2021 CVEs (page 28)
Page 28 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-40955 | High | 7.2 | 2022-06-23 | SQL injection exists in LaiKetui v3.5.0 the background administrator list. |
CVE-2021-40954 | Critical | 9.8 | 2022-06-23 | Laiketui 3.5.0 is affected by an arbitrary file upload vulnerability that can allow an attacker to execute arbitrary code. |
CVE-2021-29055 | Medium | 6.1 | 2022-06-23 | Cross Site Scripting (XSS) vulnerability in sourcecodester School File Management System 1.0 via the Firtstname parameter to the Update Account form in student… |
CVE-2021-26638 | High | 7.3 | 2022-06-23 | Improper Authentication vulnerability in S&D smarthome(smartcare) application can cause authentication bypass and information exposure. Remote attackers can us… |
CVE-2021-26637 | High | 8.8 | 2022-06-23 | There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-300, GCM-300, so unauthorized users can… |
CVE-2021-26636 | High | 8.8 | 2022-06-23 | Stored XSS and SQL injection vulnerability in MaxBoard could lead to occur Remote Code Execution, which could lead to information exposure and privilege escala… |
CVE-2021-40511 | High | 7.5 | 2022-06-21 | OBDA systems’ Mastro 1.0 is vulnerable to XML Entity Expansion (aka “billion laughs”) attack allowing denial of service. |
CVE-2021-40510 | High | 7.5 | 2022-06-21 | XML eXternal Entity (XXE) in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via custom DTDs. |
CVE-2021-36761 | Medium | 5.3 | 2022-06-21 | The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF. |
CVE-2021-39006 | Medium | 5.3 | 2022-06-21 | IBM QRadar WinCollect Agent 10.0 and 10.0.1 could allow an attacker to obtain sensitive information due to missing best practices. IBM X-Force ID: 213549. |
CVE-2021-41924 | Medium | 6.1 | 2022-06-21 | Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS). |
CVE-2021-41683 | High | 7.8 | 2022-06-20 | There is a stack-overflow at ecma-helpers.c:326 in ecma_get_lex_env_type in JerryScript 2.4.0 |
CVE-2021-41682 | High | 7.8 | 2022-06-20 | There is a heap-use-after-free at ecma-helpers-string.c:1940 in ecma_compare_ecma_non_direct_strings in JerryScript 2.4.0 |
CVE-2021-25121 | Medium | 6.5 | 2022-06-20 | The Rating by BestWebSoft WordPress plugin before 1.6 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service… |
CVE-2021-25104 | Medium | 6.1 | 2022-06-20 | The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site… |
CVE-2021-25088 | Medium | 4.8 | 2022-06-20 | The XML Sitemaps WordPress plugin before 4.1.3 does not sanitise and escape a settings before outputting it in the Debug page, which could allow high privilege… |
CVE-2021-45918 | High | 7.5 | 2022-06-20 | NHI’s health insurance web service component has insufficient validation for input string length, which can result in heap-based buffer overflow attack. A remo… |
CVE-2021-46823 | Medium | 6.5 | 2022-06-18 | python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial… |
CVE-2021-46822 | Medium | 5.5 | 2022-06-18 | The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit… |
CVE-2021-40903 | Critical | 9.8 | 2022-06-17 | A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefine… |
CVE-2021-45026 | Medium | 6.1 | 2022-06-17 | ASG technologies ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cross Site Scripting (XSS). |
CVE-2021-45025 | High | 7.5 | 2022-06-17 | ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cleartext Storage of Sensitive Informati… |
CVE-2021-45024 | Critical | 9.8 | 2022-06-17 | ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to XML External Entity (XXE). |
CVE-2021-41490 | High | 7.5 | 2022-06-17 | Memory leaks in LazyPRM.cpp of OMPL v1.5.0 can cause unexpected behavior. |
CVE-2021-41408 | Critical | 9.8 | 2022-06-17 | VoIPmonitor WEB GUI up to version 24.61 is affected by SQL injection through the "api.php" file and "user" parameter. |
CVE-2021-46820 | High | 8.1 | 2022-06-16 | Arbitrary File Deletion vulnerability in XOS-Shop xos_shop_system 1.0.9 via current_manufacturer_image parameter to /shop/admin/categories.php |
CVE-2021-37764 | High | 8.1 | 2022-06-16 | Arbitrary File Deletion vulnerability in XOS-Shop xos_shop_system 1.0.9 via current_manufacturer_image parameter to /shop/admin/manufacturers.php. |
