2021 CVEs (page 37)
Page 37 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-36775 | High | 8.8 | 2022-04-04 | a Improper Access Control vulnerability in SUSE Rancher allows users to keep privileges that should have been revoked. This issue affects: SUSE Rancher Rancher… |
CVE-2021-33616 | Medium | 5.4 | 2022-04-04 | RSA Archer 6.x through 6.9 SP1 P4 (6.9.1.4) allows stored XSS. |
CVE-2021-30066 | Medium | 6.8 | 2022-04-03 | On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an arbitrary firmwa… |
CVE-2021-30065 | High | 7.5 | 2022-04-03 | On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, crafted ModBus pack… |
CVE-2021-30064 | Critical | 9.8 | 2022-04-03 | On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an SSH login can su… |
CVE-2021-30063 | High | 7.5 | 2022-04-03 | On Schneider Electric ConneXium Tofino OPCLSM TCSEFM0000 before 03.23 and Belden Tofino Xenon Security Appliance, crafted OPC packets can cause an OPC enforcer… |
CVE-2021-30062 | High | 7.5 | 2022-04-03 | On Schneider Electric ConneXium Tofino OPCLSM TCSEFM0000 before 03.23 and Belden Tofino Xenon Security Appliance, crafted OPC packets can bypass the OPC enforc… |
CVE-2021-30061 | Medium | 6.8 | 2022-04-03 | On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, physically proximat… |
CVE-2021-3847 | High | 7.8 | 2022-04-01 | An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a c… |
CVE-2021-3461 | High | 7.1 | 2022-04-01 | A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type… |
CVE-2021-39908 | Medium | 6.5 | 2022-04-01 | In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14… |
CVE-2021-33657 | High | 8.8 | 2022-04-01 | There is a heap overflow problem in video/SDL_pixels.c in SDL (Simple DirectMedia Layer) 2.x to 2.0.18 versions. By crafting a malicious .BMP file, an attacker… |
CVE-2021-33024 | Low | 3.7 | 2022-04-01 | Philips Vue PACS versions 12.2.x.x and prior transmits or stores authentication credentials, but it uses an insecure method susceptible to unauthorized interce… |
CVE-2021-33022 | High | 7.5 | 2022-04-01 | Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unaut… |
CVE-2021-33020 | High | 8.2 | 2022-04-01 | Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increa… |
CVE-2021-33018 | High | 7.5 | 2022-04-01 | The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unnecessary risk that may result in the exposure of… |
CVE-2021-32976 | Critical | 9.8 | 2022-04-01 | Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to initiate a de… |
CVE-2021-32974 | Critical | 9.8 | 2022-04-01 | Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute c… |
CVE-2021-32970 | High | 7.5 | 2022-04-01 | Data can be copied without validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier, which may allow a remote at… |
CVE-2021-32968 | High | 7.5 | 2022-04-01 | Two buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O Series firmware version 2.2 or earlier may allow a remote attacker to cause a denial… |
CVE-2021-32961 | High | 7.5 | 2022-04-01 | A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a spe… |
CVE-2021-32960 | High | 8.5 | 2022-04-01 | Rockwell Automation FactoryTalk Services Platform v6.11 and earlier, if FactoryTalk Security is enabled and deployed contains a vulnerability that may allow a… |
CVE-2021-32957 | High | 7.5 | 2022-04-01 | A function in MDT AutoSave versions prior to v6.02.06 is used to retrieve system information for a specific process, and this information collection executes m… |
CVE-2021-32953 | Critical | 9.8 | 2022-04-01 | An attacker could utilize SQL commands to create a new user MDT AutoSave versions prior to v6.02.06 and update the user’s permissions, granting the attacker th… |
CVE-2021-32949 | High | 7.5 | 2022-04-01 | An attacker could utilize a function in MDT AutoSave versions prior to v6.02.06 that permits changing a designated path to another path and traversing the dire… |
CVE-2021-32945 | High | 7.5 | 2022-04-01 | An attacker could decipher the encryption and gain access to MDT AutoSave versions prior to v6.02.06. |
CVE-2021-32937 | High | 7.5 | 2022-04-01 | An attacker can gain knowledge of a session temporary working folder where the getfile and putfile commands are used in MDT AutoSave versions prior to v6.02.06… |
