2021 CVEs (page 31)
Page 31 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-42643 | High | 8.8 | 2022-05-17 | cmseasy V7.7.5_20211012 is affected by an arbitrary file write vulnerability. Through this vulnerability, a PHP script file is written to the website server, a… |
CVE-2021-42943 | Medium | 5.4 | 2022-05-17 | Stored cross-site scripting (XSS) in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or HTML via the userid par… |
CVE-2021-33025 | Medium | 5.6 | 2022-05-16 | xArrow SCADA versions 7.2 and prior permits unvalidated registry keys to be run with application-level privileges. |
CVE-2021-33021 | Medium | 6.1 | 2022-05-16 | xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘edate’ of the resource xhisalarm.htm, which may allow an unauthoriz… |
CVE-2021-33001 | Medium | 6.1 | 2022-05-16 | xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘bdate’ of the resource xhisvalue.htm, which may allow an unauthoriz… |
CVE-2021-27446 | Critical | 10.0 | 2022-05-16 | The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on th… |
CVE-2021-27444 | Critical | 9.8 | 2022-05-16 | The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sen… |
CVE-2021-27442 | Critical | 9.4 | 2022-05-16 | The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious Ja… |
CVE-2021-23267 | High | 7.6 | 2022-05-16 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi… |
CVE-2021-23266 | Medium | 4.3 | 2022-05-16 | An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator. |
CVE-2021-23265 | Low | 3.5 | 2022-05-16 | A logged-in and authenticated user with a Reviewer Role may lock a content item. |
CVE-2021-33318 | Critical | 9.8 | 2022-05-16 | An Input Validation Vulnerability exists in Joel Christner .NET C# packages WatsonWebserver, IpMatcher 1.0.4.1 and below (IpMatcher) and 4.1.3 and below (Watso… |
CVE-2021-25119 | High | 7.2 | 2022-05-16 | The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high p… |
CVE-2021-42897 | Critical | 9.8 | 2022-05-16 | A remote command execution (RCE) vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $_POST[r_name] is directly passed into the $my… |
CVE-2021-42870 | High | 7.5 | 2022-05-16 | ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request. |
CVE-2021-41965 | High | 8.8 | 2022-05-15 | A SQL injection vulnerability exists in ChurchCRM version 2.0.0 to 4.4.5 that allows an authenticated attacker to issue an arbitrary SQL command to the databas… |
CVE-2021-33013 | High | 8.2 | 2022-05-13 | mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive system information. |
CVE-2021-33009 | High | 7.5 | 2022-05-13 | mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to the file system. |
CVE-2021-33005 | High | 7.5 | 2022-05-13 | mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to arbitrary directories. |
CVE-2021-27505 | High | 7.5 | 2022-05-13 | mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive directory listing information. |
CVE-2021-46789 | High | 7.5 | 2022-05-13 | Configuration defects in the secure OS module. Successful exploitation of this vulnerability can affect availability. |
CVE-2021-46788 | High | 7.5 | 2022-05-13 | Third-party pop-up window coverage vulnerability in the iConnect module.Successful exploitation of this vulnerability may cause system pop-up window may be cov… |
CVE-2021-46787 | High | 7.5 | 2022-05-13 | The AMS module has a vulnerability of improper permission control.Successful exploitation of this vulnerability may cause non-system application processes to c… |
CVE-2021-46786 | Critical | 9.8 | 2022-05-13 | The audio module has a vulnerability in verifying the parameters passed by the application space.Successful exploitation of this vulnerability may cause out-of… |
CVE-2021-46785 | Medium | 5.3 | 2022-05-13 | The Property module has a vulnerability in permission control.This vulnerability can be exploited to obtain the unique device identifier. |
CVE-2021-22275 | High | 8.6 | 2022-05-13 | Buffer Overflow vulnerability in B&R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and… |
CVE-2021-42969 | High | 8.8 | 2022-05-13 | Certain Anaconda3 2021.05 are affected by OS command injection. When a user installs Anaconda, an attacker can create a new file and write something in usercus… |
