2021 CVEs (page 35)
Page 35 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-36828 | Medium | 4.8 | 2022-04-15 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) in WP Maintenance plugin <= 6.0.7 versions. |
CVE-2021-36205 | High | 8.1 | 2022-04-15 | Under certain circumstances the session token is not cleared on logout. |
CVE-2021-40386 | Critical | 9.8 | 2022-04-15 | Kaseya Unitrends Client/Agent through 10.5,5 allows remote attackers to execute arbitrary code. |
CVE-2021-28505 | High | 7.5 | 2022-04-14 | On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule… |
CVE-2021-44394 | High | 7.5 | 2022-04-14 | Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-cr… |
CVE-2021-44375 | High | 7.5 | 2022-04-14 | Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-cr… |
CVE-2021-44366 | High | 7.5 | 2022-04-14 | Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-cr… |
CVE-2021-44357 | High | 7.5 | 2022-04-14 | Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-cr… |
CVE-2021-44356 | High | 7.5 | 2022-04-14 | Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-cr… |
CVE-2021-44355 | High | 7.5 | 2022-04-14 | Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-cr… |
CVE-2021-44354 | High | 7.5 | 2022-04-14 | Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-cr… |
CVE-2021-43257 | High | 7.8 | 2022-04-14 | Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to informati… |
CVE-2021-40426 | High | 8.8 | 2022-04-14 | A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange libsox 14.4.2 and master commit 42b3557e. A spec… |
CVE-2021-40425 | Medium | 6.5 | 2022-04-14 | An out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B_03 of Webroot Secure Anywhere 21.4. A specially-crafted executable can lead to… |
CVE-2021-40424 | Medium | 6.5 | 2022-04-14 | An out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B_03 of Webroot Secure Anywhere 21.4. A specially-crafted executable can lead to… |
CVE-2021-40422 | Critical | 10.0 | 2022-04-14 | An authentication bypass vulnerability exists in the device password generation functionality of Swift Sensors Gateway SG3-1010. A specially-crafted network re… |
CVE-2021-40405 | Medium | 6.5 | 2022-04-14 | A denial of service vulnerability exists in the cgiserver.cgi Upgrade API functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP reque… |
CVE-2021-40402 | High | 7.5 | 2022-04-14 | An out-of-bounds read vulnerability exists in the RS-274X aperture macro multiple outline primitives functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), an… |
CVE-2021-40400 | High | 7.5 | 2022-04-14 | An out-of-bounds read vulnerability exists in the RS-274X aperture macro outline primitive functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and the forke… |
CVE-2021-40398 | High | 7.8 | 2022-04-14 | An out-of-bounds write vulnerability exists in the parse_raster_data functionality of Accusoft ImageGear 19.10. A specially-crafted malformed file can lead to… |
CVE-2021-40392 | High | 7.5 | 2022-04-14 | An information disclosure vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. Network sniffing can lead to a disclosure of s… |
CVE-2021-40390 | Critical | 9.8 | 2022-04-14 | An authentication bypass vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. A specially-crafted HTTP request can lead to un… |
CVE-2021-21967 | Medium | 5.9 | 2022-04-14 | An out-of-bounds write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT pa… |
CVE-2021-21956 | High | 7.8 | 2022-04-14 | A php unserialize vulnerability exists in the Ai-Bolit functionality of CloudLinux Inc Imunify360 5.10.2. A specially-crafted malformed file can lead to potent… |
CVE-2021-21949 | High | 8.8 | 2022-04-14 | An improper array index validation vulnerability exists in the JPEG-JFIF Scan header parser functionality of Accusoft ImageGear 19.10. A specially-crafted file… |
CVE-2021-21948 | High | 7.8 | 2022-04-14 | A heap-based buffer overflow vulnerability exists in the readDatHeadVec functionality of AnyCubic Chitubox AnyCubic Plugin 1.0.0. A specially-crafted GF file c… |
