2021 CVEs (page 40)
Page 40 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-36100 | Medium | 6.4 | 2022-03-21 | Specially crafted string in OTRS system configuration can allow the execution of any system command. |
CVE-2021-42194 | High | 7.2 | 2022-03-20 | The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ String function, whic… |
CVE-2021-39384 | Critical | 9.8 | 2022-03-20 | DWSurvey v3.2.0 was discovered to contain an arbitrary file write vulnerability via the component /utils/ToHtmlServlet.java. |
CVE-2021-39383 | Critical | 9.8 | 2022-03-20 | DWSurvey v3.2.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /sysuser/SysPropertyAction.java. |
CVE-2021-44345 | High | 7.5 | 2022-03-20 | Beijing Wisdom Vision Technology Industry Co., Ltd One Card Integrated Management System 3.0 is vulnerable to SQL Injection. |
CVE-2021-4031 | High | 7.5 | 2022-03-18 | Syltek application before its 10.22.00 version, does not correctly check that a product ID has a valid payment associated to it. This could allow an attacker t… |
CVE-2021-44760 | Medium | 4.8 | 2022-03-18 | Auth. (admin+) Reflected Cross-Site Scripting (XSS) vulnerability discovered in WP-DownloadManager plugin <= 1.68.6 versions. |
CVE-2021-30771 | High | 7.8 | 2022-03-18 | An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.4, iOS 14.6 and iPadOS 14.6, watchOS 7.5, tvOS 14… |
CVE-2021-27789 | Medium | 6.5 | 2022-03-18 | The Web application of Brocade Fabric OS before versions Brocade Fabric OS v9.0.1a and v8.2.3a contains debug statements that expose sensitive information to t… |
CVE-2021-23209 | Medium | 4.8 | 2022-03-18 | Multiple Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) vulnerabilities discovered in AMP for WP – Accelerated Mobile Pages WordPress pl… |
CVE-2021-23150 | Medium | 4.8 | 2022-03-18 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 versions. |
CVE-2021-39046 | Medium | 4.9 | 2022-03-18 | IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can… |
CVE-2021-29899 | Medium | 6.5 | 2022-03-18 | IBM Engineering Requirements Quality Assistant prior to 3.1.3 could allow an authenticated user to cause a denial of service. IBM X-Force ID: 207413. |
CVE-2021-45835 | Critical | 9.8 | 2022-03-18 | The Online Admission System 1.0 allows an unauthenticated attacker to upload or transfer files of dangerous types to the application through documents.php, whi… |
CVE-2021-45834 | Critical | 9.8 | 2022-03-18 | An attacker can upload or transfer files of dangerous types to the OpenDocMan 1.4.4 portal via add.php using MIME-bypass, which may be automatically processed… |
CVE-2021-22571 | Medium | 5.5 | 2022-03-18 | A local attacker could read files from some other users' SA360 reports stored in the /tmp folder during staging process before the files are loaded in BigQuery… |
CVE-2021-45868 | Medium | 5.5 | 2022-03-18 | In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk). This can, for example, lead to a kerne… |
CVE-2021-45968 | High | 7.5 | 2022-03-18 | An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.20.x (and in other p… |
CVE-2021-45967 | Critical | 9.8 | 2022-03-18 | An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal i… |
CVE-2021-45966 | Critical | 9.8 | 2022-03-18 | An issue was discovered in Pascom Cloud Phone System before 7.20.x. In the management REST API, /services/apply in exd.pl allows remote attackers to execute ar… |
CVE-2021-44088 | Critical | 9.8 | 2022-03-17 | An SQL Injection vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows a remote attacker to bypass authentication via unsaniti… |
CVE-2021-44087 | Critical | 9.8 | 2022-03-17 | A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows an unauthenticated remote attacker to uplo… |
CVE-2021-43961 | Medium | 4.3 | 2022-03-17 | Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection. |