CVE-2021-32933 | Critical | 10.0 | 2022-04-01 | An attacker could leverage an API to pass along a malicious file that could then manipulate the process creation command line in MDT AutoSave versions prior to… |
CVE-2021-32503 | Medium | 4.9 | 2022-04-01 | Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use t… |
CVE-2021-28504 | High | 7.5 | 2022-04-01 | On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that… |
CVE-2021-27501 | High | 7.5 | 2022-04-01 | Philips Vue PACS versions 12.2.x.x and prior does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the sever… |
CVE-2021-27497 | Medium | 6.5 | 2022-04-01 | Philips Vue PACS versions 12.2.x.x and prior does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks… |
CVE-2021-27493 | Medium | 6.1 | 2022-04-01 | Philips Vue PACS versions 12.2.x.x and prior does not ensure or incorrectly ensures structured messages or data are well formed and that certain security prope… |
CVE-2021-27223 | Medium | 5.5 | 2022-04-01 | A denial-of-service issue existed in one of modules that was incorporated in Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security. A local us… |
CVE-2021-26624 | High | 7.8 | 2022-04-01 | An local privilege escalation vulnerability due to a "runasroot" command in eScan Anti-Virus. This vulnerability is due to invalid arguments and insufficient e… |
CVE-2021-26623 | High | 7.8 | 2022-04-01 | A remote code execution vulnerability due to incomplete check for 'xheader_decode_path_record' function's parameter length value in the ark library. Remote att… |
CVE-2021-23288 | Medium | 5.6 | 2022-04-01 | The vulnerability exists due to insufficient validation of input from certain resources by the IPP software. The attacker would need access to the local Subnet… |
CVE-2021-23287 | Medium | 5.6 | 2022-04-01 | The vulnerability exists due to insufficient validation of input of certain resources within the IPM software. This issue affects: Intelligent Power Manager (I… |
CVE-2021-23247 | Critical | 9.8 | 2022-04-01 | A command injection vulerability found in quick game engine allows arbitrary remote code in quick app. Allows remote attacke0rs to gain arbitrary code executio… |
CVE-2021-22277 | High | 7.5 | 2022-04-01 | Improper Input Validation vulnerability in ABB 800xA, Control Software for AC 800M, Control Builder Safe, Compact Product Suite - Control and I/O, ABB Base Sof… |
CVE-2021-20295 | Medium | 6.5 | 2022-04-01 | It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 (https://access.redhat.com/errata/RHSA-2020:4676) erratum released as part of… |
CVE-2021-20238 | Low | 3.7 | 2022-04-01 | It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without auth… |
CVE-2021-44135 | Critical | 9.8 | 2022-04-01 | pagekit all versions, as of 15-10-2021, is vulnerable to SQL Injection via Comment listing. |
CVE-2021-35117 | High | 8.2 | 2022-04-01 | An Out of Bounds read may potentially occur while processing an IBSS beacon, in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consum… |
CVE-2021-35115 | High | 8.4 | 2022-04-01 | Improper handling of multiple session supported by PVM backend can lead to use after free in Snapdragon Auto, Snapdragon Mobile |
CVE-2021-35110 | High | 8.1 | 2022-04-01 | Possible buffer overflow to improper validation of hash segment of file while allocating memory in Snapdragon Connectivity, Snapdragon Mobile |
CVE-2021-35106 | High | 7.8 | 2022-04-01 | Possible out of bound read due to improper length calculation of WMI message. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consu… |
CVE-2021-35105 | High | 8.4 | 2022-04-01 | Possible out of bounds access due to improper input validation during graphics profiling in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapd… |
CVE-2021-35103 | High | 7.8 | 2022-04-01 | Possible out of bound write due to improper validation of number of timer values received from firmware while syncing timers in Snapdragon Auto, Snapdragon Com… |
CVE-2021-35089 | High | 8.4 | 2022-04-01 | Possible buffer overflow due to lack of input IB amount validation while processing the user command in Snapdragon Auto |