CVE-2021-21947 | High | 8.8 | 2022-04-14 | Two heap-based buffer overflow vulnerabilities exists in the JPEG-JFIF lossless Huffman image parser functionality of Accusoft ImageGear 19.10. A specially-cra… |
CVE-2021-21946 | High | 8.8 | 2022-04-14 | Two heap-based buffer overflow vulnerabilities exists in the JPEG-JFIF lossless Huffman image parser functionality of Accusoft ImageGear 19.10. A specially-cra… |
CVE-2021-21945 | High | 8.8 | 2022-04-14 | Two heap-based buffer overflow vulnerabilities exist in the TIFF parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to a heap… |
CVE-2021-21944 | High | 8.8 | 2022-04-14 | Two heap-based buffer overflow vulnerabilities exist in the TIFF parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to a heap… |
CVE-2021-21943 | High | 8.8 | 2022-04-14 | A heap-based buffer overflow vulnerability exists in the XWD parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to code execut… |
CVE-2021-21942 | High | 8.8 | 2022-04-14 | An out-of-bounds write vulnerability exists in the TIFF YCbCr image parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to remo… |
CVE-2021-21939 | High | 8.8 | 2022-04-14 | A heap-based buffer overflow vulnerability exists in the XWD parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to code execut… |
CVE-2021-21938 | Critical | 9.8 | 2022-04-14 | A heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to cod… |
CVE-2021-21914 | High | 8.8 | 2022-04-14 | A heap-based buffer overflow vulnerability exists in the DecoderStream::Append functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to… |
CVE-2021-45228 | Medium | 5.4 | 2022-04-14 | An XSS issue was discovered in COINS Construction Cloud 11.12. Due to insufficient neutralization of user input in the description of a task, it is possible to… |
CVE-2021-45227 | Medium | 5.4 | 2022-04-14 | An issue was discovered in COINS Construction Cloud 11.12. Due to an inappropriate use of HTML IFRAME elements, the file upload functionality is vulnerable to… |
CVE-2021-43633 | Medium | 5.4 | 2022-04-14 | Sourcecodester Messaging Web Application 1.0 is vulnerable to stored XSS. If a sender inserts valid scripts into the chat, the script will be executed on the r… |
CVE-2021-43290 | Critical | 9.8 | 2022-04-14 | An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into a directory of a GoCD… |
CVE-2021-43289 | High | 7.5 | 2022-04-14 | An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into an arbitrary director… |
CVE-2021-43288 | Medium | 5.4 | 2022-04-14 | An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report. |
CVE-2021-43286 | High | 8.8 | 2022-04-14 | An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker with privileges to create a new pipeline on a GoCD server can abuse a command-line inje… |
CVE-2021-43287 | High | 7.5 | 2022-04-14 | An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD se… |
CVE-2021-43154 | Medium | 6.1 | 2022-04-13 | Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php. |
CVE-2021-41119 | Medium | 5.3 | 2022-04-13 | Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object c… |
CVE-2021-42136 | Critical | 9.0 | 2022-04-13 | A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to execute JavaScript… |
CVE-2021-22797 | High | 7.8 | 2022-04-13 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal) vulnerability exists that could cause malicious script to be deployed i… |
CVE-2021-22795 | Critical | 9.1 | 2022-04-13 | A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution… |
CVE-2021-22794 | Critical | 9.1 | 2022-04-13 | A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution. Affected P… |
CVE-2021-46167 | High | 7.8 | 2022-04-13 | An access control issue in the authentication module of wizplat PD065 v1.19 allows attackers to access sensitive data and cause a Denial of Service (DoS). |
CVE-2021-43741 | Critical | 9.8 | 2022-04-13 | CMSimple 5.4 is vulnerable to Directory Traversal. The vulnerability exists when a user changes the file name to malicious file on config.php leading to remote… |
CVE-2021-43742 | Medium | 5.4 | 2022-04-13 | CMSimple 5.4 is vulnerable to Cross Site Scripting (XSS) via the file upload feature. |
