2021 CVEs (page 42)
Page 42 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-32478 | Medium | 6.1 | 2022-03-11 | The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3… |
CVE-2021-32477 | Medium | 4.3 | 2022-03-11 | The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administr… |
CVE-2021-32476 | High | 7.5 | 2022-03-11 | A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6… |
CVE-2021-32475 | Medium | 5.4 | 2022-03-11 | ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8… |
CVE-2021-32474 | High | 7.2 | 2022-03-11 | An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site adminis… |
CVE-2021-32473 | Medium | 5.3 | 2022-03-11 | It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8… |
CVE-2021-32472 | Medium | 4.3 | 2022-03-11 | Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6 and… |
CVE-2021-32009 | Medium | 5.0 | 2022-03-11 | Cross-site Scripting (XSS) vulnerability in firmware section of Secomea GateManager allows logged in user to inject javascript in browser session. This issue a… |
CVE-2021-27416 | Medium | 5.5 | 2022-03-11 | An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 by tri… |
CVE-2021-27414 | Medium | 5.5 | 2022-03-11 | An attacker could trick a user of Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 into visiting a mali… |
CVE-2021-26401 | Medium | 5.6 | 2022-03-11 | LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs. |
CVE-2021-26341 | Medium | 6.5 | 2022-03-11 | Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage. |
CVE-2021-23246 | High | 7.5 | 2022-03-11 | In ACE2 ColorOS11, the attacker can obtain the foreground package name through permission promotion, resulting in user information disclosure. |
CVE-2021-44620 | Critical | 9.8 | 2022-03-11 | A Command Injection vulnerability exits in TOTOLINK A3100R <=V4.1.2cu.5050_B20200504 in adm/ntm.asp via the hosTime parameters. |
CVE-2021-44618 | Critical | 9.8 | 2022-03-11 | A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header. |
CVE-2021-46708 | Medium | 6.1 | 2022-03-11 | The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit… |
CVE-2021-44585 | Medium | 6.1 | 2022-03-10 | A Cross Site Scripting (XSS) vulnerabilitiy exits in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event. |
CVE-2021-41233 | Medium | 6.5 | 2022-03-10 | Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is… |
CVE-2021-39025 | Medium | 5.3 | 2022-03-10 | IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 could disclose internal IP address information when the web backend is down. IBM X-Force 213863. |
CVE-2021-39022 | High | 8.8 | 2022-03-10 | IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or i… |
CVE-2021-38910 | Medium | 5.3 | 2022-03-10 | IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused by the improper validation of input. By… |
CVE-2021-44673 | High | 8.8 | 2022-03-10 | A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malicoius user upload a web shell script. |
CVE-2021-4095 | Medium | 5.5 | 2022-03-10 | A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacke… |
CVE-2021-4045 | Critical | 9.8 | 2022-03-10 | TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary runnin… |
CVE-2021-4023 | Medium | 5.5 | 2022-03-10 | A flaw was found in the io-workqueue implementation in the Linux kernel versions prior to 5.15-rc1. The kernel can panic when an improper cancellation operatio… |
CVE-2021-46408 | High | 7.5 | 2022-03-10 | Tenda AX12 v22.03.01.21 was discovered to contain a stack buffer overflow in the function sub_422CE4. This vulnerability allows attackers to cause a Denial of… |
CVE-2021-44750 | Medium | 6.4 | 2022-03-10 | An arbitrary code execution vulnerability was found in the F-Secure Support Tool. A standard user can craft a special configuration file, which when run by adm… |
CVE-2021-44632 | Critical | 9.8 | 2022-03-10 | A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/upgrade_info feature, which allows malicious users to… |
CVE-2021-44631 | Critical | 9.8 | 2022-03-10 | A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/reset_cloud_pwd feature, which allows malicous users… |
CVE-2021-44630 | Critical | 9.8 | 2022-03-10 | A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/modify_account_pwd feature, which allows malicious us… |
