2021 CVEs (page 36)
Page 36 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-25090 | Medium | 5.4 | 2022-04-11 | The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions related to AJAX actions… |
CVE-2021-24987 | Medium | 6.1 | 2022-04-11 | The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_shar… |
CVE-2021-24986 | Medium | 6.1 | 2022-04-11 | The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site… |
CVE-2021-32162 | High | 8.8 | 2022-04-11 | A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature. |
CVE-2021-32161 | Medium | 6.1 | 2022-04-11 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature. |
CVE-2021-32160 | Medium | 6.1 | 2022-04-11 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature. |
CVE-2021-32159 | High | 8.8 | 2022-04-11 | A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature. |
CVE-2021-32158 | Medium | 6.1 | 2022-04-11 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature. |
CVE-2021-32157 | Critical | 9.6 | 2022-04-11 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature. |
CVE-2021-32156 | High | 8.8 | 2022-04-11 | A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature. |
CVE-2021-43009 | Medium | 6.1 | 2022-04-08 | A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the request URL. |
CVE-2021-36293 | Medium | 6.4 | 2022-04-08 | Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admin may potentially exploit vulnerability… |
CVE-2021-36290 | Medium | 6.4 | 2022-04-08 | Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admin may potentially exploit vulnerability… |
CVE-2021-36288 | High | 8.6 | 2022-04-08 | Dell VNX2 for File version 8.1.21.266 and earlier, contain a path traversal vulnerability which may lead unauthenticated users to read/write restricted files |
CVE-2021-36287 | High | 7.3 | 2022-04-08 | Dell VNX2 for file version 8.1.21.266 and earlier, contain an unauthenticated remote code execution vulnerability which may lead unauthenticated users to execu… |
CVE-2021-43498 | High | 7.5 | 2022-04-08 | An Access Control vulnerability exists in ATutor 2.2.4 in password_reminder.php when the g, id, h, form_password_hidden, and form_change HTTP POST parameters a… |
CVE-2021-43517 | Critical | 9.8 | 2022-04-08 | FOSCAM Camera FI9805E with firmware V4.02.R12.00018510.10012.143900.00000 contains a backdoor that opens Telnet port when special command is sent on port 9530. |
CVE-2021-43515 | High | 7.8 | 2022-04-08 | CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious paylo… |
CVE-2021-43521 | High | 7.5 | 2022-04-08 | A Buffer Overflow vulnerability exists in zlog 1.2.15 via zlog_conf_build_with_file in src/zlog/src/conf.c. |
CVE-2021-43483 | High | 8.0 | 2022-04-08 | An Access Control vulnerability exists in CLARO KAON CG3000 1.00.67 in the router configuration, which could allow a malicious user to read or update the confi… |
CVE-2021-40656 | High | 8.8 | 2022-04-08 | libsixel before 1.10 is vulnerable to Buffer Overflow in libsixel/src/quant.c:867. |
CVE-2021-41715 | High | 8.8 | 2022-04-08 | libsixel 1.10.0 is vulnerable to Use after free in libsixel/src/dither.c:379. |
CVE-2021-46367 | High | 7.2 | 2022-04-08 | RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel. An authenticated attacker can upload a PHP file and bypa… |
CVE-2021-46437 | Medium | 4.8 | 2022-04-08 | An issue was discovered in ZZCMS 2021. There is a cross-site scripting (XSS) vulnerability in ad_manage.php. |
CVE-2021-46436 | High | 7.2 | 2022-04-08 | An issue was discovered in ZZCMS 2021. There is a SQL injection vulnerability in ad_manage.php. |
CVE-2021-43474 | Critical | 9.8 | 2022-04-07 | An Access Control vulnerability exists in D-Link DIR-823G REVA1 1.02B05 (Lastest) via any parameter in the HNAP1 function |
CVE-2021-43453 | Critical | 9.8 | 2022-04-07 | A Heap-based Buffer Overflow vulnerability exists in JerryScript 2.4.0 and prior versions via an out-of-bounds read in parser_parse_for_statement_start in the… |
