2021 CVEs (page 32)
Page 32 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-26349 | Medium | 5.5 | 2022-05-11 | Failure to assign a new report ID to an imported guest may potentially result in an SEV-SNP guest VM being tricked into trusting a dishonest Migration Agent (M… |
CVE-2021-26348 | Medium | 5.5 | 2022-05-11 | Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be abl… |
CVE-2021-26347 | Medium | 4.7 | 2022-05-11 | Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory tab… |
CVE-2021-26342 | Low | 3.3 | 2022-05-11 | In SEV guest VMs, the CPU may fail to flush the Translation Lookaside Buffer (TLB) following a particular sequence of operations that includes creation of a ne… |
CVE-2021-26339 | Medium | 5.5 | 2022-05-11 | A bug in AMD CPU’s core logic may allow for an attacker, using specific code from an unprivileged VM, to trigger a CPU core hang resulting in a potential denia… |
CVE-2021-43066 | High | 8.4 | 2022-05-11 | A external control of file name or path in Fortinet FortiClientWindows version 7.0.2 and below, version 6.4.6 and below, version 6.2.9 and below, version 6.0.1… |
CVE-2021-3611 | Medium | 6.5 | 2022-05-11 | A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on t… |
CVE-2021-39059 | Medium | 5.4 | 2022-05-11 | IBM Jazz Foundation (IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2) is vulnerable to cross-site scripting. This vulnerability allows users to embe… |
CVE-2021-38969 | Critical | 9.8 | 2022-05-11 | IBM Spectrum Virtualize 8.2, 8.3, and 8.4 could allow an attacker to allow unauthorized access due to the reuse of support generated credentials. IBM X-Force I… |
CVE-2021-44167 | Medium | 6.8 | 2022-05-11 | An incorrect permission assignment for critical resource vulnerability [CWE-732] in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and b… |
CVE-2021-43081 | Medium | 6.1 | 2022-05-11 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.0.3 and below, 6.4.8 and below, 6.2.10 and below, 6… |
CVE-2021-42651 | High | 8.8 | 2022-05-11 | A Server Side Template Injection (SSTI) vulnerability in Pentest-Collaboration-Framework v1.0.8 allows an authenticated remote attacker to execute arbitrary co… |
CVE-2021-37851 | High | 7.3 | 2022-05-11 | Local privilege escalation in Windows products of ESET allows user who is logged into the system to exploit repair feature of the installer to run malicious co… |
CVE-2021-34606 | High | 7.3 | 2022-05-11 | A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that can allow an authenticated, local attacker to load a malicious DLL… |
CVE-2021-34605 | High | 7.3 | 2022-05-11 | A zip slip vulnerability in XINJE XD/E Series PLC Program Tool up to version v3.5.1 can provide an attacker with arbitrary file write privilege when opening a… |
CVE-2021-3254 | High | 7.5 | 2022-05-11 | Asus DSL-N14U-B1 1.1.2.3_805 allows remote attackers to cause a Denial of Service (DoS) via a TCP SYN scan using nmap. |
CVE-2021-39738 | High | 7.8 | 2022-05-10 | In CarSetings, there is a possible to pair BT device bypassing user's consent due to a missing permission check. This could lead to local escalation of privile… |
CVE-2021-39700 | Medium | 5.5 | 2022-05-10 | In the policies of adbd.te, there was a logic error which caused the CTS Listening Ports Test to report invalid results. This could lead to local information d… |
CVE-2021-39670 | Medium | 5.5 | 2022-05-10 | In setStream of WallpaperManager.java, there is a possible way to cause a permanent DoS due to improper input validation. This could lead to local denial of se… |
CVE-2021-46771 | High | 7.8 | 2022-05-10 | Insufficient validation of addresses in AMD Secure Processor (ASP) firmware system call may potentially lead to arbitrary code execution by a compromised user… |
CVE-2021-43010 | High | 7.5 | 2022-05-10 | In Safedog Apache v4.0.30255, attackers can bypass this product for SQL injection. Attackers can bypass access to sensitive data. |
