2021 CVEs (page 29)
Page 29 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-35080 | Medium | 6.5 | 2022-06-14 | Disabled SMMU from secure side while RPM is assigned a secure stream can lead to information disclosure in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdr… |
CVE-2021-35079 | Medium | 6.2 | 2022-06-14 | Improper validation of permissions for third party application accessing Telephony service API can lead to information disclosure in Snapdragon Compute, Snapdr… |
CVE-2021-35078 | High | 7.5 | 2022-06-14 | Possible memory leak due to improper validation of certificate chain length while parsing server certificate chain in Snapdragon Auto, Snapdragon Compute, Snap… |
CVE-2021-35076 | High | 7.5 | 2022-06-14 | Possible null pointer dereference due to improper validation of RRC connection reconfiguration message in Snapdragon Auto, Snapdragon Compute, Snapdragon Conne… |
CVE-2021-35073 | High | 7.5 | 2022-06-14 | Possible assertion due to improper validation of rank restriction field in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial… |
CVE-2021-35072 | High | 7.8 | 2022-06-14 | Possible buffer overflow due to improper validation of array index while processing external DIAG command in Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag… |
CVE-2021-35071 | Medium | 5.5 | 2022-06-14 | Possible buffer over read due to lack of size validation while copying data from DBR buffer to RX buffer and can lead to Denial of Service in Snapdragon Auto… |
CVE-2021-35070 | Medium | 6.5 | 2022-06-14 | RPM secure Stream can access any secure resource due to improper SMMU configuration and can lead to information disclosure in Snapdragon Industrial IOT, Snapdr… |
CVE-2021-30350 | High | 8.4 | 2022-06-14 | Lack of MBN header size verification against input buffer can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdr… |
CVE-2021-30349 | High | 8.2 | 2022-06-14 | Improper access control sequence for AC database after memory allocation can lead to possible memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdra… |
CVE-2021-30347 | Critical | 9.1 | 2022-06-14 | Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC Command packet has been received in Snapdragon Auto, Sn… |
CVE-2021-30346 | Medium | 6.5 | 2022-06-14 | RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snap… |
CVE-2021-30345 | Medium | 6.5 | 2022-06-14 | RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snap… |
CVE-2021-30344 | High | 7.5 | 2022-06-14 | Improper authorization of a replayed LTE security mode command can lead to a denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2021-30343 | Critical | 9.1 | 2022-06-14 | Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdrag… |
CVE-2021-30342 | Critical | 9.1 | 2022-06-14 | Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdrag… |
CVE-2021-30341 | Critical | 9.8 | 2022-06-14 | Improper buffer size validation of DSM packet received can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdrago… |
CVE-2021-30340 | High | 7.5 | 2022-06-14 | Reachable assertion due to improper validation of coreset in PDCCH configuration in SA mode in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sn… |
CVE-2021-30339 | Critical | 9.0 | 2022-06-14 | Reading PRNG output may lead to improper key generation due to lack of buffer validation in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobi… |
CVE-2021-30338 | High | 7.1 | 2022-06-14 | Improper input validation in TrustZone memory transfer interface can lead to information disclosure in Snapdragon Compute |
CVE-2021-30334 | High | 8.4 | 2022-06-14 | Possible use after free due to lack of null check of DRM file status after file structure is freed in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectiv… |
CVE-2021-30327 | High | 7.5 | 2022-06-14 | Buffer overflow in sahara protocol while processing commands leads to overwrite of secure configuration data in Snapdragon Mobile, Snapdragon Compute, Snapdrag… |
CVE-2021-30281 | High | 8.4 | 2022-06-14 | Possible unauthorized access to secure space due to improper check of data allowed while flashing the no access control device configuration in Snapdragon Auto… |