CVE-2021-46107 | High | 7.5 | 2022-03-17 | Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to Server Side Request Forgery (SSRF) which allows an attacker to read any documents via the downloa… |
CVE-2021-45040 | Critical | 9.8 | 2022-03-17 | The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route. |
CVE-2021-44906 | Critical | 9.8 | 2022-03-17 | Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95). |
CVE-2021-44262 | High | 7.5 | 2022-03-17 | A vulnerability is in the 'MNU_top.htm' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access this page without any a… |
CVE-2021-44261 | Medium | 5.3 | 2022-03-17 | A vulnerability is in the 'BRS_top.html' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access this page without any… |
CVE-2021-44260 | High | 7.5 | 2022-03-17 | A vulnerability is in the 'live_mfg.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacker to access this pa… |
CVE-2021-44259 | Critical | 9.8 | 2022-03-17 | A vulnerability is in the 'wx.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacker to access this page wit… |
CVE-2021-45794 | High | 7.5 | 2022-03-17 | Slims9 Bulian 9.4.2 is affected by SQL injection in /admin/modules/system/backup.php. User data can be obtained. |
CVE-2021-45793 | High | 7.5 | 2022-03-17 | Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained. |
CVE-2021-44908 | Critical | 9.8 | 2022-03-17 | SailsJS Sails.js <=1.4.0 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules(). |
CVE-2021-23771 | Medium | 6.5 | 2022-03-17 | This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. T… |
CVE-2021-23632 | Medium | 6.6 | 2022-03-17 | All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS comma… |
CVE-2021-23556 | Medium | 6.4 | 2022-03-17 | The package guake before 3.8.5 are vulnerable to Exposed Dangerous Method or Function due to the exposure of execute_command and execute_command_by_uuid method… |
CVE-2021-45792 | Medium | 4.8 | 2022-03-17 | Slims9 Bulian 9.4.2 is affected by Cross Site Scripting (XSS) in /admin/modules/system/custom_field.php. |
CVE-2021-45791 | High | 8.8 | 2022-03-17 | Slims8 Akasia 8.3.1 is affected by SQL injection in /admin/modules/bibliography/index.php, /admin/modules/membership/member_type.php, /admin/modules/system/use… |
CVE-2021-42219 | High | 7.5 | 2022-03-17 | Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amount of messages to… |
CVE-2021-45822 | Medium | 6.1 | 2022-03-16 | A cross-site scripting vulnerability is present in Xbtit 3.1. The stored XSS vulnerability occurs because /ajaxchat/sendChatData.php does not properly validate… |
CVE-2021-23648 | Medium | 5.4 | 2022-03-16 | The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function. |
CVE-2021-45821 | High | 8.8 | 2022-03-16 | A blind SQL injection vulnerability exists in Xbtit 3.1 via the sid parameter in ajaxchat/getHistoryChatData.php file that is accessible by a registered user… |
CVE-2021-42730 | High | 7.8 | 2022-03-16 | Adobe Bridge version 11.1.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious PSD file, potentially result… |
CVE-2021-42729 | High | 7.8 | 2022-03-16 | Adobe Bridge version 11.1.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially result… |
CVE-2021-42728 | High | 7.8 | 2022-03-16 | Adobe Bridge 11.1.1 (and earlier) is affected by a stack overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary… |
CVE-2021-42724 | High | 7.8 | 2022-03-16 | Adobe Bridge version 11.1.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, potentially resulting… |
CVE-2021-42722 | High | 7.8 | 2022-03-16 | Adobe Bridge version 11.1.1 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the… |
CVE-2021-42720 | High | 7.8 | 2022-03-16 | Adobe Bridge version 11.1.1 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the… |
CVE-2021-42719 | High | 7.8 | 2022-03-16 | Adobe Bridge version 11.1.1 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted .jpe file, which could result in a read pas… |
