2021 CVEs (page 30)
Page 30 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-42196 | Medium | 5.5 | 2022-06-02 | An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function traits_parse() located in abc.c. It allows an attacker… |
CVE-2021-42195 | High | 7.8 | 2022-06-02 | An issue was discovered in swftools through 20201222. A heap-buffer-overflow exists in the function handleEditText() located in swfdump.c. It allows an attacke… |
CVE-2021-40186 | Medium | 6.5 | 2022-06-02 | The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, formerly known as DotNetNuke. SSRF vulner… |
CVE-2021-36890 | Medium | 4.3 | 2022-06-02 | Cross-Site Request Forgery (CSRF) vulnerability in Social Share Buttons by Supsystic plugin <= 2.2.2 at WordPress. |
CVE-2021-36866 | Medium | 4.8 | 2022-06-02 | Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Easy Pricing Tables plugin <= 3.1.2 at WordPress. |
CVE-2021-34084 | Critical | 9.8 | 2022-06-02 | OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commands via the metada… |
CVE-2021-34083 | High | 8.1 | 2022-06-02 | Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browse… |
CVE-2021-34082 | Critical | 9.8 | 2022-06-02 | OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allows attackers to ex… |
CVE-2021-34081 | High | 8.8 | 2022-06-02 | OS Command Injection vulnerability in bbultman gitsome through 0.2.3 allows attackers to execute arbitrary commands via a crafted tag name of the target git re… |
CVE-2021-34080 | Critical | 9.8 | 2022-06-02 | OS Command Injection vulnerability in es128 ssl-utils 1.0.0 for Node.js allows attackers to execute arbitrary commands via unsanitized shell metacharacters pro… |
CVE-2021-34079 | Critical | 9.8 | 2022-06-02 | OS Command injection vulnerability in Mintzo Docker-Tester through 1.2.1 allows attackers to execute arbitrary commands via shell metacharacters in the 'ports'… |
CVE-2021-34078 | High | 8.8 | 2022-06-02 | lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file. |
CVE-2021-33615 | High | 7.5 | 2022-06-02 | RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type. |
CVE-2021-33504 | Medium | 4.9 | 2022-06-02 | Couchbase Server before 7.1.0 has Incorrect Access Control. |
CVE-2021-33254 | High | 7.5 | 2022-06-02 | An issue was discovered in src/http/httpLib.c in EmbedThis Appweb Community Edition 8.2.1, allows attackers to cause a denial of service via the stream paramte… |
CVE-2021-32546 | High | 8.8 | 2022-06-02 | Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. An unprivileged attacker (registered… |
CVE-2021-26635 | High | 7.8 | 2022-06-02 | In the code that verifies the file size in the ark library, it is possible to manipulate the offset read from the target file due to the wrong use of the data… |
CVE-2021-26634 | Critical | 9.8 | 2022-06-02 | SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files compromising Maxboa… |
CVE-2021-26633 | High | 7.5 | 2022-06-02 | SQL injection and Local File Inclusion (LFI) vulnerabilities in MaxBoard can cause information leakage and privilege escalation. This vulnerabilities can be ex… |
CVE-2021-27914 | High | 7.6 | 2022-06-01 | A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript |
CVE-2021-27778 | Medium | 4.9 | 2022-06-01 | HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler admini… |
CVE-2021-3555 | High | 7.6 | 2022-05-31 | A Buffer Overflow vulnerability in the RSTP server component of Eufy Indoor 2K Indoor Camera allows a local attacker to achieve remote code execution. This iss… |
CVE-2021-27781 | Medium | 6.6 | 2022-05-27 | The Master operator may be able to embed script tag in HTML with alert pop-up display cookie. |
CVE-2021-27780 | Medium | 5.3 | 2022-05-27 | The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment. |
CVE-2021-28509 | Medium | 6.1 | 2022-05-26 | This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport proto… |
CVE-2021-28508 | Medium | 6.8 | 2022-05-26 | This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport proto… |
