2021 CVEs (page 34)
Page 34 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-36460 | High | 7.8 | 2022-04-25 | VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the ba… |
CVE-2021-45842 | High | 7.5 | 2022-04-25 | It is possible to obtain the first administrator's hash set up in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) on the system as well as other infor… |
CVE-2021-45841 | High | 8.1 | 2022-04-25 | In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's passw… |
CVE-2021-45840 | Critical | 9.8 | 2022-04-25 | It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending specifically crafted input to /tos/… |
CVE-2021-45839 | Medium | 6.5 | 2022-04-25 | It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) as well as other infor… |
CVE-2021-45837 | Critical | 9.8 | 2022-04-25 | It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending a specifically crafted input to /to… |
CVE-2021-45836 | High | 8.8 | 2022-04-25 | An authenticated attacker can execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by injecting a maliciously crafted… |
CVE-2021-40680 | High | 8.1 | 2022-04-25 | There is a Directory Traversal vulnerability in Artica Proxy (4.30.000000 SP206 through SP255, and VMware appliance 4.30.000000 through SP273) via the filename… |
CVE-2021-4212 | Medium | 6.7 | 2022-04-22 | A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local acce… |
CVE-2021-4211 | Medium | 6.7 | 2022-04-22 | A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow… |
CVE-2021-4210 | Medium | 6.7 | 2022-04-22 | A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker… |
CVE-2021-3972 | Medium | 6.7 | 2022-04-22 | A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly not deactivated may… |
CVE-2021-3971 | Medium | 6.7 | 2022-04-22 | A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BI… |
CVE-2021-3970 | Medium | 6.7 | 2022-04-22 | A potential vulnerability in LenovoVariable SMI Handler due to insufficient validation in some Lenovo Notebook models BIOS may allow an attacker with local acc… |
CVE-2021-3898 | Medium | 6.8 | 2022-04-22 | Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify the server certificate which could lead… |
CVE-2021-3897 | Critical | 9.8 | 2022-04-22 | An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SM… |
CVE-2021-3849 | Critical | 9.8 | 2022-04-22 | An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM)… |
CVE-2021-3722 | Medium | 5.0 | 2022-04-22 | A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow configuration files to be written to non-stand… |
CVE-2021-3721 | Medium | 5.5 | 2022-04-22 | A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.20.10282 that could allow an attacker with local access to trigger a bl… |
CVE-2021-38946 | Medium | 5.4 | 2022-04-22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in th… |
CVE-2021-38905 | Medium | 4.3 | 2022-04-22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pages that they should not have access to. IBM X-Force ID: 209… |
CVE-2021-38904 | Medium | 6.5 | 2022-04-22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings… |
CVE-2021-38903 | Medium | 5.4 | 2022-04-22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker… |
CVE-2021-38886 | High | 8.8 | 2022-04-22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized… |
CVE-2021-29824 | Medium | 4.3 | 2022-04-22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could have read access to to the 'Data Connecti… |
CVE-2021-20464 | Medium | 6.5 | 2022-04-22 | IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. I… |
CVE-2021-36203 | Medium | 5.3 | 2022-04-22 | The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request. |
CVE-2021-32929 | Medium | 4.3 | 2022-04-22 | All versions of Uffizio GPS Tracker may allow an attacker to perform unintended actions on behalf of a user. |
CVE-2021-32927 | High | 7.1 | 2022-04-22 | An attacker may be able to inject client-side JavaScript code on multiple instances within all versions of Uffizio GPS Tracker. |
CVE-2021-43708 | Medium | 5.5 | 2022-04-21 | The Labeling tool in Titus Classification Suite 18.8.1910.140 allows users to avoid the generation of a classification label by using Excel's safe mode. |
CVE-2021-35229 | Medium | 6.8 | 2022-04-21 | Cross-site scripting vulnerability is present in Database Performance Monitor 2022.1.7779 and previous versions when using a complex SQL query |
CVE-2021-23055 | Medium | 6.5 | 2022-04-21 | On version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls snippet use with NGINX Ingress Controller does not apply to Ingre… |
CVE-2021-41162 | Critical | 9.3 | 2022-04-21 | Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to beta6 the `ajax.render.php?operation=wizard_helper` page did not proper… |
CVE-2021-41161 | Critical | 9.3 | 2022-04-21 | Combodo iTop is a web based IT Service Management tool. In versions prior to 3.0.0-beta6 the export CSV page don't properly escape the user supplied parameters… |