CVE-2021-41662 | Critical | 9.8 | 2022-06-13 | The South Gate Inn Online Reservation System v1.0 contains an SQL injection vulnerability that can be chained with a malicious PHP file upload, which is caused… |
CVE-2021-41661 | Critical | 9.8 | 2022-06-13 | Church Management System version 1.0 is affected by a SQL anjection vulnerability through creating a user with a PHP file as an avatar image, which is accessib… |
CVE-2021-41663 | Medium | 6.1 | 2022-06-13 | A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11. The vulnerability exists in the article upload: post-edit.php page. |
CVE-2021-40604 | Critical | 9.1 | 2022-06-13 | A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger d… |
CVE-2021-40036 | Critical | 9.8 | 2022-06-13 | The bone voice ID TA has a memory overwrite vulnerability. Successful exploitation of this vulnerability may result in malicious code execution. |
CVE-2021-46813 | High | 7.5 | 2022-06-13 | Vulnerability of residual files not being deleted after an update in the ChinaDRM module. Successful exploitation of this vulnerability may affect availability. |
CVE-2021-46812 | High | 7.5 | 2022-06-13 | The Device Manager has a vulnerability in multi-device interaction. Successful exploitation of this vulnerability may affect data integrity. |
CVE-2021-46811 | Medium | 5.3 | 2022-06-13 | HwSEServiceAPP has a vulnerability in permission management. Successful exploitation of this vulnerability may cause disclosure of the Card Production Life Cyc… |
CVE-2021-46814 | High | 7.5 | 2022-06-13 | The video framework has an out-of-bounds memory read/write vulnerability. Successful exploitation of this vulnerability may affect system availability. |
CVE-2021-46818 | High | 7.8 | 2022-06-13 | Adobe Media Encoder version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability… |
CVE-2021-46817 | High | 7.8 | 2022-06-13 | Adobe Media Encoder version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability… |
CVE-2021-46816 | High | 7.8 | 2022-06-13 | Adobe Premiere Pro version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability… |
CVE-2021-40902 | Medium | 5.4 | 2022-06-13 | flatCore-CMS version 2.0.8 is affected by Cross Site Scripting (XSS) in the "Create New Page" option through the index page. |
CVE-2021-25116 | Medium | 6.5 | 2022-06-13 | The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the i… |
CVE-2021-37404 | Critical | 9.8 | 2022-06-13 | There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial… |
CVE-2021-41641 | High | 8.4 | 2022-06-12 | Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain… |
CVE-2021-41750 | Medium | 6.1 | 2022-06-12 | A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /i… |
CVE-2021-41749 | Critical | 9.8 | 2022-06-12 | In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for rem… |
CVE-2021-44266 | Medium | 6.1 | 2022-06-11 | GUnet Open eClass (aka openeclass) before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter. |
CVE-2021-41738 | High | 8.8 | 2022-06-11 | ZeroShell 3.9.5 has a command injection vulnerability in /cgi-bin/kerbynet IP parameter, which may allow an authenticated attacker to execute system commands. |
CVE-2021-41502 | Medium | 5.4 | 2022-06-11 | An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting (XSS) vulnerability that can execute malicious JavaScript code by modifyin… |
CVE-2021-41756 | Critical | 9.8 | 2022-06-10 | dynamicMarkt <= 3.10 is affected by SQL injection in the kat parameter of index.php. |
CVE-2021-41755 | Critical | 9.8 | 2022-06-10 | dynamicMarkt <= 3.10 is affected by SQL injection in the kat1 parameter of index.php. |
CVE-2021-41754 | Critical | 9.8 | 2022-06-10 | dynamicMarkt <= 3.10 is affected by SQL injection in the parent parameter of index.php. |
CVE-2021-44582 | High | 8.8 | 2022-06-10 | A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remote malicious user to gain elevated privi… |
CVE-2021-44117 | High | 8.8 | 2022-06-10 | A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4. |
CVE-2021-42811 | Low | 3.3 | 2022-06-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SafeNet KeySecure allows an authenticated user to read arbitrar… |