CVE-2021-35088 | High | 8.2 | 2022-04-01 | Possible out of bound read due to improper validation of IE length during SSID IE parse when channel is DFS in Snapdragon Auto, Snapdragon Compute, Snapdragon… |
CVE-2021-30333 | High | 7.8 | 2022-04-01 | Improper validation of buffer size input to the EFS file can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdra… |
CVE-2021-30332 | High | 7.5 | 2022-04-01 | Possible assertion due to improper validation of OTA configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT… |
CVE-2021-30331 | Medium | 5.5 | 2022-04-01 | Possible buffer overflow due to improper data validation of external commands sent via DIAG interface in Snapdragon Auto, Snapdragon Compute, Snapdragon Connec… |
CVE-2021-30329 | High | 7.5 | 2022-04-01 | Possible assertion due to improper validation of TCI configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT… |
CVE-2021-30328 | High | 7.5 | 2022-04-01 | Possible assertion due to improper validation of invalid NR CSI-IM resource configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snap… |
CVE-2021-1950 | High | 7.8 | 2022-04-01 | Improper cleaning of secure memory between authenticated users can lead to face authentication bypass in Snapdragon Auto, Snapdragon Compute, Snapdragon Connec… |
CVE-2021-1942 | Critical | 9.3 | 2022-04-01 | Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapd… |
CVE-2021-43722 | Critical | 9.8 | 2022-03-31 | D-Link DIR-645 1.03 A1 is vulnerable to Buffer Overflow. The hnap_main function in the cgibin handler uses sprintf to format the soapaction header onto the sta… |
CVE-2021-43707 | Medium | 6.1 | 2022-03-31 | Cross Site Scripting (XSS) vulnerability exists in Maccms v10 via link_Name parameter. |
CVE-2021-43479 | Critical | 9.8 | 2022-03-31 | A Remote Code Execution (RCE) vulnerability exists in The-Secretary 2.5 via install.php. |
CVE-2021-43484 | Critical | 9.8 | 2022-03-31 | A Remote Code Execution (RCE) vulnerability exists in Simple Client Management System 1.0 in create.php due to the failure to validate the extension of the fil… |
CVE-2021-43478 | Medium | 5.4 | 2022-03-31 | A vulnerability exists in Hoosk 1.8.0 in /install/index.php, due to a failure to check if config.php already exists in the root directory, which could let a ma… |
CVE-2021-37517 | High | 7.5 | 2022-03-31 | An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the application allows email… |
CVE-2021-42946 | Medium | 4.8 | 2022-03-31 | A Cross Site Scripting (XSS) vulnerability exists in htmly.2.8.1 via the Copyright field in the /admin/config page. |
CVE-2021-42869 | Medium | 4.8 | 2022-03-31 | A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 via the last_name parameter in the (1) patient/insert, (2) pati… |
CVE-2021-42868 | Medium | 4.8 | 2022-03-31 | A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 in the first_name parameter in (1) patient/insert, (2) patient_… |
CVE-2021-42867 | Medium | 4.8 | 2022-03-31 | A Cross Site Scripting (XSS) vulnerability exists in DanPros htmly 2.8.1 via the Description field in (1) admin/config, and (2) index.php pages. |
CVE-2021-42866 | Medium | 4.8 | 2022-03-31 | A Cross Site Scripting vulnerabilty exists in Pixelimity 1.0 via the Site Description field in pixelimity/admin/setting.php |
CVE-2021-36625 | High | 8.8 | 2022-03-31 | An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statemen… |
CVE-2021-43506 | Critical | 9.8 | 2022-03-31 | An SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the password parameter in Login.php. |
CVE-2021-43505 | Medium | 5.4 | 2022-03-31 | Multiple Cross Site Scripting (XSS) vulnerabilities exist in Ssourcecodester Simple Client Management System v1 via (1) Add new Client and (2) Add new invoice. |
CVE-2021-34257 | High | 8.8 | 2022-03-31 | Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) Pos… |
CVE-2021-20729 | Medium | 6.1 | 2022-03-31 | Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and… |
CVE-2021-43663 | High | 7.5 | 2022-03-31 | totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component cloudupdate_check. |
CVE-2021-43662 | Medium | 6.5 | 2022-03-31 | totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver V4.1.5cu.470_B20200911 have an issue which causes uncontrolled resource consumption. |