CVE-2021-26408 | High | 7.1 | 2022-05-10 | Insufficient validation of elliptic curve points in SEV-legacy firmware may compromise SEV-legacy guest migration potentially resulting in loss of guest's inte… |
CVE-2021-26390 | Medium | 6.2 | 2022-05-10 | A malicious or compromised UApp or ABL may coerce the bootloader into corrupting arbitrary memory potentially leading to loss of integrity of data. |
CVE-2021-26370 | High | 7.1 | 2022-05-10 | Improper validation of destination address in SVC_LOAD_FW_IMAGE_BY_INSTANCE and SVC_LOAD_BINARY_BY_ATTRIB in a malicious UApp or ABL may allow an attacker to o… |
CVE-2021-26353 | High | 7.8 | 2022-05-10 | Failure to validate inputs in SMM may allow an attacker to create a mishandled error leaving the DRTM UApp in a partially initialized state potentially resulti… |
CVE-2021-26352 | Medium | 5.5 | 2022-05-10 | Insufficient bound checks in System Management Unit (SMU) PCIe Hot Plug table may result in access/updates from/to invalid address space that could result in d… |
CVE-2021-26332 | High | 7.1 | 2022-05-10 | Failure to verify SEV-ES TMR is not in MMIO space, SEV-ES FW could result in a potential loss of integrity or availability. |
CVE-2021-26324 | High | 7.8 | 2022-05-10 | A bug with the SEV-ES TMR may lead to a potential loss of memory integrity for SNP-active VMs. |
CVE-2021-39024 | Medium | 6.1 | 2022-05-10 | IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript cod… |
CVE-2021-43094 | Critical | 9.8 | 2022-05-10 | An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requests on ar… |
CVE-2021-42645 | Critical | 10.0 | 2022-05-10 | CMSimple_XH 1.7.4 is affected by a remote code execution (RCE) vulnerability. To exploit this vulnerability, an attacker must use the "File" parameter to uploa… |
CVE-2021-42581 | Critical | 9.1 | 2022-05-10 | Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying… |
CVE-2021-41545 | High | 7.5 | 2022-05-10 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2021-43712 | Medium | 5.4 | 2022-05-09 | Stored XSS in Add New Employee Form in Sourcecodester Employee Daily Task Management System 1.0 Allows Remote Attacker to Inject/Store Arbitrary Code via the N… |
CVE-2021-20479 | High | 7.5 | 2022-05-09 | IBM Cloud Pak System 2.3.0 through 2.3.3.3 Interim Fix 1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sens… |
CVE-2021-23792 | High | 7.3 | 2022-05-06 | The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML… |
CVE-2021-23592 | High | 7.7 | 2022-05-06 | The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class. |
CVE-2021-27767 | Medium | 6.7 | 2022-05-06 | The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a pr… |
CVE-2021-27766 | Medium | 6.7 | 2022-05-06 | The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a pri… |
CVE-2021-27765 | Medium | 6.7 | 2022-05-06 | The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a… |
CVE-2021-27764 | High | 7.4 | 2022-05-06 | Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI) |
CVE-2021-27762 | Medium | 4.7 | 2022-05-06 | Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses |
CVE-2021-27761 | Medium | 4.8 | 2022-05-06 | Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks |
CVE-2021-27760 | Medium | 4.6 | 2022-05-06 | An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execut… |
CVE-2021-27759 | Low | 2.3 | 2022-05-06 | This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. A… |
CVE-2021-27758 | Medium | 4.3 | 2022-05-06 | There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system bloc… |
CVE-2021-27751 | Medium | 4.4 | 2022-05-06 | HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are st… |
CVE-2021-42743 | High | 8.8 | 2022-05-06 | A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk Enterprise versions… |
CVE-2021-36912 | Medium | 5.4 | 2022-05-06 | Stored Cross-Site Scripting (XSS) vulnerability in Andrea Pernici News Sitemap for Google plugin <= 1.0.16 on WordPress, attackers must have contributor or hig… |