CVE-2021-36202 | High | 8.4 | 2022-04-07 | Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF ex… |
CVE-2021-43432 | Medium | 6.1 | 2022-04-07 | A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp. |
CVE-2021-43430 | High | 8.8 | 2022-04-07 | An Access Control vulnerability exists in BigAntSoft BigAnt office messenger 5.6 via im_webserver, which could let a malicious user upload PHP Trojan files. |
CVE-2021-43429 | High | 7.5 | 2022-04-07 | A Denial of Service vulnerability exists in CORTX-S3 Server as of 11/7/2021 via the mempool_destroy method due to a failture to release locks pool->lock. |
CVE-2021-43421 | Critical | 9.8 | 2022-04-07 | A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary fi… |
CVE-2021-46419 | Critical | 9.1 | 2022-04-07 | An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts. |
CVE-2021-46418 | High | 7.5 | 2022-04-07 | An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts. |
CVE-2021-46417 | High | 7.5 | 2022-04-07 | Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fueling Systems Colibri C… |
CVE-2021-46416 | High | 8.1 | 2022-04-07 | Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling. |
CVE-2021-43138 | High | 7.8 | 2022-04-06 | In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterato… |
CVE-2021-41026 | Medium | 6.5 | 2022-04-06 | A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrary files from the… |
CVE-2021-32585 | High | 7.2 | 2022-04-06 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiWAN before 4.5.9 may allow an attacker to perform a stored cross-… |
CVE-2021-26116 | Medium | 6.7 | 2022-04-06 | An improper neutralization of special elements used in an OS command vulnerability in the command line interpreter of FortiAuthenticator before 6.3.1 may allow… |
CVE-2021-26113 | Medium | 6.2 | 2022-04-06 | A use of a one-way hash with a predictable salt vulnerability [CWE-760] in FortiWAN before 4.5.9 may allow an attacker who has previously come in possession of… |
CVE-2021-26104 | High | 7.8 | 2022-04-06 | Multiple OS command injection (CWE-78) vulnerabilities in the command line interface of FortiManager 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x… |
CVE-2021-22127 | High | 7.1 | 2022-04-06 | An improper input validation vulnerability in FortiClient for Linux 6.4.x before 6.4.3, FortiClient for Linux 6.2.x before 6.2.9 may allow an unauthenticated a… |
CVE-2021-44169 | High | 8.2 | 2022-04-06 | A improper initialization in Fortinet FortiClient (Windows) version 6.0.10 and below, version 6.2.9 and below, version 6.4.7 and below, version 7.0.3 and below… |
CVE-2021-43205 | Medium | 4.3 | 2022-04-06 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Linux version 7.0.2 and below, 6.4.7 and below and 6.2… |
CVE-2021-32593 | Medium | 6.5 | 2022-04-06 | A use of a broken or risky cryptographic algorithm vulnerability [CWE-327] in the Dynamic Tunnel Protocol of FortiWAN before 4.5.9 may allow an unauthenticated… |
CVE-2021-26114 | Critical | 9.8 | 2022-04-06 | Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiWAN before 4.5.9 may allow an unauthenticated attacker to e… |
CVE-2021-26112 | High | 8.1 | 2022-04-06 | Multiple stack-based buffer overflow vulnerabilities [CWE-121] both in network daemons and in the command line interpreter of FortiWAN before 4.5.9 may allow a… |
CVE-2021-24009 | High | 7.2 | 2022-04-06 | Multiple improper neutralization of special elements used in an OS command vulnerabilities (CWE-78) in the Web GUI of FortiWAN before 4.5.9 may allow an authen… |
CVE-2021-45104 | High | 7.4 | 2022-04-06 | An issue was discovered in HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1. An attacker who can capture HTCondor network data can interfere with users' job… |
CVE-2021-40375 | Medium | 6.5 | 2022-04-06 | Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite… |
CVE-2021-40374 | Medium | 5.4 | 2022-04-06 | A stored cross-site scripting (XSS) vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patient's details allows remote attackers to… |