CVE-2021-36609 | Medium | 5.4 | 2022-06-16 | Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /linkedcontent/editfolder.php. |
CVE-2021-36608 | Medium | 5.4 | 2022-06-16 | Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /projects/editproject.php. |
CVE-2021-33295 | Medium | 5.4 | 2022-06-16 | Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html. |
CVE-2021-41487 | Critical | 9.8 | 2022-06-16 | NOKIA VitalSuite SPM 2020 is affected by SQL injection through UserName'. |
CVE-2021-36827 | Medium | 4.8 | 2022-06-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label". |
CVE-2021-41421 | Medium | 4.8 | 2022-06-16 | A PHP code injection vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker to gain RCE through the MaianAffiliate admin panel. |
CVE-2021-41420 | Medium | 5.4 | 2022-06-16 | A stored XSS vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker for arbitrary JavaScript code execution in the context of authenticated and… |
CVE-2021-3675 | Medium | 5.5 | 2022-06-16 | Improper Input Validation vulnerability in synaTEE.signed.dll of Synaptics Fingerprint Driver allows a local authorized attacker to overwrite a heap tag, with… |
CVE-2021-41654 | Critical | 9.8 | 2022-06-16 | SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/p… |
CVE-2021-41458 | Medium | 5.5 | 2022-06-16 | In GPAC MP4Box v1.1.0, there is a stack buffer overflow at src/utils/error.c:1769 which leads to a denial of service vulnerability. |
CVE-2021-41411 | Critical | 9.8 | 2022-06-16 | drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in… |
CVE-2021-41402 | High | 8.8 | 2022-06-16 | flatCore-CMS v2.0.8 has a code execution vulnerability, which could let a remote malicious user execute arbitrary PHP code. |
CVE-2021-41403 | Critical | 9.8 | 2022-06-15 | flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities. |
CVE-2021-43755 | High | 7.8 | 2022-06-15 | Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an Out-of-bounds Write vulnerability due to insecure handling of a mal… |
CVE-2021-42735 | High | 7.8 | 2022-06-15 | Adobe Photoshop version 22.5.1 (and earlier versions ) is affected by an Access of Memory Location After End of Buffer vulnerability, potentially resulting in… |
CVE-2021-41418 | Critical | 9.8 | 2022-06-15 | AriaNg v0.1.0~v1.2.2 is affected by an incorrect access control vulnerability through not authenticating visitors' access rights. |
CVE-2021-41415 | Medium | 6.1 | 2022-06-15 | Subscription-Manager v1.0 /main.js has a cross-site scripting (XSS) vulnerability in the machineDetail parameter. |
CVE-2021-36891 | Medium | 5.4 | 2022-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery by Supsystic plugin <= 1.15.5 at WordPress allows changing the plugin settings. |
CVE-2021-25261 | High | 7.8 | 2022-06-15 | Local privilege vulnerability in Yandex Browser for Windows prior to 22.5.0.862 allows a local, low privileged, attacker to execute arbitary code with the SYST… |
CVE-2021-43756 | High | 7.8 | 2022-06-15 | Adobe Media Encoder versions 22.0, 15.4.2 (and earlier) are affected by an Out-of-bounds Write vulnerability. An unauthenticated attacker could leverage this v… |
CVE-2021-43754 | High | 7.8 | 2022-06-15 | Adobe Prelude version 22.1.1 (and earlier) is affected by an Out-of-bounds Write vulnerability due to insecure handling of a malicious file, potentially result… |
CVE-2021-40776 | Medium | 6.1 | 2022-06-15 | Adobe Lightroom Classic 10.3 (and earlier) are affected by a privilege escalation vulnerability in the Offline Lightroom Classic installer. An authenticated at… |
CVE-2021-42732 | High | 7.8 | 2022-06-15 | Access of Memory Location After End of Buffer (CWE-788) |
CVE-2021-40940 | Critical | 9.8 | 2022-06-15 | Monstra 3.0.4 does not filter the case of php, which leads to an unrestricted file upload vulnerability. |
CVE-2021-40727 | High | 7.8 | 2022-06-15 | Access of Memory Location After End of Buffer (CWE-788 |
CVE-2021-39820 | High | 7.8 | 2022-06-15 | Adobe InDesign versions 16.3 (and earlier), and 16.3.1 (and earlier) is affected by an Out-of-bounds Write vulnerability due to insecure handling of a maliciou… |
CVE-2021-41672 | Medium | 6.5 | 2022-06-15 | PEEL Shopping CMS 9.4.0 is vulnerable to authenticated SQL injection in utilisateurs.php. A user that belongs to the administrator group can inject a malicious… |