CVE-2021-42967 | Critical | 9.8 | 2022-05-13 | Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows allows an attacker t… |
CVE-2021-27777 | High | 7.5 | 2022-05-12 | XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attacke… |
CVE-2021-27773 | Medium | 4.2 | 2022-05-12 | This vulnerability allows users to execute a clickjacking attack in the meeting's chat. |
CVE-2021-27772 | High | 7.1 | 2022-05-12 | Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations… |
CVE-2021-27771 | High | 8.2 | 2022-05-12 | User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with… |
CVE-2021-27770 | Medium | 6.8 | 2022-05-12 | The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this s… |
CVE-2021-27769 | Medium | 5.3 | 2022-05-12 | Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may or may not be sens… |
CVE-2021-27768 | Medium | 6.3 | 2022-05-12 | Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be i… |
CVE-2021-27500 | High | 7.5 | 2022-05-12 | A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may result in a denial-of-serv… |
CVE-2021-27498 | High | 7.5 | 2022-05-12 | A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may result in a denial-of-serv… |
CVE-2021-27482 | High | 7.5 | 2022-05-12 | A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may allow the attacker to read… |
CVE-2021-27478 | High | 8.2 | 2022-05-12 | A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may cause a denial-of-service… |
CVE-2021-26386 | High | 7.8 | 2022-05-12 | A malicious or compromised UApp or ABL may be used by an attacker to issue a malformed system call to the Stage 2 Bootloader potentially leading to corrupt mem… |
CVE-2021-26368 | Medium | 4.4 | 2022-05-12 | Insufficient check of the process type in Trusted OS (TOS) may allow an attacker with privileges to enable a lesser privileged process to unmap memory owned by… |
CVE-2021-26363 | Medium | 4.4 | 2022-05-12 | A malicious or compromised UApp or ABL could potentially change the value that the ASP uses for its reserved DRAM, to one outside of the fenced area, potential… |
CVE-2021-26317 | High | 7.8 | 2022-05-12 | Failure to verify the protocol in SMM may allow an attacker to control the protocol and modify SPI flash resulting in a potential arbitrary code execution. |
CVE-2021-22531 | Medium | 6.1 | 2022-05-12 | A bug exist in the input parameter of Access Manager that allows supply of invalid character to trigger cross-site scripting vulnerability. This affects NetIQ… |
CVE-2021-26369 | High | 7.8 | 2022-05-12 | A malicious or compromised UApp or ABL may be used by an attacker to send a malformed system call to the bootloader, resulting in out-of-bounds memory accesses. |
CVE-2021-26366 | High | 7.1 | 2022-05-12 | An attacker, who gained elevated privileges via some other vulnerability, may be able to read data from Boot ROM resulting in a loss of system integrity. |
CVE-2021-26362 | High | 7.1 | 2022-05-12 | A malicious or compromised UApp or ABL may be used by an attacker to issue a malformed system call which results in mapping sensitive System Management Network… |
CVE-2021-26361 | Medium | 5.5 | 2022-05-12 | A malicious or compromised User Application (UApp) or AGESA Boot Loader (ABL) could be used by an attacker to exfiltrate arbitrary memory from the ASP stage 2… |
CVE-2021-26351 | Medium | 5.5 | 2022-05-12 | Insufficient DRAM address validation in System Management Unit (SMU) may result in a DMA (Direct Memory Access) read/write from/to invalid DRAM address that co… |
CVE-2021-40399 | High | 7.8 | 2022-05-12 | An exploitable use-after-free vulnerability exists in WPS Spreadsheets ( ET ) as part of WPS Office, version 11.2.0.10351. A specially-crafted XLS file can cau… |
CVE-2021-33149 | Medium | 5.5 | 2022-05-12 | Observable behavioral discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. |
CVE-2021-33135 | Medium | 5.5 | 2022-05-12 | Uncontrolled resource consumption in the Linux kernel drivers for Intel(R) SGX may allow an authenticated user to potentially enable denial of service via loca… |