CVE-2021-44520 | High | 8.8 | 2022-04-13 | In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Command Injection vulnerability, leading to remote code execution with root privileges. |
CVE-2021-28544 | Medium | 4.3 | 2022-04-12 | Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-b… |
CVE-2021-41005 | Medium | 6.5 | 2022-04-12 | A remote vulnerability was discovered in Aruba Instant On 1930 Switch Series version(s): Firmware below v1.0.7.0. |
CVE-2021-41004 | High | 7.5 | 2022-04-12 | A remote vulnerability was discovered in Aruba Instant On 1930 Switch Series version(s): Firmware below v1.0.7.0. |
CVE-2021-39814 | Medium | 6.7 | 2022-04-12 | In ppmp_validate_wsm of drm_fw.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege wi… |
CVE-2021-39812 | High | 7.8 | 2022-04-12 | In TBD of TBD, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with no additional execution pr… |
CVE-2021-39809 | High | 7.5 | 2022-04-12 | In avrc_ctrl_pars_vendor_rsp of avrc_pars_ct.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information di… |
CVE-2021-39808 | High | 7.8 | 2022-04-12 | In createNotificationChannelGroup of PreferencesHelper.java, there is a possible way for a service to run in foreground without user notification due to improp… |
CVE-2021-39807 | High | 7.8 | 2022-04-12 | In handleNfcStateChanged of SecureNfcEnabler.java, there is a possible way to enable NFC from the Guest account due to a missing permission check. This could l… |
CVE-2021-39805 | Medium | 6.5 | 2022-04-12 | In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure… |
CVE-2021-39804 | Medium | 6.5 | 2022-04-12 | In reinit of HeifDecoderImpl.cpp, there is a possible crash due to a missing null check. This could lead to remote persistent denial of service in the file pic… |
CVE-2021-39803 | Medium | 6.5 | 2022-04-12 | In ~Impl of C2AllocatorIon.cpp, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure with no additi… |
CVE-2021-39802 | High | 7.8 | 2022-04-12 | In change_pte_range of mprotect.c , there is a possible way to make a shared mmap writable due to a permissions bypass. This could lead to local escalation of… |
CVE-2021-39801 | High | 7.8 | 2022-04-12 | In ion_ioctl of ion-ioctl.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional ex… |
CVE-2021-39800 | Medium | 5.5 | 2022-04-12 | In ion_ioctl of ion-ioctl.c, there is a possible way to leak kernel head data due to a use after free. This could lead to local information disclosure with no… |
CVE-2021-39799 | High | 7.8 | 2022-04-12 | In AttributionSource of AttributionSource.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of… |
CVE-2021-39798 | High | 7.8 | 2022-04-12 | In Bitmap_createFromParcel of Bitmap.cpp, there is a possible arbitrary code execution due to a missing bounds check. This could lead to local escalation of pr… |
CVE-2021-39797 | High | 7.8 | 2022-04-12 | In several functions of of LauncherApps.java, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation… |
CVE-2021-39796 | High | 7.3 | 2022-04-12 | In HarmfulAppWarningActivity of HarmfulAppWarningActivity.java, there is a possible way to trick victim to install harmful app due to a tapjacking/overlay atta… |
CVE-2021-39794 | High | 7.8 | 2022-04-12 | In broadcastPortInfo of AdbService.java, there is a possible way for apps to run code as the shell user, if wireless debugging is enabled, due to a missing per… |
CVE-2021-36914 | Medium | 6.1 | 2022-04-12 | Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS) in CalderaWP License Manager (WordPress plugin) <= 1.2.11. |
CVE-2021-0707 | High | 7.8 | 2022-04-12 | In dma_buf_release of dma-buf.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additi… |
CVE-2021-0694 | High | 7.8 | 2022-04-12 | In setServiceForegroundInnerLocked of ActiveServices.java, there is a possible way for a background application to regain foreground permissions due to insuffi… |
CVE-2021-42255 | High | 7.8 | 2022-04-12 | AppGuard Enterprise before 6.7.100.1 creates a Temporary File in a Directory with Insecure Permissions. Local users can gain SYSTEM privileges because a repair… |