CVE-2021-30497 | High | 7.5 | 2022-04-06 | Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal. The imageFilePath parameter processed… |
CVE-2021-45103 | High | 8.1 | 2022-04-06 | An issue was discovered in HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1. An attacker can access files stored in S3 cloud storage that a user has asked H… |
CVE-2021-41752 | Critical | 9.8 | 2022-04-05 | Stack overflow vulnerability in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021 due to an unbounded recursive call to the ne… |
CVE-2021-41751 | Critical | 9.8 | 2022-04-05 | Buffer overflow vulnerability in file ecma-builtin-array-prototype.c:909 in function ecma_builtin_array_prototype_object_slice in Jerryscript before commit e1c… |
CVE-2021-30080 | Critical | 9.8 | 2022-04-05 | An issue was discovered in the route lookup process in beego before 1.12.11 that allows attackers to bypass access control. |
CVE-2021-28428 | Critical | 9.8 | 2022-04-05 | File upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and *.hello files using the Media Files upload functionality. The origin… |
CVE-2021-27117 | High | 7.8 | 2022-04-05 | An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally. |
CVE-2021-27116 | High | 7.8 | 2022-04-05 | An issue was discovered in file profile.go in function MemProf in beego through 2.0.2, allows attackers to launch symlink attacks locally. |
CVE-2021-41245 | Medium | 6.5 | 2022-04-05 | Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF tokens generated by `privUITransactionFile` aren't properly… |
CVE-2021-38834 | High | 8.8 | 2022-04-05 | easy-mock v1.5.0-v1.6.0 allows remote attackers to bypass the vm2 sandbox and execute arbitrary system commands through special js code. |
CVE-2021-39114 | High | 8.8 | 2022-04-05 | Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Jav… |
CVE-2021-33207 | Critical | 9.8 | 2022-04-05 | The HTTP client in MashZone NextGen through 10.7 GA deserializes untrusted data when it gets an HTTP response with a 570 status code. |
CVE-2021-45893 | High | 7.5 | 2022-04-05 | An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is Improper Handling of Case Sensitivity, which makes password guessing easier. |
CVE-2021-45892 | Medium | 5.9 | 2022-04-05 | An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is storage of Passwords in a Recoverable Format. |
CVE-2021-45891 | High | 8.8 | 2022-04-05 | An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4., that allows attackers to escalate privileges within the application, since all permission checks… |
CVE-2021-44109 | High | 7.5 | 2022-04-05 | A buffer overflow in lib/sbi/message.c in Open5GS 2.3.6 and earlier allows remote attackers to Denial of Service via a crafted sbi request. |
CVE-2021-44108 | High | 7.5 | 2022-04-05 | A null pointer dereference in src/amf/namf-handler.c in Open5GS 2.3.6 and earlier allows remote attackers to Denial of Service via a crafted sbi request to amf. |
CVE-2021-43008 | High | 7.5 | 2022-04-05 | Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by… |
CVE-2021-42324 | High | 7.4 | 2022-04-05 | An issue was discovered on DCN (Digital China Networks) S4600-10P-SI devices before R0241.0470. Due to improper parameter validation in the console interface… |
CVE-2021-45894 | Medium | 5.9 | 2022-04-05 | An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is Cleartext Transmission of Sensitive Information. |
CVE-2021-36851 | Medium | 4.1 | 2022-04-04 | Authenticated (editor or higher user role) Cross-Site Scripting (XSS) vulnerability in Web-Settler Testimonial Slider – Free Testimonials Slider Plugin (WordPr… |
CVE-2021-36826 | Medium | 5.4 | 2022-04-04 | Authenticated (subscriber or higher user role if allowed to access projects) Stored Cross-Site Scripting (XSS) vulnerability in weDevs WP Project Manager plugi… |
CVE-2021-33010 | High | 7.5 | 2022-04-04 | An exception is thrown from a function in AVEVA System Platform versions 2017 through 2020 R2 P01, but it is not caught, which may cause a denial-of-service co… |
