2021 CVEs (page 4)
Page 4 of 235 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-47709 | | 2025-12-09 | COMMAX Smart Home System allows an unauthenticated attacker to change configuration and cause denial-of-service through the setconf endpoint. Attackers can tri… | |
CVE-2021-47708 | | 2025-12-09 | COMMAX Smart Home System CDP-1020n contains an SQL injection vulnerability that allows attackers to bypass authentication by injecting arbitrary SQL code throu… | |
CVE-2021-47707 | | 2025-12-09 | COMMAX CVD-Axx DVR 5.1.4 contains weak default administrative credentials that allow remote password attacks and disclose RTSP stream. Attackers can exploit th… | |
CVE-2021-47706 | | 2025-12-09 | COMMAX Biometric Access Control System 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access sensitive informat… | |
CVE-2021-47705 | | 2025-12-09 | COMMAX UMS Client ActiveX Control 1.7.0.2 contains a heap-based buffer overflow vulnerability that allows attackers to execute arbitrary code by providing exce… | |
CVE-2021-47704 | Medium | 6.5 | 2025-12-09 | OpenBMCS 2.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting arbitrary SQL code. Attack… |
CVE-2021-47703 | High | 7.2 | 2025-12-09 | OpenBMCS 2.4 contains an unauthenticated SSRF vulnerability that allows attackers to bypass firewalls and initiate service and network enumeration on the inter… |
CVE-2021-47702 | Medium | 4.3 | 2025-12-09 | OpenBMCS 2.4 contains a CSRF vulnerability that allows attackers to perform actions with administrative privileges by exploiting the sendFeedback.php endpoint… |
CVE-2021-47701 | High | 8.8 | 2025-12-09 | OpenBMCS 2.4 allows an attacker to escalate privileges from a read user to an admin user by manipulating permissions and exploiting a vulnerability in the upda… |
CVE-2021-4472 | Medium | 6.5 | 2025-11-26 | The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbi… |
CVE-2021-4471 | | 2025-11-14 | TG8 Firewall exposes a directory such as /data/ over HTTP without authentication. This directory stores credential files for previously logged-in users. A remo… | |
CVE-2021-4470 | | 2025-11-14 | TG8 Firewall contains a pre-authentication remote code execution vulnerability in the runphpcmd.php endpoint. The syscmd POST parameter is passed directly to a… | |
CVE-2021-4469 | | 2025-11-14 | Denver SHO-110 IP cameras expose a secondary HTTP service on TCP port 8001 that provides access to a '/snapshot' endpoint without authentication. While the pri… | |
CVE-2021-4468 | | 2025-11-14 | PLANEX CS-QP50F-ING2 smart cameras expose a configuration backup interface over HTTP that does not require authentication. A remote, unauthenticated attacker c… | |
CVE-2021-4467 | | 2025-11-14 | Positive Technologies MaxPatrol 8 and XSpider contain a remote denial-of-service vulnerability in the client communication service on TCP port 2002. The servic… | |
CVE-2021-4466 | | 2025-11-14 | IPCop versions up to and including 2.1.9 contain an authenticated remote code execution vulnerability within the web-based administration interface. The email… | |
CVE-2021-4465 | | 2025-11-14 | ReQuest Serious Play F3 Media Server versions 7.0.3.4968 (Pro), 7.0.2.4954, 6.5.2.4954, 6.4.2.4681, 6.3.2.4203, and 2.0.1.823 contain a remote denial-of-servic… | |
CVE-2021-4464 | | 2025-11-12 | FiberHome AN5506-04-FA firmware versions up to and including RP2631 and HG6245D prior to RP2602 contain a stack-based buffer overflow, as the HTTP service ('we… | |
CVE-2021-4463 | | 2025-11-12 | Longjing Technology BEMS API versions up to and including 1.21 contains an unauthenticated arbitrary file download vulnerability in the 'downloads' endpoint. T… | |
CVE-2021-4462 | Critical | 9.8 | 2025-11-10 | Employee Records System version 1.0 contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload arbitrary files… |
CVE-2021-47698 | Medium | 5.4 | 2025-11-03 | Nagios XI versions prior to 5.8.7 using embedded Nagios Core are vulnerable to cross-site scripting (XSS) via the Core UI’s Views URL handling (escape_string()… |
CVE-2021-4461 | | 2025-10-30 | Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1 improperly decode and parse the `enc` parameter in thirdpartyController.do. The d… | |