CVE-2021-31805 | Critical | 9.8 | 2022-04-12 | The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation i… |
CVE-2021-32040 | Medium | 6.5 | 2022-04-12 | It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of t… |
CVE-2021-42029 | High | 7.8 | 2022-04-12 | A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) V15 (All versions), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 5), SIMATIC S… |
CVE-2021-40368 | High | 7.5 | 2022-04-12 | A vulnerability has been identified in SIMATIC S7-400 CPU 412-1 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 DP V7 (All versions), SIMATIC S7-400 CPU 412-… |
CVE-2021-4047 | High | 7.5 | 2022-04-11 | The release of OpenShift 4.9.6 included four CVE fixes for the haproxy package, however the patch for CVE-2021-39242 was missing. This issue only affects Red H… |
CVE-2021-46742 | Critical | 9.1 | 2022-04-11 | The multi-window module has a vulnerability of unauthorized insertion and tampering of Settings.Secure data.Successful exploitation of this vulnerability may a… |
CVE-2021-46740 | High | 7.5 | 2022-04-11 | The device authentication service module has a defect vulnerability introduced in the design process.Successful exploitation of this vulnerability may affect d… |
CVE-2021-43177 | Medium | 5.3 | 2022-04-11 | As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (… |
CVE-2021-40065 | High | 7.5 | 2022-04-11 | The communication module has a service logic error vulnerability.Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2021-38125 | Critical | 9.8 | 2022-04-11 | Unauthenticated remote code execution in Micro Focus Operations Bridge containerized, affecting versions 2021.05, 2021.08, and newer versions of Micro Focus Op… |
CVE-2021-36910 | Low | 3.4 | 2022-04-11 | Authenticated (admin user role) Stored Cross-Site Scripting (XSS) in WP-Appbox (WordPress plugin) <= 4.3.20. |
CVE-2021-36896 | Medium | 4.8 | 2022-04-11 | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Pricing Table (WordPress plugin) versions <= 1.5.2 |
CVE-2021-36893 | Medium | 4.8 | 2022-04-11 | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Responsive Tabs (WordPress plugin) <= 4.0.5 |
CVE-2021-36848 | Low | 3.4 | 2022-04-11 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Feather (WordPress plugin) versions <= 2.0.4 |
CVE-2021-36846 | Medium | 4.8 | 2022-04-11 | Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Premio Chaty (WordPress plugin) <= 2.8.3 |
CVE-2021-22055 | Medium | 5.3 | 2022-04-11 | The SchedulerServer in Vmware photon allows remote attackers to inject logs through \r in the package parameter. Attackers can also insert malicious data and f… |
CVE-2021-43442 | High | 8.1 | 2022-04-11 | A Logic Flaw vulnerability exists in i3 International Inc Annexxus Camera V5.2.0 build 150317 (Ax46), V5.0.9 build 151106 (Ax68), and V5.0.9 build 150615 (Ax78… |
CVE-2021-39068 | Medium | 5.4 | 2022-04-11 | IBM Curam Social Program Management 8.0.1 and 7.0.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2021-38930 | High | 7.5 | 2022-04-11 | IBM System Storage DS8000 Management Console (HMC) R8.5 88.5x.x.x, R9.1 89.1x.0.0, and R9.2 89.2x.0.0 could allow a remote attacker to obtain sensitive informa… |
CVE-2021-38929 | High | 7.5 | 2022-04-11 | IBM System Storage DS8000 Management Console (HMC) R8.5 88.5x.x.x, R9.1 89.1x.0.0, and R9.2 89.2x.0.0 could allow a remote attacker to obtain sensitive informa… |
CVE-2021-37293 | Medium | 6.5 | 2022-04-11 | A Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 via the page GET parameter in index.php. |
CVE-2021-37292 | High | 7.2 | 2022-04-11 | An Access Control vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 due to an undocumented backdoor account. A malicious us… |
CVE-2021-37291 | Critical | 9.8 | 2022-04-11 | An SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 ivia the input_id POST parameter in index.php. |
CVE-2021-40219 | High | 8.8 | 2022-04-11 | Bolt CMS <= 4.2 is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit theme to inject server-side template in… |