CVE-2021-44629 | Critical | 9.8 | 2022-03-10 | A Buffer Overflow vulnerabilitiy exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/register feature, which allows malicious users to ex… |
CVE-2021-44628 | Critical | 9.8 | 2022-03-10 | A Buffer Overflow vulnerabiltiy exists in TP-LINK WR-886N 20190826 2.3.8 in thee /cloud_config/router_post/login feature, which allows malicious users to execu… |
CVE-2021-44627 | Critical | 9.8 | 2022-03-10 | A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/get_reset_pwd_veirfy_code feature, which allows malic… |
CVE-2021-44626 | Critical | 9.8 | 2022-03-10 | A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/get_reg_verify_code feature, which allows malicious u… |
CVE-2021-44625 | Critical | 9.8 | 2022-03-10 | A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in /cloud_config/cloud_device/info interface, which allows a malicious user to execute… |
CVE-2021-44623 | Critical | 9.8 | 2022-03-10 | A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 via the /cloud_config/router_post/check_reset_pwd_verify_code interface. |
CVE-2021-44622 | Critical | 9.8 | 2022-03-10 | A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/check_reg_verify_code function which could let a remo… |
CVE-2021-44421 | Medium | 5.5 | 2022-03-10 | The pointer-validation logic in util/mem_util.rs in Occlum before 0.26.0 for Intel SGX acts as a confused deputy that allows a local attacker to access unautho… |
CVE-2021-44269 | Medium | 5.5 | 2022-03-10 | An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, taint… |
CVE-2021-44216 | Medium | 5.5 | 2022-03-10 | Northern.tech CFEngine Enterprise before 3.15.5 and 3.18.x before 3.18.1 has Insecure Permissions that may allow unauthorized local users to access the Apache… |
CVE-2021-44215 | Medium | 5.5 | 2022-03-10 | Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an unspecified impact. |
CVE-2021-44032 | High | 7.5 | 2022-03-10 | TP-Link Omada SDN Software Controller before 5.0.15 does not check if the authentication method specified in a connection request is allowed. An attacker can b… |
CVE-2021-43970 | High | 8.8 | 2022-03-10 | An arbitrary file upload vulnerability exists in albumimages.jsp in Quicklert for Digium 10.0.0 (1043) via a .mp3;.jsp filename for a file that begins with aud… |
CVE-2021-43969 | Medium | 6.5 | 2022-03-10 | The login.jsp page of Quicklert for Digium 10.0.0 (1043) is affected by both Blind SQL Injection with Out-of-Band Interaction (DNS) and Blind Time-Based SQL In… |
CVE-2021-42857 | Medium | 5.3 | 2022-03-10 | It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDaServlet has directory traversal vulnerabilities at the "/api/appInte… |
CVE-2021-42856 | Medium | 4.7 | 2022-03-10 | It was discovered that the /DsaDataTest endpoint is susceptible to Cross-site scripting (XSS) attack. It was noted that the Metric parameter does not have any… |
CVE-2021-42855 | High | 7.8 | 2022-03-10 | It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a… |
CVE-2021-42854 | Critical | 9.8 | 2022-03-10 | It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) PluginServlet has directory traversal vulnerabilities at the "/api/appInter… |
CVE-2021-42853 | Critical | 9.1 | 2022-03-10 | It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDiagnosticServlet has directory traversal vulnerability at the "/api/a… |
CVE-2021-42787 | Critical | 9.4 | 2022-03-10 | It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentConfigurationServlet has directory traversal vulnerabilities at the "/… |
CVE-2021-42786 | Critical | 9.8 | 2022-03-10 | It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) has Remote Code Execution vulnerabilities in multiple instances of the API re… |
CVE-2021-41657 | Medium | 6.1 | 2022-03-10 | SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clickjacking attack. |
CVE-2021-40376 | High | 7.8 | 2022-03-10 | otris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated calls to exposed interfaces over a .NET named pipe. A remote attac… |
CVE-2021-40064 | High | 7.5 | 2022-03-10 | There is a heap-based buffer overflow vulnerability in system components. Successful exploitation of this vulnerability may affect system stability. |