CVE-2021-33008 | High | 8.8 | 2022-04-04 | AVEVA System Platform versions 2017 through 2020 R2 P01 does not perform any authentication for functionality that requires a provable user identity. |
CVE-2021-32994 | High | 7.5 | 2022-04-04 | Softing OPC UA C++ SDK (Software Development Kit) versions from 5.59 to 5.64 exported library functions don't properly validate received extension objects, whi… |
CVE-2021-32986 | Critical | 9.8 | 2022-04-04 | After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, the unlocked state does not timeout… |
CVE-2021-32985 | High | 7.2 | 2022-04-04 | AVEVA System Platform versions 2017 through 2020 R2 P01 does not properly verify that the source of data or communication is valid. |
CVE-2021-32984 | Critical | 9.8 | 2022-04-04 | All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Direct CLICK PLC CPU M… |
CVE-2021-32982 | High | 7.5 | 2022-04-04 | Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An att… |
CVE-2021-32981 | High | 7.2 | 2022-04-04 | AVEVA System Platform versions 2017 through 2020 R2 P01 uses external input to construct a pathname that is intended to identify a file or directory that is lo… |
CVE-2021-32980 | Critical | 9.8 | 2022-04-04 | Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attac… |
CVE-2021-32978 | High | 7.5 | 2022-04-04 | The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful… |
CVE-2021-32977 | High | 7.2 | 2022-04-04 | AVEVA System Platform versions 2017 through 2020 R2 P01 does not verify, or incorrectly verifies, the cryptographic signature for data. |
CVE-2021-43464 | High | 8.8 | 2022-04-04 | A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is modified, the data in… |
CVE-2021-43463 | High | 7.8 | 2022-04-04 | An Unquoted Service Path vulnerability exists in Ext2Fsd v0.68 via a specially crafted file in the Ext2Srv Service executable service path. |
CVE-2021-43462 | Medium | 5.4 | 2022-04-04 | A Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the username parameter. |
CVE-2021-43461 | Medium | 5.4 | 2022-04-04 | Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the servername parameter. |
CVE-2021-43460 | High | 7.8 | 2022-04-04 | An Unquoted Service Path vulnerability exists in System Explorer 7.0.0 via via a specially crafted file in the SystemExplorerHelpService service executable pat… |
CVE-2021-43459 | Medium | 5.4 | 2022-04-04 | A Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the (1) domain and (2) path parameters. |
CVE-2021-25113 | Medium | 5.4 | 2022-04-04 | The Dropdown Menu Widget WordPress plugin through 1.9.7 does not have authorisation and CSRF checks when saving its settings, allowing low privilege users such… |
CVE-2021-25048 | Medium | 5.4 | 2022-04-04 | The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing any authenticated u… |
CVE-2021-43458 | High | 7.8 | 2022-04-04 | An Unquoted Service Path vulnerability exits in Vembu BDR 4.2.0.1 via a specially crafted file in the (1) hsflowd, (2) VembuBDR360Agent, or (3) VembuOffice365A… |
CVE-2021-43457 | High | 7.8 | 2022-04-04 | An Unquoted Service Path vulnerability exists in bVPN 2.5.1 via a specially crafted file in the waselvpnserv service path. |
CVE-2021-43456 | High | 7.8 | 2022-04-04 | An Unquoted Service Path vulnerablility exists in Rumble Mail Server 0.51.3135 via via a specially crafted file in the RumbleService executable service path. |
CVE-2021-43455 | High | 7.8 | 2022-04-04 | An Unquoted Service Path vulnerability exists in FreeLAN 2.2 via a specially crafted file in the FreeLAN Service path. |
CVE-2021-43454 | High | 7.8 | 2022-04-04 | An Unquoted Service Path vulnerability exists in AnyTXT Searcher 1.2.394 via a specially crafted file in the ATService path. . |
CVE-2021-44138 | High | 7.5 | 2022-04-04 | There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary… |
CVE-2021-36776 | High | 8.8 | 2022-04-04 | A Improper Access Control vulnerability in SUSE Rancher allows remote attackers impersonate arbitrary users. This issue affects: SUSE Rancher Rancher versions… |