CVE-2021-33845 | Medium | 5.3 | 2022-05-06 | The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances b… |
CVE-2021-31559 | High | 7.5 | 2022-05-06 | A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 ver… |
CVE-2021-26253 | High | 8.1 | 2022-05-06 | A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6… |
CVE-2021-39027 | Medium | 5.0 | 2022-05-06 | IBM Guardium Data Encryption (GDE) 4.0.0 and 5.0.0 prepares a structured message for communication with another component, but encoding or escaping of the data… |
CVE-2021-39023 | High | 7.5 | 2022-05-06 | IBM Guardium Data Encryption (GDE) 4.0.0 and 5.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is ret… |
CVE-2021-25746 | High | 7.6 | 2022-05-06 | A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in… |
CVE-2021-25745 | High | 7.6 | 2022-05-06 | A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an… |
CVE-2021-25268 | High | 8.4 | 2022-05-05 | Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA. |
CVE-2021-25267 | Medium | 6.8 | 2022-05-05 | Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA. |
CVE-2021-44057 | High | 7.1 | 2022-05-05 | An improper authentication vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows attackers to co… |
CVE-2021-44056 | High | 7.1 | 2022-05-05 | An improper authentication vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows attackers to co… |
CVE-2021-44055 | Medium | 5.3 | 2022-05-05 | An missing authorization vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows remote attackers… |
CVE-2021-44054 | Medium | 4.3 | 2022-05-05 | An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows attackers… |
CVE-2021-44053 | Medium | 5.7 | 2022-05-05 | A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allow… |
CVE-2021-44052 | Medium | 6.5 | 2022-05-05 | An improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS… |
CVE-2021-44051 | High | 8.8 | 2022-05-05 | A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote att… |
CVE-2021-43547 | High | 7.5 | 2022-05-05 | TwinOaks Computing CoreDX DDS versions prior to 5.9.1 are susceptible to exploitation when an attacker sends a specially crafted packet to flood target devices… |
CVE-2021-38693 | Medium | 5.3 | 2022-05-05 | A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance. If exploited, this vulnerability a… |
CVE-2021-38487 | High | 8.2 | 2022-05-05 | RTI Connext Professional versions 4.1 to 6.1.0, and Connext Micro versions 2.4 and later are vulnerable when an attacker sends a specially crafted packet to fl… |
CVE-2021-38447 | High | 8.6 | 2022-05-05 | OCI OpenDDS versions prior to 3.18.1 are vulnerable when an attacker sends a specially crafted packet to flood target devices with unwanted traffic, which may… |
CVE-2021-38445 | High | 7.0 | 2022-05-05 | OCI OpenDDS versions prior to 3.18.1 do not handle a length parameter consistent with the actual length of the associated data, which may allow an attacker to… |
CVE-2021-38443 | Medium | 6.6 | 2022-05-05 | Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in the XML parser. |
CVE-2021-38441 | Medium | 6.6 | 2022-05-05 | Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary values in the XML par… |
CVE-2021-38439 | High | 8.6 | 2022-05-05 | All versions of GurumDDS are vulnerable to heap-based buffer overflow, which may cause a denial-of-service condition or remotely execute arbitrary code. |
CVE-2021-38435 | Medium | 6.6 | 2022-05-05 | RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 not correctly calculate the size when allocating the buffer, which may result in a b… |
CVE-2021-38433 | Medium | 6.6 | 2022-05-05 | RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 vulnerable to a stack-based buffer overflow, which may allow a local attacker to exe… |