CVE-2021-47700 | High | 7.8 | 2025-10-30 | Nagios XI versions prior to 5.8.7 used a temporary directory for Highcharts exports with overly permissive ownership/permissions under the Apache user. Local o… |
CVE-2021-47699 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.8.7 are vulnerable to cross-site scripting (XSS) via the Audit Log page’s Send to NLS form. Insufficient validation or escaping o… |
CVE-2021-47697 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.8.0 are vulnerable to cross-site scripting (XSS) via the Views feature URL handling. Insufficient validation or escaping of user-… |
CVE-2021-47696 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.8.0 are vulnerable to cross-site scripting (XSS) via BPI config ID handling. Insufficient validation or escaping of user-supplied… |
CVE-2021-47695 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.8.0 are vulnerable to stored cross-site scripting (XSS) via the My Tools page. Insufficient validation or escaping of user-suppli… |
CVE-2021-47694 | Medium | 6.1 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.4 / Nagios XI 5.8.6 contains a reflected cross-site scripting (XSS) vulnerability via the… |
CVE-2021-47693 | High | 8.8 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.3 / Nagios XI 5.8.5 contains a SQL injection vulnerability in the search text handling. Un… |
CVE-2021-47691 | Medium | 5.4 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.1 / Nagios XI 5.8.2 contains multiple cross-site scripting (XSS) vulnerabilities via the S… |
CVE-2021-47690 | Medium | 5.4 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.1 / Nagios XI 5.8.2 contains multiple cross-site scripting (XSS) vulnerabilities in Overla… |
CVE-2021-47689 | Medium | 5.4 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.0 / Nagios XI 5.8.0 contais a cross-site scripting (XSS) vulnerability in the Templates pa… |
CVE-2021-43768 | Medium | 5.3 | 2025-10-24 | In Malwarebytes For Teams v.1.0.990 and before and fixed in v.1.0.1003 and later a privilege escalation can occur via the COM interface running in mbamservice… |
CVE-2021-22291 | High | 8.0 | 2025-10-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ABB EIBPORT V3 KNX, ABB EIBPORT V3 KNX GSM.This is… |
CVE-2021-42193 | Medium | 6.1 | 2025-10-03 | nopCommerce 4.40.3 is vulnerable to XSS in the Product Name at /Admin/Product/Edit/[id]. Each time a user views the product in the shop, the XSS payload fires. |
CVE-2021-4460 | High | 7.1 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix UBSAN shift-out-of-bounds warning If get_num_sdma_queues or get_num_xgmi_… |
CVE-2021-46750 | Low | 3.0 | 2025-09-06 | Failure to validate the address and size in TEE (Trusted Execution Environment) may allow a malicious x86 attacker to send malformed messages to the graphics m… |
CVE-2021-26377 | Medium | 4.1 | 2025-09-06 | Insufficient parameter validation while allocating process space in the Trusted OS (TOS) may allow for a malicious userspace process to trigger an integer over… |
CVE-2021-26383 | High | 7.9 | 2025-09-06 | Insufficient bounds checking in AMD TEE (Trusted Execution Environment) could allow an attacker with a compromised userspace to invoke a command with malformed… |
CVE-2021-4459 | Medium | 6.5 | 2025-08-27 | An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected… |
CVE-2021-4458 | Medium | 5.9 | 2025-07-12 | The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wp_ajax_mec_load_single_page' AJAX action in… |
CVE-2021-27961 | Medium | 6.5 | 2025-07-09 | evesys 7.1 (2152) through 8.0 (2202) allows Reflected XSS via the indexeva.php action parameter. |
CVE-2021-4457 | Critical | 9.1 | 2025-06-25 | The ZoomSounds plugin before 6.05 contains a PHP file allowing unauthenticated users to upload an arbitrary file anywhere on the web server. |
CVE-2021-41691 | Critical | 9.8 | 2025-06-24 | A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST requ… |
CVE-2021-47688 | Medium | 5.7 | 2025-06-23 | In WhiteBeam 0.2.0 through 0.2.1 before 0.2.2, a user with local access to a server can bypass the allow-list functionality because a file can be truncated in… |