CVE-2021-27786 | Medium | 4.6 | 2022-06-09 | Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifie… |
CVE-2021-40961 | High | 8.8 | 2022-06-09 | CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby variable is concatenated with $query1, but it… |
CVE-2021-40668 | High | 8.1 | 2022-06-09 | The Android application HTTP File Server (Version 1.4.1) by 'slowscript' is affected by a path traversal vulnerability that permits arbitrary directory listing… |
CVE-2021-40610 | Medium | 5.4 | 2022-06-09 | Emlog Pro v 1.0.4 cross-site scripting (XSS) in Emlog Pro background management. |
CVE-2021-40592 | Medium | 5.5 | 2022-06-08 | GPAC version before commit 71460d72ec07df766dab0a4d52687529f3efcf0a (version v1.0.1 onwards) contains loop with unreachable exit condition ('infinite loop') vu… |
CVE-2021-40589 | Critical | 9.8 | 2022-06-08 | ZAngband zangband-data 2.7.5 is affected by an integer underflow vulnerability in src/tk/plat.c through the variable fileheader.bfOffBits. |
CVE-2021-36710 | High | 8.8 | 2022-06-08 | ToaruOS 1.99.2 is affected by incorrect access control via the kernel. Improper MMU management and having a low GDT address allows it to be mapped in userland… |
CVE-2021-35532 | Medium | 6.7 | 2022-06-07 | A vulnerability exists in the file upload validation part of Hitachi Energy TXpert Hub CoreTec 4 product. The vulnerability allows an attacker or malicious age… |
CVE-2021-35531 | Medium | 6.7 | 2022-06-07 | Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with acc… |
CVE-2021-35530 | Medium | 6.0 | 2022-06-07 | A vulnerability in the application authentication and authorization mechanism in Hitachi Energy's TXpert Hub CoreTec 4, that depends on a token validation of t… |
CVE-2021-37589 | High | 7.5 | 2022-06-07 | Virtua Cobranca before 12R allows SQL Injection on the login page. |
CVE-2021-39947 | Medium | 5.3 | 2022-06-06 | In specific circumstances, trace file buffers in GitLab Runner versions up to 14.3.4, 14.4 to 14.4.2, and 14.5 to 14.5.2 would re-use the file descriptor 0 for… |
CVE-2021-41932 | High | 8.8 | 2022-06-06 | A blind SQL injection vulnerability in search form in TeamMate+ Audit version 28.0.19.0 allows any authenticated user to create malicious SQL injections, which… |
CVE-2021-42245 | Medium | 6.1 | 2022-06-06 | FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections. |
CVE-2021-43271 | Medium | 6.8 | 2022-06-03 | Riverbed AppResponse 11.8.0, 11.8.5, 11.8.5a, 11.9.0, 11.9.0a, 11.10.0, 11.11.0, 11.11.0a, 11.11.1, 11.11.1a, 11.11.5, and 11.11.5a (when configured to use loc… |
CVE-2021-42893 | High | 7.5 | 2022-06-03 | In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, etc.) without authorization through getSysStatusCfg. |
CVE-2021-42892 | Medium | 4.3 | 2022-06-03 | In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can start telnet without authorization because the default username and password exists in the firmware. |
CVE-2021-42891 | High | 7.5 | 2022-06-03 | In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, etc.) without authorization. |
CVE-2021-42890 | Critical | 9.8 | 2022-06-03 | TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function NTPSyncWithHost of the file system.so which can control hostTime t… |
CVE-2021-42889 | High | 7.5 | 2022-06-03 | In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, wifiname, etc.) without authorization. |
CVE-2021-42888 | Critical | 9.8 | 2022-06-03 | TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setLanguageCfg of the file global.so which can control langType to… |
CVE-2021-42887 | Critical | 9.8 | 2022-06-03 | In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm. |
CVE-2021-42886 | High | 7.5 | 2022-06-03 | TOTOLINK EX1200T V4.1.2cu.5215 contains an information disclosure vulnerability where an attacker can get the apmib configuration file without authorization, a… |
CVE-2021-42885 | Critical | 9.8 | 2022-06-03 | TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceMac of the file global.so which can control deviceName to… |
CVE-2021-42884 | Critical | 9.8 | 2022-06-03 | TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceName of the file global.so which can control thedeviceNam… |