CVE-2021-42533 | High | 7.8 | 2022-03-16 | Adobe Bridge version 11.1.1 (and earlier) is affected by a double free vulnerability when parsing a crafted DCM file, which could result in arbitrary code exec… |
CVE-2021-42527 | High | 7.8 | 2022-03-16 | Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, pot… |
CVE-2021-42526 | High | 7.8 | 2022-03-16 | Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, pot… |
CVE-2021-42264 | Medium | 5.5 | 2022-03-16 | Adobe Premiere Pro 15.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attac… |
CVE-2021-42263 | Medium | 5.5 | 2022-03-16 | Adobe Premiere Pro 15.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attac… |
CVE-2021-41987 | High | 8.1 | 2022-03-16 | In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code execution. The atta… |
CVE-2021-40796 | Medium | 5.5 | 2022-03-16 | Adobe Premiere Pro 15.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attac… |
CVE-2021-40794 | High | 7.8 | 2022-03-16 | Adobe Premiere Pro version 15.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, potentially resu… |
CVE-2021-40793 | High | 7.8 | 2022-03-16 | Adobe Premiere Pro version 15.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, potentially resu… |
CVE-2021-40792 | High | 7.8 | 2022-03-16 | Adobe Premiere Pro version 15.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, potentially resu… |
CVE-2021-40789 | Medium | 5.5 | 2022-03-16 | Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An… |
CVE-2021-40788 | Medium | 5.5 | 2022-03-16 | Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An… |
CVE-2021-40787 | High | 7.8 | 2022-03-16 | Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, pot… |
CVE-2021-40786 | High | 7.8 | 2022-03-16 | Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, pot… |
CVE-2021-40785 | Medium | 5.5 | 2022-03-16 | Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An… |
CVE-2021-40782 | Medium | 5.5 | 2022-03-16 | Adobe Media Encoder 15.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated atta… |
CVE-2021-40781 | Medium | 5.5 | 2022-03-16 | Adobe Media Encoder 15.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated atta… |
CVE-2021-40780 | High | 7.8 | 2022-03-16 | Adobe Media Encoder version 15.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, potentially res… |
CVE-2021-40779 | High | 7.8 | 2022-03-16 | Adobe Media Encoder version 15.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, potentially res… |
CVE-2021-40778 | Medium | 5.5 | 2022-03-16 | Adobe Media Encoder 15.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated atta… |
CVE-2021-40777 | High | 7.8 | 2022-03-16 | Adobe Media Encoder version 15.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, potentially res… |
CVE-2021-40769 | Low | 3.3 | 2022-03-16 | Adobe Character Animator version 4.4 (and earlier versions) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memo… |
CVE-2021-40768 | Medium | 5.5 | 2022-03-16 | Adobe Character Animator version 4.4 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenti… |
CVE-2021-40767 | Medium | 5.5 | 2022-03-16 | Adobe Character Animator version 4.4 (and earlier) is affected by an Access of Memory Location After End of Buffer vulnerability when parsing a specially craft… |
CVE-2021-40766 | Low | 3.3 | 2022-03-16 | Adobe Character Animator version 4.4 (and earlier versions) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memo… |
CVE-2021-40765 | High | 7.8 | 2022-03-16 | Adobe Character Animator version 4.4 (and earlier) is affected by a memory corruption vulnerability when parsing a M4A file, potentially resulting in arbitrary… |
CVE-2021-40764 | High | 7.8 | 2022-03-16 | Adobe Character Animator version 4.4 (and earlier) is affected by a memory corruption vulnerability when parsing a M4A file, potentially resulting in arbitrary… |
CVE-2021-40763 | High | 7.8 | 2022-03-16 | Adobe Character Animator version 4.4 (and earlier) is affected by a memory corruption vulnerability when parsing a WAF file, potentially resulting in arbitrary… |