CVE-2021-33130 | Medium | 4.6 | 2022-05-12 | Insecure default variable initialization of Intel(R) RealSense(TM) ID Solution F450 before version 2.6.0.74 may allow an unauthenticated user to potentially en… |
CVE-2021-33124 | Medium | 6.7 | 2022-05-12 | Out-of-bounds write in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privile… |
CVE-2021-33123 | High | 7.8 | 2022-05-12 | Improper access control in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of pri… |
CVE-2021-33122 | High | 7.8 | 2022-05-12 | Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privile… |
CVE-2021-33117 | Medium | 5.5 | 2022-05-12 | Improper access control for some 3rd Generation Intel(R) Xeon(R) Scalable Processors before BIOS version MR7, may allow a local attacker to potentially enable… |
CVE-2021-33108 | Medium | 6.7 | 2022-05-12 | Improper input validation in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enable escalation of… |
CVE-2021-33103 | Medium | 6.7 | 2022-05-12 | Unintended intermediary in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of pri… |
CVE-2021-33083 | Medium | 4.4 | 2022-05-12 | Improper authentication in firmware for some Intel(R) SSD, Intel(R) Optane(TM) SSD, Intel(R) Optane(TM) SSD DC and Intel(R) SSD DC Products may allow an privil… |
CVE-2021-33082 | Medium | 4.6 | 2022-05-12 | Sensitive information in resource not removed before reuse in firmware for some Intel(R) SSD and Intel(R) Optane(TM) SSD Products may allow an unauthenticated… |
CVE-2021-33080 | Medium | 6.8 | 2022-05-12 | Exposure of sensitive system information due to uncleared debug information in firmware for some Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(T… |
CVE-2021-33078 | Medium | 4.7 | 2022-05-12 | Race condition within a thread in firmware for some Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products may allow a privileged user to potentially enable deni… |
CVE-2021-33077 | Medium | 6.8 | 2022-05-12 | Insufficient control flow management in firmware for some Intel(R) SSD, Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products may allow an unauthenticated user… |
CVE-2021-33075 | Medium | 4.7 | 2022-05-12 | Race condition in firmware for some Intel(R) Optane(TM) SSD, Intel(R) Optane(TM) SSD DC and Intel(R) SSD DC Products may allow a privileged user to potentially… |
CVE-2021-33074 | Medium | 4.6 | 2022-05-12 | Protection mechanism failure in firmware for some Intel(R) SSD, Intel(R) SSD DC and Intel(R) Optane(TM) SSD Products may allow an unauthenticated user to poten… |
CVE-2021-33069 | Medium | 5.5 | 2022-05-12 | Improper resource shutdown or release in firmware for some Intel(R) SSD, Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SSD DC may allow a pr… |
CVE-2021-26258 | High | 7.8 | 2022-05-12 | Improper access control for the Intel(R) Killer(TM) Control Center software before version 2.4.3337.0 may allow an authorized user to potentially enable escala… |
CVE-2021-0194 | High | 7.2 | 2022-05-12 | Improper access control in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enable escalation of pr… |
CVE-2021-0193 | High | 7.2 | 2022-05-12 | Improper authentication in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enable escalation of pr… |
CVE-2021-0190 | High | 7.8 | 2022-05-12 | Uncaught exception in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local acces… |
CVE-2021-0189 | High | 7.8 | 2022-05-12 | Use of out-of-range pointer offset in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege… |
CVE-2021-0188 | High | 7.8 | 2022-05-12 | Return of pointer value outside of expected range in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalati… |
CVE-2021-0159 | High | 7.8 | 2022-05-12 | Improper input validation in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of p… |
CVE-2021-0155 | Medium | 5.5 | 2022-05-12 | Unchecked return value in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local acc… |
CVE-2021-0154 | High | 7.8 | 2022-05-12 | Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via loca… |
CVE-2021-0153 | High | 7.8 | 2022-05-12 | Out-of-bounds write in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local acce… |