CVE-2021-40910 | Medium | 6.1 | 2022-06-15 | There is a reflective cross-site scripting (XSS) vulnerability in the PHPCMS V9.6.3 management side. |
CVE-2021-33036 | High | 8.8 | 2022-06-15 | In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary co… |
CVE-2021-39806 | High | 7.8 | 2022-06-15 | In closef of label_backends_android.c, there is a possible way to corrupt memory due to a double free. This could lead to local escalation of privilege during… |
CVE-2021-36901 | Medium | 6.1 | 2022-06-15 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Phil Baker's Age Gate plugin <= 2.17.0 at WordPress. |
CVE-2021-39691 | High | 7.3 | 2022-06-15 | In WindowManager, there is a possible tapjacking attack due to an incorrect window flag when processing user input. This could lead to local escalation of priv… |
CVE-2021-41413 | High | 7.8 | 2022-06-15 | ok-file-formats master 2021-9-12 is affected by a buffer overflow in ok_jpg_convert_data_unit_grayscale and ok_jpg_convert_YCbCr_to_RGB. |
CVE-2021-40212 | Critical | 9.8 | 2022-06-15 | An exploitable out-of-bounds write vulnerability in PotPlayer 1.7.21523 build 210729 may lead to code execution, information disclosure, and denial of service. |
CVE-2021-42675 | Critical | 9.8 | 2022-06-14 | Kreado Kreasfero 1.5 does not properly sanitize uploaded files to the media directory. One can upload a malicious PHP file and obtain remote code execution. |
CVE-2021-40660 | High | 7.5 | 2022-06-14 | An issue was discovered in Delight Nashorn Sandbox 0.2.0. There is an ReDoS vulnerability that can be exploited to launching a denial of service (DoS) attack. |
CVE-2021-40678 | Medium | 5.4 | 2022-06-14 | In Piwigo 11.5.0, there exists a persistent cross-site scripting in the single mode function through /admin.php?page=batch_manager&mode=unit. |
CVE-2021-40658 | Medium | 4.8 | 2022-06-14 | Textpattern 4.8.7 is affected by a HTML injection vulnerability through “Content>Write>Body”. |
CVE-2021-40633 | High | 8.8 | 2022-06-14 | A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via… |
CVE-2021-40650 | Medium | 6.5 | 2022-06-14 | In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the secure flag set. |
CVE-2021-40649 | Medium | 6.5 | 2022-06-14 | In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the HttpOnly flag set. |
CVE-2021-40616 | Medium | 6.5 | 2022-06-14 | thinkcmf v5.1.7 has an unauthorized vulnerability. The attacker can modify the password of the administrator account with id 1 through the background user mana… |
CVE-2021-37182 | High | 7.5 | 2022-06-14 | A vulnerability has been identified in SCALANCE XM408-4C (All versions < V6.5), SCALANCE XM408-4C (L3 int.) (All versions < V6.5), SCALANCE XM408-8C (All versi… |
CVE-2021-35130 | High | 8.4 | 2022-06-14 | Memory corruption in graphics support layer due to use after free condition in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon… |
CVE-2021-35129 | High | 7.8 | 2022-06-14 | Memory corruption in BT controller due to improper length check while processing vendor specific commands in Snapdragon Compute, Snapdragon Connectivity, Snapd… |
CVE-2021-35126 | High | 8.4 | 2022-06-14 | Memory corruption in DSP service due to improper validation of input parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Ind… |
CVE-2021-35123 | High | 8.8 | 2022-06-14 | Buffer copy in GATT multi notification due to improper length check for the data coming over-the-air in Snapdragon Connectivity, Snapdragon Industrial IOT |
CVE-2021-35121 | Medium | 6.7 | 2022-06-14 | An array index is improperly used to lock and unlock a mutex which can lead to a Use After Free condition In the Synx driver in Snapdragon Compute, Snapdragon… |
CVE-2021-35120 | Medium | 6.7 | 2022-06-14 | Improper handling between export and release functions on the same handle from client can lead to use after free in Snapdragon Compute, Snapdragon Connectivity… |
CVE-2021-35119 | Medium | 5.5 | 2022-06-14 | Potential out of Bounds read in FIPS event processing due to improper validation of the length from the firmware in Snapdragon Auto, Snapdragon Compute, Snapdr… |
CVE-2021-35118 | Medium | 6.7 | 2022-06-14 | An out-of-bounds write can occur due to an incorrect input check in the camera driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdrag… |