CVE-2021-40762 | Medium | 5.5 | 2022-03-16 | Adobe Character Animator version 4.4 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenti… |
CVE-2021-40750 | Medium | 5.5 | 2022-03-16 | Adobe Bridge version 11.1.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated att… |
CVE-2021-40742 | Medium | 5.5 | 2022-03-16 | Adobe Audition version 14.4 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated att… |
CVE-2021-40741 | Medium | 5.5 | 2022-03-16 | Adobe Audition version 14.4 (and earlier) is affected by an Access of Memory Location After End of Buffer vulnerability when parsing a specially crafted file… |
CVE-2021-40740 | High | 7.8 | 2022-03-16 | Adobe Audition version 14.4 (and earlier) is affected by a memory corruption vulnerability when parsing a M4A file, potentially resulting in arbitrary code exe… |
CVE-2021-40739 | High | 7.8 | 2022-03-16 | Adobe Audition version 14.4 (and earlier) is affected by a memory corruption vulnerability when parsing a M4A file, potentially resulting in arbitrary code exe… |
CVE-2021-40738 | High | 7.8 | 2022-03-16 | Adobe Audition version 14.4 (and earlier) is affected by a memory corruption vulnerability when parsing a WAV file, potentially resulting in arbitrary code exe… |
CVE-2021-40737 | Medium | 5.5 | 2022-03-16 | Adobe Audition version 14.4 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated att… |
CVE-2021-40736 | High | 7.8 | 2022-03-16 | Adobe Audition version 14.4 (and earlier) is affected by a memory corruption vulnerability, potentially resulting in arbitrary code execution in the context of… |
CVE-2021-40735 | High | 7.8 | 2022-03-16 | Adobe Audition version 14.4 (and earlier) is affected by a memory corruption vulnerability, potentially resulting in arbitrary code execution in the context of… |
CVE-2021-40734 | High | 7.8 | 2022-03-16 | Adobe Audition version 14.4 (and earlier) is affected by a memory corruption vulnerability when parsing a SVG file, potentially resulting in arbitrary code exe… |
CVE-2021-39793 | High | 7.8 | 2022-03-16 | In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalati… |
CVE-2021-39792 | Medium | 4.1 | 2022-03-16 | In usb_gadget_giveback_request of core.c, there is a possible use after free out of bounds read due to a race condition. This could lead to local information d… |
CVE-2021-39737 | Critical | 9.8 | 2022-03-16 | Product: AndroidVersions: Android kernelAndroid ID: A-208229524References: N/A |
CVE-2021-39736 | Medium | 6.7 | 2022-03-16 | In prepare_io_entry and prepare_response of lwis_ioctl.c and lwis_periodic_io.c, there is a possible out of bounds write due to an integer overflow. This could… |
CVE-2021-39735 | Medium | 6.4 | 2022-03-16 | In gasket_alloc_coherent_memory of gasket_page_table.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of p… |
CVE-2021-39734 | High | 7.8 | 2022-03-16 | In sendMessage of OneToOneChatImpl.java (? TBD), there is a possible way to send an RCS message without permissions due to a missing permission check. This cou… |
CVE-2021-39733 | Medium | 6.7 | 2022-03-16 | In amcs_cdev_unlocked_ioctl of audiometrics.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of… |
CVE-2021-39732 | High | 7.8 | 2022-03-16 | In copy_io_entries of lwis_ioctl.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with n… |
CVE-2021-39731 | Medium | 6.7 | 2022-03-16 | In ProtocolStkProactiveCommandAdapter::Init of protocolstkadapter.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lea… |
CVE-2021-39730 | Medium | 4.4 | 2022-03-16 | In TBD of TBD, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2021-39729 | Medium | 6.7 | 2022-03-16 | In the TitanM chip, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System executi… |
CVE-2021-39727 | Medium | 4.1 | 2022-03-16 | In eicPresentationRetrieveEntryValue of acropora/app/identity/libeic/EicPresentation.c, there is a possible information disclosure due to a race condition. Thi… |