CVE-2021-38429 | Medium | 6.6 | 2022-05-05 | OCI OpenDDS versions prior to 3.18.1 are vulnerable when an attacker sends a specially crafted packet to flood target devices with unwanted traffic, which may… |
CVE-2021-38427 | Medium | 6.6 | 2022-05-05 | RTI Connext DDS Professional and Connext DDS Secure Versions 4.2.x to 6.1.0 are vulnerable to a stack-based buffer overflow, which may allow a local attacker t… |
CVE-2021-38425 | High | 7.5 | 2022-05-05 | eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an attacker sends a specially crafted packet to flood a target device wi… |
CVE-2021-38423 | Medium | 6.6 | 2022-05-05 | All versions of GurumDDS improperly calculate the size to be used when allocating the buffer, which may result in a buffer overflow. |
CVE-2021-39020 | Medium | 5.3 | 2022-05-05 | IBM Guardium Data Encryption (GDE) 4.0.0.7 and lower stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized pa… |
CVE-2021-42183 | High | 7.5 | 2022-05-05 | MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/. |
CVE-2021-42242 | Critical | 9.8 | 2022-05-05 | A command execution vulnerability exists in jfinal_cms 5.0.1 via com.jflyfox.component.controller.Ueditor. |
CVE-2021-45783 | Medium | 4.6 | 2022-05-05 | Bookeen Notea Firmware BK_R_1.0.5_20210608 is affected by a directory traversal vulnerability that allows an attacker to obtain sensitive information. |
CVE-2021-41739 | Critical | 9.8 | 2022-05-05 | A OS Command Injection vulnerability was discovered in Artica Proxy 4.30.000000. Attackers can execute OS commands in cyrus.events.php with GET param logs and… |
CVE-2021-42235 | Critical | 9.8 | 2022-05-04 | SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionalit… |
CVE-2021-43206 | Medium | 4.3 | 2022-05-04 | A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x and FortiProxy 7.0… |
CVE-2021-41032 | Medium | 6.3 | 2022-05-04 | An improper access control vulnerability [CWE-284] in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attacker with a restricte… |
CVE-2021-41020 | High | 8.8 | 2022-05-04 | An improper access control vulnerability [CWE-284] in FortiIsolator versions 2.3.2 and below may allow an authenticated, non privileged attacker to regenerate… |
CVE-2021-20051 | High | 7.8 | 2022-05-04 | SonicWall Global VPN Client 4.10.7.1117 installer (32-bit and 64-bit) and earlier versions have a DLL Search Order Hijacking vulnerability in one of the instal… |
CVE-2021-32010 | Medium | 5.6 | 2022-05-04 | Inadequate Encryption Strength vulnerability in TLS stack of Secomea SiteManager, LinkManager, GateManager may facilitate man in the middle attacks. This issue… |
CVE-2021-42185 | Critical | 9.8 | 2022-05-04 | wdja v2.1 is affected by a SQL injection vulnerability in the foreground search function. |
CVE-2021-42192 | High | 8.8 | 2022-05-04 | Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation. |
CVE-2021-43164 | High | 8.8 | 2022-05-04 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the updateVersi… |
CVE-2021-43163 | Critical | 9.8 | 2022-05-04 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the checkNet fu… |
CVE-2021-43162 | High | 8.8 | 2022-05-04 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the runPackDiag… |
CVE-2021-43161 | High | 8.8 | 2022-05-04 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the doSwitchApi… |
CVE-2021-43160 | High | 8.8 | 2022-05-04 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the switchFastD… |
CVE-2021-43159 | High | 8.8 | 2022-05-04 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the setSessionT… |
CVE-2021-27439 | High | 7.3 | 2022-05-03 | TencentOS-tiny version 3.1.0 is vulnerable to integer wrap-around in function 'tos_mmheap_alloc incorrect calculation of effective memory allocation size. This… |
CVE-2021-27435 | High | 7.3 | 2022-05-03 | ARM mbed product Version 6.3.0 is vulnerable to integer wrap-around in malloc_wrapper function, which can lead to arbitrary memory allocation, resulting in une… |