CVE-2021-43481 | Critical | 9.8 | 2022-04-20 | An SQL Injection vulnerability exists in Webtareas 2.4p3 and earlier via the $uq HTTP POST parameter in editapprovalstage.php. |
CVE-2021-37740 | High | 7.5 | 2022-04-20 | A denial of service vulnerability exists in MDT's firmware for the KNXnet/IP Secure router SCN-IP100.03 and KNX IP interface SCN-IP000.03 before v3.0.4, that a… |
CVE-2021-43990 | Medium | 6.1 | 2022-04-20 | The affected product is vulnerable to a network-based attack by threat actors supplying a crafted, malicious XML payload designed to trigger an external entity… |
CVE-2021-43988 | Medium | 6.1 | 2022-04-20 | The affected product is vulnerable to a network-based attack by threat actors utilizing crafted naming conventions of files to gain unauthorized access rights. |
CVE-2021-43986 | Medium | 6.0 | 2022-04-20 | The setup program for the affected product configures its files and folders with full access, which may allow unauthorized users permission to replace original… |
CVE-2021-43933 | Medium | 6.1 | 2022-04-20 | The affected product is vulnerable to a network-based attack by threat actors sending unimpeded requests to the receiving server, which could cause a denial-of… |
CVE-2021-38483 | Medium | 6.0 | 2022-04-20 | The affected product is vulnerable to misconfigured binaries, allowing users on the target PC with SYSTEM level privileges access to overwrite the binary and m… |
CVE-2021-3101 | High | 8.8 | 2022-04-19 | Hotdog, prior to v1.0.1, did not mimic the capabilities or the SELinux label of the target JVM process. This would allow a container to gain full privileges on… |
CVE-2021-3100 | High | 8.8 | 2022-04-19 | The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate pr… |
CVE-2021-4096 | High | 8.8 | 2022-04-19 | The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers… |
CVE-2021-26627 | High | 7.5 | 2022-04-19 | Real-time image information exposure is caused by insufficient authentication for activated RTSP port. This vulnerability could allow to remote attackers to se… |
CVE-2021-26626 | High | 8.1 | 2022-04-19 | Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter value of the execBrowse… |
CVE-2021-26625 | High | 8.8 | 2022-04-19 | Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerability is caused by an a… |
CVE-2021-23283 | Medium | 5.2 | 2022-04-19 | Eaton Intelligent Power Protector (IPP) prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient valida… |
CVE-2021-39078 | Medium | 4.4 | 2022-04-19 | IBM Security Guardium 10.5 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 215589. |
CVE-2021-39076 | High | 7.5 | 2022-04-19 | IBM Security Guardium 10.5 and 11.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM X-For… |
CVE-2021-39072 | Medium | 5.9 | 2022-04-19 | IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Securi… |
CVE-2021-39033 | Medium | 6.5 | 2022-04-19 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information… |
CVE-2021-44519 | High | 8.8 | 2022-04-19 | In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Directory Traversal vulnerability, leading to remote code execution. |
CVE-2021-43129 | Medium | 6.5 | 2022-04-19 | A bypass exists for Desire2Learn/D2L Brightspace’s “Disable Right Click” option in the quizzing feature, which allows a quiz-taker to access print and copy fun… |
CVE-2021-41570 | Medium | 5.4 | 2022-04-19 | Veritas NetBackup OpsCenter Analytics 9.1 allows XSS via the NetBackup Master Server Name, Display Name, NetBackup User Name, or NetBackup Password field durin… |
CVE-2021-25120 | Medium | 6.1 | 2022-04-18 | The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in… |
CVE-2021-42782 | Medium | 5.3 | 2022-04-18 | Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library. |
CVE-2021-42781 | Medium | 5.3 | 2022-04-18 | Heap buffer overflow issues were found in Opensc before version 0.22.0 in pkcs15-oberthur.c that could potentially crash programs using the library. |
CVE-2021-42780 | Medium | 5.3 | 2022-04-18 | A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the library. |
CVE-2021-42779 | Medium | 5.3 | 2022-04-18 | A heap use after free issue was found in Opensc before version 0.22.0 in sc_file_valid. |
CVE-2021-42778 | Medium | 5.3 | 2022-04-18 | A heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo. |
CVE-2021-3681 | Medium | 5.5 | 2022-04-18 | A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via… |
CVE-2021-3652 | Medium | 6.5 | 2022-04-18 | A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any passwor… |
CVE-2021-3624 | High | 7.8 | 2022-04-18 | There is an integer overflow vulnerability in dcraw. When the victim runs dcraw with a maliciously crafted X3F input image, arbitrary code may be executed in t… |
CVE-2021-3503 | Medium | 4.3 | 2022-04-18 | A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confiden… |
CVE-2021-23286 | Medium | 5.7 | 2022-04-18 | Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to CSV Formula Injection. This i… |
CVE-2021-23285 | Low | 3.1 | 2022-04-18 | Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to reflected Cross-site Scriptin… |