CVE-2021-4232 | Low | 3.5 | 2022-05-26 | A vulnerability classified as problematic has been found in Zoo Management System 1.0. Affected is an unknown function of the file admin/manage-ticket.php. The… |
CVE-2021-33016 | Critical | 9.8 | 2022-05-26 | An attacker can gain full access (read/write/delete) to sensitive folders due to hard-coded credentials on KUKA KR C4 control software for versions prior to 8… |
CVE-2021-33014 | High | 8.8 | 2022-05-26 | An attacker can gain VxWorks Shell after login due to hard-coded credentials on a KUKA KR C4 control software for versions prior to 8.7 or any product running… |
CVE-2021-4231 | Low | 3.5 | 2022-05-26 | A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation… |
CVE-2021-34360 | Medium | 5.3 | 2022-05-26 | A cross-site request forgery (CSRF) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote… |
CVE-2021-40317 | High | 8.8 | 2022-05-26 | Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter. |
CVE-2021-42860 | High | 7.5 | 2022-05-26 | A stack buffer overflow exists in Mini-XML v3.2. When inputting an unformed XML string to the mxmlLoadString API, it will cause a stack-buffer-overflow in mxml… |
CVE-2021-42859 | High | 7.5 | 2022-05-26 | A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service. NOTE: testing reports are inconsistent, with some testers seeing the… |
CVE-2021-42692 | Medium | 6.5 | 2022-05-26 | There is a stack-overflow vulnerability in tinytoml v0.4 that can cause a crash or DoS. |
CVE-2021-27783 | Medium | 6.8 | 2022-05-25 | User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed. |
CVE-2021-27779 | Critical | 9.1 | 2022-05-25 | VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server. |
CVE-2021-44719 | High | 8.4 | 2022-05-25 | Docker Desktop 4.3.0 has Incorrect Access Control. |
CVE-2021-35487 | Medium | 6.5 | 2022-05-25 | Nokia Broadcast Message Center through 11.1.0 allows an authenticated user to perform a Boolean Blind SQL Injection attack on the endpoint /owui/block/send-rec… |
CVE-2021-32997 | High | 8.2 | 2022-05-25 | The affected Baker Hughes Bentley Nevada products (3500 System 1 6.x, Part No. 3060/00 versions 6.98 and prior, 3500 System 1, Part No. 3071/xx & 3072/xx versi… |
CVE-2021-32989 | Critical | 9.3 | 2022-05-25 | When a non-existent resource is requested, the LCDS LAquis SCADA application (version 4.3.1.1011 and prior) returns error messages which may allow reflected cr… |
CVE-2021-32966 | Low | 3.7 | 2022-05-25 | Philips Interoperability Solution XDS versions 2.5 through 3.11 and 2018-1 through 2021-1 are vulnerable to clear text transmission of sensitive information wh… |
CVE-2021-44974 | Medium | 5.5 | 2022-05-25 | radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol parser. |
CVE-2021-42614 | High | 7.8 | 2022-05-24 | A use after free in info_width_internal in bk_info.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly have unspecified other impact… |
CVE-2021-42613 | High | 7.8 | 2022-05-24 | A double free in cleanup_index in index.c in Halibut 1.2 allows an attacker to cause a denial of service or possibly have other unspecified impact via a crafte… |
CVE-2021-42612 | High | 7.8 | 2022-05-24 | A use after free in cleanup_index in index.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly have other unspecified impact via a cr… |
CVE-2021-3717 | High | 7.8 | 2022-05-24 | A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all u… |
CVE-2021-3629 | Medium | 5.9 | 2022-05-24 | A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of serv… |
CVE-2021-3597 | Medium | 5.9 | 2022-05-24 | A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest thr… |
CVE-2021-32969 | High | 7.8 | 2022-05-24 | Delta Electronics DIAScreen versions prior to 1.1.0 are vulnerable to an out-of-bounds write condition, which may result in a system crash or allow an attacker… |
CVE-2021-32965 | High | 7.8 | 2022-05-24 | Delta Electronics DIAScreen versions prior to 1.1.0 are vulnerable to type confusion, which may allow an attacker to remotely execute arbitrary code. |
