-28 | The gf_bs_write_data function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command. |
CVE-2021-40942 | Medium | 5.5 | 2022-06-27 | In GPAC MP4Box v1.1.0, there is a heap-buffer-overflow in the function filter_parse_dyn_args function in filter_core/filter.c:1454, as demonstrated by GPAC. Th… |
CVE-2021-40941 | High | 7.5 | 2022-06-27 | In Bento4 1.6.0-638, there is an allocator is out of memory in the function AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity in Ap4Array.h:172, as demonstrated b… |
CVE-2021-33654 | High | 7.5 | 2022-06-27 | When performing the initialization operation of the Split operator, if a dimension in the input shape is 0, it will cause a division by 0 exception. |
CVE-2021-33653 | High | 7.5 | 2022-06-27 | When performing the derivation shape operation of the SpaceToBatch operator, if there is a value of 0 in the parameter block_shape element, it will cause a div… |
CVE-2021-33652 | High | 7.5 | 2022-06-27 | When the Reduce operator run operation is executed, if there is a value of 0 in the parameter axis_sizes element, it will cause a division by 0 exception. |
CVE-2021-33651 | High | 7.5 | 2022-06-27 | When performing the analytical operation of the DepthwiseConv2D operator, if the attribute depth_multiplier is 0, it will cause a division by 0 exception. |
CVE-2021-33650 | High | 7.5 | 2022-06-27 | When performing the inference shape operation of the SparseToDense operator, if the number of inputs is less than three, it will access data outside of bounds… |
CVE-2021-33649 | High | 7.5 | 2022-06-27 | When performing the inference shape operation of the Transpose operator, if the value in the perm element is greater than or equal to the size of the input_sha… |
CVE-2021-33648 | High | 7.5 | 2022-06-27 | When performing the inference shape operation of Affine, Concat, MatMul, ArgMinMax, EmbeddingLookup, and Gather operators, if the input shape size is 0, it wil… |
CVE-2021-33647 | High | 7.5 | 2022-06-27 | When performing the inference shape operation of the Tile operator, if the input data type is not int or int32, it will access data outside of bounds of heap a… |
CVE-2021-40901 | High | 7.5 | 2022-06-27 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scniro-validator v1.0.1 when validating crafted invalid emails. |
CVE-2021-40900 | High | 7.5 | 2022-06-27 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in regexfn v1.0.5 when validating crafted invalid emails. |
CVE-2021-40899 | High | 7.5 | 2022-06-27 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in repo-git-downloader v0.1.1 when downloading crafted invalid git repositories. |
CVE-2021-40898 | High | 7.5 | 2022-06-27 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scaffold-helper v1.2.0 when copying crafted invalid files. |
CVE-2021-40897 | High | 7.5 | 2022-06-27 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in split-html-to-chars v1.0.5 when splitting crafted invalid htmls. |
CVE-2021-40896 | High | 7.5 | 2022-06-27 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in that-value v0.1.3 when validating crafted invalid emails. |
CVE-2021-40895 | High | 7.5 | 2022-06-27 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in todo-regex v0.1.1 when matching crafted invalid TODO statements. |
CVE-2021-40894 | High | 7.5 | 2022-06-24 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in underscore-99xp v1.7.2 when the deepValueSearch function is called. |
CVE-2021-42056 | Medium | 6.7 | 2022-06-24 | Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, throug… |
CVE-2021-40893 | High | 7.5 | 2022-06-24 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-data v0.1.1 when validating crafted invalid emails. |
CVE-2021-39409 | Critical | 9.8 | 2022-06-24 | A vulnerability exists in Online Student Rate System v1.0 that allows any user to register as an administrator without needing to be authenticated. |
CVE-2021-39408 | Medium | 6.1 | 2022-06-24 | Cross Site Scripting (XSS) vulnerability exists in Online Student Rate System 1.0 via the page parameter on the index.php file |
CVE-2021-38879 | Medium | 5.3 | 2022-06-24 | IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTP… |
CVE-2021-38871 | Medium | 5.4 | 2022-06-24 | IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2021-29865 | Medium | 5.4 | 2022-06-24 | IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to… |
CVE-2021-20551 | Low | 3.3 | 2022-06-24 | IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force I… |
CVE-2021-20544 | Medium | 4.3 | 2022-06-24 | IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to sen… |
CVE-2021-20543 | Medium | 5.4 | 2022-06-24 | IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when view… |
CVE-2021-20421 | Medium | 4.3 | 2022-06-24 | IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to sen… |
CVE-2021-20355 | Medium | 5.3 | 2022-06-24 | IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTP… |
CVE-2021-39047 | Medium | 6.1 | 2022-06-24 | IBM Planning Analytics 2.0 and IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 are vulnerable to cross-site scripting. This vulnerability allows users to embed… |
CVE-2021-38945 | Critical | 9.8 | 2022-06-24 | IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validation. IBM X-Force ID… |
CVE-2021-29768 | Medium | 6.5 | 2022-06-24 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a low level user to obtain sensitive information from the details of the 'Cloud Storage' page for w… |
CVE-2021-30651 | Medium | 4.9 | 2022-06-24 | A malicious authenticated SMG administrator user can obtain passwords for external LDAP/Active Directory servers that they might not otherwise be authorized to… |
CVE-2021-40892 | High | 7.5 | 2022-06-24 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-color v2.1.0 when handling crafted invalid rgb(a) strings. |
CVE-2021-41639 | Medium | 5.5 | 2022-06-24 | MELAG FTP Server 2.2.0.4 stores unencrpyted passwords of FTP users in a local configuration file. |
CVE-2021-41638 | High | 7.5 | 2022-06-24 | The authentication checks of the MELAG FTP Server in version 2.2.0.4 are incomplete, which allows a remote attacker to access local files only by using a valid… |
CVE-2021-41637 | High | 7.1 | 2022-06-24 | Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the "Everyone" group to read the local FTP configuration file, which includes among other inf… |
CVE-2021-41636 | Medium | 6.5 | 2022-06-24 | MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire operating system, w… |
CVE-2021-41635 | High | 8.8 | 2022-06-24 | When installed as Windows service MELAG FTP Server 2.2.0.4 is run as SYSTEM user, which grants remote attackers to abuse misconfigurations or vulnerabilities w… |
CVE-2021-41634 | Medium | 5.3 | 2022-06-24 | A user enumeration vulnerability in MELAG FTP Server 2.2.0.4 allows an attacker to identify valid FTP usernames. |
CVE-2021-46824 | Medium | 5.4 | 2022-06-23 | Cross Site Scripting (XSS) vulnerability in sourcecodester School File Management System 1.0 via the Lastname parameter to the Update Account form in student_p… |
CVE-2021-41432 | Medium | 5.4 | 2022-06-23 | A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaScript commands through blog content. |
CVE-2021-40956 | High | 7.5 | 2022-06-23 | LaiKetui v3.5.0 has SQL injection in the background through the menu management function, and sensitive data can be obtained. |