CVE-2021-25262 | Medium | 5.4 | 2025-05-21 | Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack. |
CVE-2021-25255 | High | 7.5 | 2025-05-21 | Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service. |
CVE-2021-25254 | Medium | 5.3 | 2025-05-21 | Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar. |
CVE-2021-47664 | Medium | 5.3 | 2025-04-24 | Due to improper authentication mechanism an unauthenticated remote attacker can enumerate valid usernames. |
CVE-2021-47663 | High | 8.1 | 2025-04-24 | Due to improper JSON Web Tokens implementation an unauthenticated remote attacker can guess a valid session ID and therefore impersonate a user to gain full ac… |
CVE-2021-47662 | High | 7.5 | 2025-04-24 | Due to missing authorization an unauthenticated remote attacker can cause a DoS attack by connecting via HTTPS and triggering the shutdown button. |
CVE-2021-4455 | Critical | 9.8 | 2025-04-19 | The Wordpress Plugin Smart Product Review plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up t… |
CVE-2021-47671 | Low | 3.3 | 2025-04-17 | In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path In es58x_rx_err_msg()… |
CVE-2021-47670 | High | 8.8 | 2025-04-17 | In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix use after free bugs After calling peak_usb_netif_rx_ni(skb), dereferen… |
CVE-2021-47669 | High | 7.8 | 2025-04-17 | In the Linux kernel, the following vulnerability has been resolved: can: vxcan: vxcan_xmit: fix use after free bug After calling netif_rx_ni(skb), dereferenc… |
CVE-2021-47668 | High | 8.8 | 2025-04-17 | In the Linux kernel, the following vulnerability has been resolved: can: dev: can_restart: fix use after free bug After calling netif_rx_ni(skb), dereferenci… |
CVE-2021-27289 | Critical | 9.1 | 2025-04-15 | A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v1.0.3, Door Sensor = v1.0.7, Motion Sens… |
CVE-2021-47667 | Critical | 10.0 | 2025-04-05 | An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackers to execute arbit… |
CVE-2021-24008 | Medium | 5.3 | 2025-03-28 | An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, vers… |
CVE-2021-4454 | High | 7.5 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate The conclusion "j1939_ses… |
CVE-2021-26105 | Medium | 6.8 | 2025-03-24 | A stack-based buffer overflow vulnerability (CWE-121) in the profile parser of FortiSandbox version 3.2.2 and below, version 3.1.4 and below may allow an authe… |
CVE-2021-26091 | High | 7.5 | 2025-03-24 | A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service of FortiMail 6.4.0… |
CVE-2021-25635 | Medium | 5.5 | 2025-03-21 | An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, t… |
CVE-2021-32584 | Medium | 5.3 | 2025-03-17 | An improper access control (CWE-284) vulnerability in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 and below, versio… |
CVE-2021-26087 | Medium | 4.3 | 2025-03-17 | An improper neutralization of input during web page generation in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 web i… |
CVE-2021-22126 | Medium | 6.7 | 2025-03-17 | A use of hard-coded password vulnerability in FortiWLC version 8.5.2 and below, version 8.4.8 and below, version 8.3.3 to 8.3.2, version 8.2.7 to 8.2.6 may all… |
CVE-2021-37787 | Medium | 6.5 | 2025-03-11 | The unprivileged administrative interface in ABO.CMS version 5.8 through v.5.9.3 is affected by a SQL Injection vulnerability via a HTTP POST request to the Ti… |
CVE-2021-41719 | High | 7.5 | 2025-03-04 | Maharashtra State Electricity Distribution Company Limited Mahavitran IOS Application 16.1 application till version 16.1 communicates using the GET method to p… |
CVE-2021-4453 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix a potential gpu_metrics_table memory leak Memory is allocated for gpu_met… |
CVE-2021-47660 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()' All error han… |
CVE-2021-47659 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: drm/plane: Move range check for format_count earlier While the check for format_count > 6… |
CVE-2021-47658 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix a potential gpu_metrics_table memory leak Memory is allocated for gpu_met… |