CVE-2021-32964 | Medium | 6.5 | 2022-05-24 | The AGG Software Web Server version 4.0.40.1014 and prior is vulnerable to a path traversal attack, which may allow an attacker to read arbitrary files from th… |
CVE-2021-32962 | High | 8.2 | 2022-05-24 | The AGG Software Web Server version 4.0.40.1014 and prior is vulnerable to cross-site scripting, which may allow an attacker to remotely execute arbitrary code. |
CVE-2021-4230 | Low | 3.7 | 2022-05-24 | A vulnerability has been found in Airfield Online and classified as problematic. This vulnerability affects the path /backups/ of the MySQL backup handler. An… |
CVE-2021-4229 | Medium | 5.0 | 2022-05-24 | A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a… |
CVE-2021-45915 | Critical | 9.8 | 2022-05-24 | In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a cookie value. This allows the attacker's session to be authenticated… |
CVE-2021-45914 | Critical | 9.8 | 2022-05-24 | In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request. This allows the attacker's session to be authenticated… |
CVE-2021-44975 | Medium | 5.5 | 2022-05-24 | radareorg radare2 5.5.2 is vulnerable to Buffer Overflow via /libr/core/anal_objc.c mach-o parser. |
CVE-2021-42656 | Medium | 5.4 | 2022-05-24 | SiteServer CMS V6.15.51 is affected by a Cross Site Scripting (XSS) vulnerability. |
CVE-2021-42655 | High | 8.8 | 2022-05-24 | SiteServer CMS V6.15.51 is affected by a SQL injection vulnerability. |
CVE-2021-42654 | Critical | 9.8 | 2022-05-24 | SiteServer CMS < V5.1 is affected by an unrestricted upload of a file with dangerous type (getshell), which could be used to execute arbitrary code. |
CVE-2021-42659 | Medium | 6.5 | 2022-05-24 | There is a buffer overflow vulnerability in the Web server httpd of the router in Tenda router devices such as Tenda AC9 V1.0 V15.03.02.19(6318) and Tenda AC9… |
CVE-2021-32958 | Medium | 5.5 | 2022-05-23 | Successful exploitation of this vulnerability on Claroty Secure Remote Access (SRA) Site versions 3.0 through 3.2 allows an attacker with local command line in… |
CVE-2021-42233 | Medium | 5.4 | 2022-05-23 | The Simple Blog plugin in Wondercms 3.4.1 is vulnerable to stored cross-site scripting (XSS) vulnerability. When any user opens a particular blog hosted on an… |
CVE-2021-32941 | Critical | 9.4 | 2022-05-23 | Annke N48PBB (Network Video Recorder) products of version 3.4.106 build 200422 and prior are vulnerable to a stack-based buffer overflow, which allows an unaut… |
CVE-2021-32935 | High | 8.8 | 2022-05-23 | The affected Cognex product, the In-Sight OPC Server versions v5.7.4 (96) and prior, deserializes untrusted data, which could allow a remote attacker access to… |
CVE-2021-41714 | High | 7.7 | 2022-05-23 | In Tipask < 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Ti… |
CVE-2021-42586 | High | 8.8 | 2022-05-23 | A heap buffer overflow was discovered in copy_bytes in decode_r2007.c in dwgread before 0.12.4 via a crafted dwg file. |
CVE-2021-42585 | High | 8.8 | 2022-05-23 | A heap buffer overflow was discovered in copy_compressed_bytes in decode_r2007.c in dwgread before 0.12.4 via a crafted dwg file. |
CVE-2021-41834 | Medium | 5.3 | 2022-05-23 | JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to r… |
CVE-2021-36833 | Medium | 4.8 | 2022-05-20 | Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ibericode's MC4WP plugin <= 4.8.6 at WordPress. |
CVE-2021-39043 | Medium | 5.4 | 2022-05-20 | IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary Jav… |
CVE-2021-43729 | Medium | 5.4 | 2022-05-20 | Pix-Link MiNi Router 28K.MiniRouter.20190211 was discovered to contain a stored cross-site scripting (XSS) vulnerability due to an unsanitized Security Key par… |
CVE-2021-43728 | Medium | 5.4 | 2022-05-20 | Pix-Link MiNi Router 28K.MiniRouter.20190211 was discovered to contain a stored cross-site scripting (XSS) vulnerability due to an unsanitized SSID parameter. |