CVE-2021-43661 | Medium | 6.1 | 2022-03-31 | totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /home.asp. |
CVE-2021-46010 | High | 8.8 | 2022-03-30 | Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSION_ID is predictable. An attacker can hijack a… |
CVE-2021-46009 | Critical | 9.8 | 2022-03-30 | In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, admin configurations can be set without c… |
CVE-2021-46008 | High | 8.8 | 2022-03-30 | In totolink a3100r V5.9c.4577, the hard-coded telnet password can be discovered from official released firmware. An attacker, who has connected to the Wi-Fi, c… |
CVE-2021-46007 | Critical | 9.8 | 2022-03-30 | totolink a3100r V5.9c.4577 is vulnerable to os command injection. The backend of a page is executing the "ping" command, and the input field does not adequatel… |
CVE-2021-46006 | Medium | 6.5 | 2022-03-30 | In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple se… |
CVE-2021-43664 | High | 8.1 | 2022-03-30 | totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component process forceugpo. |
CVE-2021-33523 | High | 7.2 | 2022-03-30 | MashZone NextGen through 10.7 GA allows a remote authenticated user, with access to the admin console, to upload a new JDBC driver that can execute arbitrary c… |
CVE-2021-45900 | Medium | 6.5 | 2022-03-30 | Vivoh Webinar Manager before 3.6.3.0 has improper API authentication. When a user logs in to the administration configuration web portlet, a VIVOH_AUTH cookie… |
CVE-2021-43142 | Critical | 9.8 | 2022-03-30 | An XML External Entity (XXE) vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput. |
CVE-2021-38362 | Medium | 6.5 | 2022-03-30 | In RSA Archer 6.x through 6.9 SP3 (6.9.3.0), an authenticated attacker can make a GET request to a REST API endpoint that is vulnerable to an Insecure Direct O… |
CVE-2021-33581 | High | 7.2 | 2022-03-30 | MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP services, by abusing the feature to check the… |
CVE-2021-33208 | High | 7.2 | 2022-03-30 | The "Register an Ehcache Configuration File" admin feature in MashZone NextGen through 10.7 GA allows XXE attacks via a malicious XML configuration file. |
CVE-2021-40645 | Medium | 6.5 | 2022-03-30 | An SQL Injection vulnerability exists in glorylion JFinalOA as of 9/7/2021 in the defkey parameter getHaveDoneTaskDataList method of the FlowTaskController. |
CVE-2021-40644 | Medium | 6.5 | 2022-03-30 | An SQL Injection vulnerability exists in oasys oa_system as of 9/7/2021 in resources/mappers/notice-mapper.xml. |
CVE-2021-45031 | High | 7.7 | 2022-03-30 | A vulnerability in MEPSAN's USC+ before version 3.0 has a weakness in login function which lets attackers to generate high privileged accounts passwords. |
CVE-2021-44312 | High | 8.8 | 2022-03-30 | An issue was discovered in Firmware Analysis and Comparison Tool v3.2. Logged in administrators could be targeted by a CSRF attack through visiting a crafted w… |
CVE-2021-44310 | Medium | 4.8 | 2022-03-30 | An issue was discovered in Firmware Analysis and Comparison Tool v3.2. With administrator privileges, the attacker could perform stored XSS attacks by insertin… |
CVE-2021-3456 | High | 7.1 | 2022-03-30 | An improper authorization handling flaw was found in Foreman. The Salt plugin for the smart-proxy allows foreman clients to execute actions that should be limi… |
CVE-2021-39791 | Medium | 5.5 | 2022-03-30 | In WallpaperManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclo… |
CVE-2021-39790 | High | 7.8 | 2022-03-30 | In Dialer, there is a possible way to manipulate visual voicemail settings due to a missing permission check. This could lead to local escalation of privilege… |
CVE-2021-39789 | High | 7.8 | 2022-03-30 | In Telecom, there is a possible leak of TTY mode change due to a missing permission check. This could lead to local escalation of privilege with no additional… |
CVE-2021-39788 | Medium | 5.5 | 2022-03-30 | In TelecomManager, there is a possible way to check if a particular self managed phone account was registered on the device due to side channel information dis… |
CVE-2021-39787 | High | 7.8 | 2022-03-30 | In SystemUI, there is a possible arbitrary Activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execut… |