CVE-2021-47657 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free() If virtio_gpu_obj… |
CVE-2021-47656 | High | 7.8 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: jffs2: fix use-after-free in jffs2_clear_xattr_subsystem When we mount a jffs2 image, ass… |
CVE-2021-47655 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: media: venus: vdec: fixed possible memory leak issue The venus_helper_alloc_dpb_bufs() im… |
CVE-2021-47654 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: samples/landlock: Fix path_list memory leak Clang static analysis reports this error san… |
CVE-2021-47653 | High | 7.8 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: media: davinci: vpif: fix use-after-free on driver unbind The driver allocates and regist… |
CVE-2021-47652 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() I got a null-ptr-deref repor… |
CVE-2021-47651 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: soc: qcom: rpmpd: Check for null return of devm_kcalloc Because of the possible failure o… |
CVE-2021-47650 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-compress: prevent the potentially use of null pointer There is one call trace t… |
CVE-2021-47649 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: udmabuf: validate ubuf->pagecount Syzbot has reported GPF in sg_alloc_append_table_from_p… |
CVE-2021-47648 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix a memory leak in 'host1x_remove()' Add a missing 'host1x_channel_list_fr… |
CVE-2021-47647 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: clk: qcom: ipq8074: fix PCI-E clock oops Fix PCI-E clock related kernel oops that are cau… |
CVE-2021-47646 | High | 7.8 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: Revert "Revert "block, bfq: honor already-setup queue merges"" A crash [1] happened to be… |
CVE-2021-47645 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com O… |
CVE-2021-47644 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: media: staging: media: zoran: move videodev alloc Move some code out of zr36057_init() an… |
CVE-2021-47643 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: media: ir_toy: free before error exiting Fix leak in error path. |
CVE-2021-47642 | High | 7.8 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow Coverity complains of a… |
CVE-2021-47641 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: video: fbdev: cirrusfb: check pixclock to avoid divide by zero Do a sanity check on pixcl… |
CVE-2021-47640 | High | 7.8 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: powerpc/kasan: Fix early region not updated correctly The shadow's page table is not upda… |
CVE-2021-47639 | High | 7.8 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU Zap both valid and inva… |
CVE-2021-47638 | High | 7.8 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: ubifs: rename_whiteout: Fix double free for whiteout_ui->data 'whiteout_ui->data' will be… |
CVE-2021-47637 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix deadlock in concurrent rename whiteout and inode writeback Following hung task… |
CVE-2021-47636 | High | 7.1 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() Function ubifs_wbuf_write_nolo… |
CVE-2021-47635 | High | 7.8 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix to add refcount once page is set private MM defined the rule [1] very clearly… |
CVE-2021-47634 | High | 7.8 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl Hulk Robot reported a… |
CVE-2021-47633 | High | 7.1 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 The bug was found during fuzzing. Stac… |
CVE-2021-47632 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: powerpc/set_memory: Avoid spinlock recursion in change_page_attr() Commit 1f9ad21c3b38 ("… |
CVE-2021-47631 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: ARM: davinci: da850-evm: Avoid NULL pointer dereference With newer versions of GCC, there… |
CVE-2021-46686 | Critical | 9.8 | 2025-02-18 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in acmailer CGI ver.4.0.3 and earlier and acmailer DB v… |