CVE-2021-42877 | High | 7.5 | 2022-06-02 | TOTOLINK EX1200T V4.1.2cu.5215 contains a denial of service vulnerability in function RebootSystem of the file lib/cste_modules/system which can reboot the sys… |
CVE-2021-33473 | Critical | 9.1 | 2022-06-02 | An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. Thi… |
CVE-2021-42875 | Critical | 9.8 | 2022-06-02 | TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste_modules/system.so to cont… |
CVE-2021-45983 | Critical | 9.8 | 2022-06-02 | NetScout nGeniusONE 6.3.2 allows Java RMI Code Execution. |
CVE-2021-45982 | High | 8.8 | 2022-06-02 | NetScout nGeniusONE 6.3.2 allows Arbitrary File Upload by a privileged user. |
CVE-2021-45981 | Critical | 9.8 | 2022-06-02 | NetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack. |
CVE-2021-38221 | Medium | 5.4 | 2022-06-02 | bbs-go <= 3.3.0 including Custom Edition is vulnerable to stored XSS. |
CVE-2021-44098 | Critical | 9.8 | 2022-06-02 | EGavilan Media Expense-Management-System 1.0 is vulnerable to SQL Injection via /expense_action.php. This allows a remote attacker to compromise Application SQ… |
CVE-2021-44097 | Critical | 9.8 | 2022-06-02 | EGavilan Media Contact-Form-With-Messages-Entry-Management 1.0 is vulnerable to SQL Injection via Addmessage.php. This allows a remote attacker to compromise A… |
CVE-2021-44096 | Critical | 9.8 | 2022-06-02 | EGavilan Media User-Registration-and-Login-System-With-Admin-Panel 1.0 is vulnerable to SQL Injection via profile_action - update_user. This allows a remote at… |
CVE-2021-44095 | Critical | 9.8 | 2022-06-02 | A SQL injection vulnerability exists in ProjectWorlds Hospital Management System in php 1.0 on login page that allows a remote attacker to compromise Applicati… |
CVE-2021-44080 | High | 7.2 | 2022-06-02 | A Command Injection vulnerability in httpd web server (setup.cgi) in SerComm h500s, FW: lowi-h500s-v3.4.22 allows logged in administrators to arbitrary OS comm… |
CVE-2021-43512 | Medium | 5.5 | 2022-06-02 | An issue was discovered in FlightRadar24 v8.9.0, v8.10.0, v8.10.2, v8.10.3, v8.10.4 for Android, allows attackers to cause unspecified consequences due to bein… |
CVE-2021-43308 | Medium | 5.9 | 2022-06-02 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arb… |
CVE-2021-43307 | Medium | 5.9 | 2022-06-02 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary inpu… |
CVE-2021-43306 | Medium | 5.9 | 2022-06-02 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary… |
CVE-2021-42872 | Critical | 9.8 | 2022-06-02 | TOTOLINK EX1200T V4.1.2cu.5215 is affected by a command injection vulnerability that can remotely execute arbitrary code. |
CVE-2021-42204 | High | 7.8 | 2022-06-02 | An issue was discovered in swftools through 20201222. A heap-buffer-overflow exists in the function swf_GetBits() located in rfxswf.c. It allows an attacker to… |
CVE-2021-42203 | High | 7.8 | 2022-06-02 | An issue was discovered in swftools through 20201222. A heap-use-after-free exists in the function swf_FontExtract_DefineTextCallback() located in swftext.c. I… |
CVE-2021-42202 | Medium | 5.5 | 2022-06-02 | An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function swf_DeleteFilter() located in swffilter.c. It allows an… |
CVE-2021-42201 | High | 7.8 | 2022-06-02 | An issue was discovered in swftools through 20201222. A heap-buffer-overflow exists in the function swf_GetD64() located in rfxswf.c. It allows an attacker to… |
CVE-2021-42200 | Medium | 5.5 | 2022-06-02 | An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function main() located in swfdump.c. It allows an attacker to c… |
CVE-2021-42199 | High | 7.8 | 2022-06-02 | An issue was discovered in swftools through 20201222. A heap buffer overflow exists in the function swf_FontExtract_DefineTextCallback() located in swftext.c… |
CVE-2021-42198 | Medium | 5.5 | 2022-06-02 | An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function swf_GetBits() located in rfxswf.c. It allows an attacke… |
CVE-2021-42197 | High | 7.8 | 2022-06-02 | An issue was discovered in swftools through 20201222 through a memory leak in the swftools when swfdump is used. It allows an attacker to cause code execution. |