CVE-2021-0126 | High | 8.0 | 2022-05-12 | Improper input validation for the Intel(R) Manageability Commander before version 2.2 may allow an authenticated user to potentially enable escalation of privi… |
CVE-2021-42863 | Critical | 9.8 | 2022-05-12 | A buffer overflow in ecma_builtin_typedarray_prototype_filter() in JerryScript version fe3a5c0 allows an attacker to construct a fake object or a fake arraybuf… |
CVE-2021-42648 | Medium | 6.1 | 2022-05-11 | Cross-site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted URL. |
CVE-2021-42646 | Critical | 9.1 | 2022-05-11 | XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.0, 3.1.0… |
CVE-2021-36614 | Medium | 6.5 | 2022-05-11 | Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the tr069-client process. An authenticated remote attacker can cause a… |
CVE-2021-36613 | Medium | 6.5 | 2022-05-11 | Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the ptp process. An authenticated remote attacker can cause a Denial o… |
CVE-2021-34085 | Critical | 9.8 | 2022-05-11 | Read access violation in the III_dequantize_sample function in mpglibDBL/layer3.c in mp3gain through 1.5.2-r2 allows remote attackers to cause a denial of serv… |
CVE-2021-33317 | High | 7.5 | 2022-05-11 | The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from a null pointer dereference vulnerability. This vulnerability exists in its lldp… |
CVE-2021-33316 | Critical | 9.8 | 2022-05-11 | The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from an integer underflow vulnerability. This vulnerability exists in its lldp relat… |
CVE-2021-33315 | Critical | 9.8 | 2022-05-11 | The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from an integer underflow vulnerability. This vulnerability exists in its lldp relat… |
CVE-2021-31330 | Medium | 5.4 | 2022-05-11 | A Cross-Site Scripting (XSS) vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. An authenticated attacker may inject malicious J… |
CVE-2021-28290 | Medium | 6.1 | 2022-05-11 | A cross-site scripting (XSS) vulnerability in Skoruba IdentityServer4.Admin before 2.0.0 via unencoded value passed to the data-secret-value parameter. |
CVE-2021-46744 | Medium | 6.5 | 2022-05-11 | An attacker with access to a malicious hypervisor may be able to infer data values used in a SEV guest on AMD CPUs by monitoring ciphertext values over time. |
CVE-2021-30361 | Medium | 6.7 | 2022-05-11 | The Check Point Gaia Portal's GUI Clients allowed authenticated administrators with permission for the GUI Clients settings to inject a command that would run… |
CVE-2021-26400 | Medium | 4.0 | 2022-05-11 | AMD processors may speculatively re-order load instructions which can result in stale data being observed when multiple processors are operating on shared memo… |
CVE-2021-26388 | Medium | 5.5 | 2022-05-11 | Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memory contents, result… |
CVE-2021-26378 | Medium | 5.5 | 2022-05-11 | Insufficient bound checks in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service. |
CVE-2021-26376 | Medium | 5.5 | 2022-05-11 | Insufficient checks in System Management Unit (SMU) FeatureConfig may result in reenabling features potentially resulting in denial of resources and/or denial… |
CVE-2021-26375 | Medium | 5.5 | 2022-05-11 | Insufficient General Purpose IO (GPIO) bounds check in System Management Unit (SMU) may result in access/updates from/to invalid address space that could resul… |
CVE-2021-26373 | Medium | 5.5 | 2022-05-11 | Insufficient bound checks in the System Management Unit (SMU) may result in a system voltage malfunction that could result in denial of resources and/or possib… |
CVE-2021-26372 | Medium | 5.5 | 2022-05-11 | Insufficient bound checks related to PCIE in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of s… |
CVE-2021-26364 | Medium | 5.5 | 2022-05-11 | Insufficient bounds checking in an SMU mailbox register could allow an attacker to potentially read outside of the SRAM address range which could result in an… |
CVE-2021-26350 | Medium | 4.7 | 2022-05-11 | A TOCTOU race condition in SMU may allow for the caller to obtain and manipulate the address of a message port register which may result in a potential denial… |