CVE-2021-23284 | Medium | 5.7 | 2022-04-18 | Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to Stored Cross-site Scripting v… |
CVE-2021-46122 | High | 7.2 | 2022-04-18 | Tp-Link TL-WR840N (EU) v6.20 Firmware (0.9.1 4.17 v0001.0 Build 201124 Rel.64328n) is vulnerable to Buffer Overflow via the Password reset feature. |
CVE-2021-44510 | High | 7.5 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, attackers can cause a calculation of the size of… |
CVE-2021-44509 | High | 7.5 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, attackers can cause an integer underflow of the s… |
CVE-2021-44508 | High | 7.5 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). A lack of NULL checks in calls to ious_open in sr_unix/ious_open.c all… |
CVE-2021-44507 | High | 7.5 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). A lack of parameter validation in calls to memcpy in str_tok in sr_uni… |
CVE-2021-44506 | High | 7.5 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). A lack of input validation in calls to do_verify in sr_unix/do_verify… |
CVE-2021-44505 | High | 7.5 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can cause a NULL pointer dereference… |
CVE-2021-44504 | High | 7.5 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can cause a size variable, stored as… |
CVE-2021-44503 | High | 7.5 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can cause a call to va_arg on an empt… |
CVE-2021-44502 | High | 7.5 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can control the size of a memset that… |
CVE-2021-44501 | High | 7.5 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can cause calls to ZRead to crash due… |
CVE-2021-44500 | High | 7.5 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). A lack of input validation in calls to eb_div in sr_port/eb_muldiv.c a… |
CVE-2021-44499 | High | 7.5 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can cause a call to $Extract to force… |
CVE-2021-44498 | High | 7.5 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, attackers can cause a type to be incorrectly init… |
CVE-2021-44497 | High | 7.5 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, can cause the bounds of a for loop to be miscalcu… |
CVE-2021-44496 | Critical | 9.8 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can control the size variable and buf… |
CVE-2021-44495 | High | 7.5 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. Using crafted input, an attacker can cause a NULL pointer derefere… |
CVE-2021-44494 | High | 7.5 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. Using crafted input, an attacker can cause calls to ZRead to crash… |
CVE-2021-44493 | High | 7.5 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. Using crafted input, an attacker can cause a call to $Extract to f… |
CVE-2021-44492 | High | 7.5 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. Using crafted input, attackers can cause a type to be incorrectly… |
CVE-2021-44491 | High | 7.5 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can cause a calculation of the size of calls to memset in op_fnj3… |
CVE-2021-44490 | High | 7.5 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can cause a calculation of the size of calls to memset in op_fnj3… |
CVE-2021-44489 | High | 7.5 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can cause an integer underflow of the size of calls to memset in… |
CVE-2021-44488 | Critical | 9.1 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can control the size and input to calls to memcpy in op_fnfnumber… |
CVE-2021-44487 | High | 7.5 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of NULL checks in calls to ious_open in sr_unix/ious_open.c allows attackers to crash the… |
CVE-2021-44486 | Critical | 9.8 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can manipulate the value of a function pointer used in op_write i… |
CVE-2021-44485 | High | 7.5 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of NULL checks in trip_gen in sr_port/emit_code.c allows attackers to crash the applicati… |
CVE-2021-44484 | High | 7.5 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of NULL checks in calls to emit_trip in sr_port/emit_code.c allows attackers to crash the… |
CVE-2021-44483 | High | 7.5 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of input validation in calls to eb_div in sr_port/eb_muldiv.c allows attackers to crash t… |
CVE-2021-44482 | High | 7.5 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of input validation in calls to do_verify in sr_unix/do_verify.c allows attackers to atte… |
CVE-2021-44481 | High | 7.5 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of parameter validation in calls to memcpy in check_and_set_timeout in sr_unix/ztimeoutro… |
CVE-2021-42230 | Critical | 9.8 | 2022-04-15 | Seowon 130-SLC router all versions as of 2021-09-15 is vulnerable to Remote Code Execution via the queriesCnt parameter. |