CVE-2021-30028 | High | 7.2 | 2022-05-20 | SOOTEWAY Wi-Fi Range Extender v1.5 was discovered to use default credentials (the admin password for the admin account) to access the TELNET service, allowing… |
CVE-2021-34111 | Critical | 9.8 | 2022-05-20 | Thecus 4800Eco was discovered to contain a command injection vulnerability via the username parameter in /adm/setmain.php. |
CVE-2021-32934 | Critical | 9.1 | 2022-05-19 | The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, fir… |
CVE-2021-45730 | Medium | 6.0 | 2022-05-19 | JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Re… |
CVE-2021-37413 | Critical | 9.8 | 2022-05-19 | GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerability in the admin login interface. A remote unauthenticated attacker can exploit this vulnerabilit… |
CVE-2021-26631 | High | 8.0 | 2022-05-19 | Improper input validation vulnerability in Mangboard commerce package could lead to occur for abnormal request. A remote attacker can exploit this vulnerabilit… |
CVE-2021-26630 | High | 7.8 | 2022-05-19 | Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vulnerability can be… |
CVE-2021-41938 | High | 7.2 | 2022-05-19 | An issue was discovered in ShopXO CMS 2.2.0. After entering the management page, there is an arbitrary file upload vulnerability in three locations. |
CVE-2021-38944 | Medium | 6.1 | 2022-05-18 | IBM DataPower Gateway 10.0.2.0 through 1.0.3.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 is vulnerable to HTTP header injection, caused by… |
CVE-2021-42704 | High | 7.8 | 2022-05-18 | Inkscape version 0.91 is vulnerable to an out-of-bounds write, which may allow an attacker to arbitrary execute code. |
CVE-2021-42702 | Low | 3.3 | 2022-05-18 | Inkscape version 0.91 can access an uninitialized pointer, which may allow an attacker to have access to unauthorized information. |
CVE-2021-42700 | Low | 3.3 | 2022-05-18 | Inkscape 0.91 is vulnerable to an out-of-bounds read, which may allow an attacker to have access to unauthorized information. |
CVE-2021-42852 | High | 8.0 | 2022-05-18 | A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execute operating system… |
CVE-2021-42851 | Medium | 6.3 | 2022-05-18 | A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard user account. |
CVE-2021-42850 | High | 8.8 | 2022-05-18 | A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unautho… |
CVE-2021-42849 | Medium | 6.8 | 2022-05-18 | A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attack… |
CVE-2021-42848 | Medium | 4.3 | 2022-05-18 | An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to retrieve device… |
CVE-2021-3969 | High | 7.8 | 2022-05-18 | A Time of Check Time of Use (TOCTOU) vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1… |
CVE-2021-3956 | Medium | 4.3 | 2022-05-18 | A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware affecting XCC devic… |
CVE-2021-3922 | High | 7.8 | 2022-05-18 | A race condition vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.1.20.3 that could a… |
CVE-2021-27548 | Medium | 5.5 | 2022-05-18 | There is a Null Pointer Dereference vulnerability in the XFAScanner::scanNode() function in XFAScanner.cc in xpdf 4.03. |
CVE-2021-41946 | Medium | 5.4 | 2022-05-18 | In FiberHome VDSL2 Modem HG150-Ub_V3.0, a stored cross-site scripting (XSS) vulnerability in Parental Control --> Access Time Restriction --> Username field, a… |
CVE-2021-35249 | Medium | 4.3 | 2022-05-17 | This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should no… |
CVE-2021-38872 | High | 7.5 | 2022-05-17 | IBM DataPower Gateway 10.0.2.0, 10.0.3.0, 10.0.1.0 through 10.0.1.4, and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a denial of service… |
CVE-2021-29726 | Medium | 5.3 | 2022-05-17 | IBM Sterling Secure Proxy 6.0.3 and IBM Secure External Authentication Server 6.0.3 does not properly ensure that a certificate is actually associated with the… |
CVE-2021-42644 | Medium | 6.5 | 2022-05-17 | cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability. After login, the configuration file information of the website such as the databas… |