CVE-2021-35116 | High | 7.7 | 2022-06-14 | APK can load a crafted model into the CDSP which can lead to a compromise of CDSP and other APK`s data executing there in Snapdragon Auto, Snapdragon Compute… |
CVE-2021-35114 | High | 8.4 | 2022-06-14 | Improper buffer initialization on the backend driver can lead to buffer overflow in Snapdragon Auto |
CVE-2021-35112 | High | 8.4 | 2022-06-14 | A user with user level permission can access graphics protected region due to improper access control in register configuration in Snapdragon Auto, Snapdragon… |
CVE-2021-35111 | High | 7.5 | 2022-06-14 | Improper validation of tag id while RRC sending tag id to MAC can lead to TOCTOU race condition in Snapdragon Connectivity, Snapdragon Mobile |
CVE-2021-35104 | Critical | 9.8 | 2022-06-14 | Possible buffer overflow due to improper parsing of headers while playing the FLAC audio clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2021-35102 | High | 7.8 | 2022-06-14 | Possible buffer overflow due to lack of validation for the length of NAI string read from EFS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2021-35101 | High | 7.1 | 2022-06-14 | Improper handling of writes to virtual GICR control can lead to assertion failure in the hypervisor in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile |
CVE-2021-35100 | High | 7.5 | 2022-06-14 | Possible buffer over read due to improper calculation of string length while parsing Id3 tag in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, S… |
CVE-2021-35098 | Medium | 6.7 | 2022-06-14 | Improper validation of session id in PCM routing process can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdra… |
CVE-2021-35096 | High | 7.5 | 2022-06-14 | Improper memory allocation during counter check DLM handling can lead to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sna… |
CVE-2021-35095 | High | 8.4 | 2022-06-14 | Improper serialization of message queue client registration can lead to race condition allowing multiple gunyah message clients to register with same label in… |
CVE-2021-35094 | High | 7.8 | 2022-06-14 | Improper verification of timeout-based authentication in identity credential can lead to invalid authorization in HLOS in Snapdragon Auto, Snapdragon Compute… |
CVE-2021-35092 | Medium | 6.7 | 2022-06-14 | Processing DCB/AVB algorithm with an invalid queue index from IOCTL request could lead to arbitrary address modification in Snapdragon Auto, Snapdragon Compute… |
CVE-2021-35091 | High | 8.4 | 2022-06-14 | Possible out of bounds read due to improper typecasting while handling page fault for global memory in Snapdragon Connectivity, Snapdragon Mobile |
CVE-2021-35090 | Critical | 9.3 | 2022-06-14 | Possible hypervisor memory corruption due to TOC TOU race condition when updating address mappings in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectiv… |
CVE-2021-35087 | High | 7.5 | 2022-06-14 | Possible null pointer access due to improper validation of system information message to be processed in Snapdragon Industrial IOT, Snapdragon Mobile |
CVE-2021-35086 | High | 7.5 | 2022-06-14 | Possible buffer over read due to improper validation of SIB type when processing a NR system Information message in Snapdragon Auto, Snapdragon Compute, Snapdr… |
CVE-2021-35085 | Medium | 5.5 | 2022-06-14 | Possible buffer overflow due to lack of buffer length check during management frame Rx handling in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2021-35084 | Medium | 5.5 | 2022-06-14 | Possible out of bound read due to lack of length check of data length for a DIAG event in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdra… |
CVE-2021-35083 | High | 8.2 | 2022-06-14 | Possible out of bound read due to improper validation of certificate chain in SSL or Internet key exchange in Snapdragon Auto, Snapdragon Compute, Snapdragon C… |
CVE-2021-35082 | Critical | 9.1 | 2022-06-14 | Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC security mode command packet has been received in Snapd… |
CVE-2021-35081 | Critical | 9.8 | 2022-06-14 | Possible buffer overflow due to improper validation of SSID length received from beacon or probe response during an IBSS session in Snapdragon Auto, Snapdragon… |