CVE-2021-40063 | High | 7.5 | 2022-03-10 | There is an improper access control vulnerability in the video module. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2021-40062 | High | 7.5 | 2022-03-10 | There is a vulnerability of copying input buffer without checking its size in the video framework. Successful exploitation of this vulnerability may affect ava… |
CVE-2021-40061 | High | 7.5 | 2022-03-10 | There is a vulnerability of accessing resources using an incompatible type (type confusion) in the Bastet module. Successful exploitation of this vulnerability… |
CVE-2021-40060 | High | 7.5 | 2022-03-10 | There is a heap-based buffer overflow vulnerability in the video framework. Successful exploitation of this vulnerability may affect availability. |
CVE-2021-40059 | Medium | 6.5 | 2022-03-10 | There is a permission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2021-40058 | High | 7.5 | 2022-03-10 | There is a heap-based buffer overflow vulnerability in the video framework. Successful exploitation of this vulnerability may affect availability. |
CVE-2021-40057 | High | 7.5 | 2022-03-10 | There is a heap-based and stack-based buffer overflow vulnerability in the video framework. Successful exploitation of this vulnerability may affect availabili… |
CVE-2021-40056 | High | 7.5 | 2022-03-10 | There is a vulnerability of copying input buffer without checking its size in the video framework. Successful exploitation of this vulnerability may affect ava… |
CVE-2021-40055 | Medium | 5.9 | 2022-03-10 | There is a man-in-the-middle attack vulnerability during system update download in recovery mode. Successful exploitation of this vulnerability may affect inte… |
CVE-2021-40054 | High | 7.5 | 2022-03-10 | There is an integer underflow vulnerability in the atcmdserver module. Successful exploitation of this vulnerability may affect integrity. |
CVE-2021-40053 | Critical | 9.1 | 2022-03-10 | There is a permission control vulnerability in the Nearby module.Successful exploitation of this vulnerability will affect availability and integrity. |
CVE-2021-40052 | High | 7.5 | 2022-03-10 | There is an incorrect buffer size calculation vulnerability in the video framework.Successful exploitation of this vulnerability may affect availability. |
CVE-2021-40051 | High | 7.5 | 2022-03-10 | There is an unauthorized access vulnerability in system components. Successful exploitation of this vulnerability will affect confidentiality. |
CVE-2021-40050 | Critical | 9.8 | 2022-03-10 | There is an out-of-bounds read vulnerability in the IFAA module. Successful exploitation of this vulnerability may cause stack overflow. |
CVE-2021-40049 | High | 7.5 | 2022-03-10 | There is a permission control vulnerability in the PMS module. Successful exploitation of this vulnerability can lead to sensitive system information being obt… |
CVE-2021-40048 | High | 7.5 | 2022-03-10 | There is an incorrect buffer size calculation vulnerability in the video framework. Successful exploitation of this vulnerability will affect availability. |
CVE-2021-40047 | High | 7.5 | 2022-03-10 | There is a vulnerability of memory not being released after effective lifetime in the Bastet module. Successful exploitation of this vulnerability may affect i… |
CVE-2021-3981 | Low | 3.3 | 2022-03-10 | A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read… |
CVE-2021-3739 | High | 7.1 | 2022-03-10 | A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux Kernel, where triggering the bug requires ‘CAP_SYS… |
CVE-2021-3733 | Medium | 6.5 | 2022-03-10 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects… |
CVE-2021-3732 | Medium | 5.5 | 2022-03-10 | A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user mounts the TmpFS filesystem with OverlayFS. This flaw allows a local user to gai… |
CVE-2021-3698 | High | 7.5 | 2022-03-10 | A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD)… |
CVE-2021-3660 | Medium | 4.3 | 2022-03-10 | Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside… |
CVE-2021-35251 | Medium | 5.3 | 2022-03-10 | Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details about the Web… |
CVE-2021-34342 | Medium | 6.5 | 2022-03-10 | Ming 0.4.8 has an out-of-bounds read vulnerability in the function newVar_N() in decompile.c which causes a huge information leak. |
CVE-2021-34341 | Medium | 6.5 | 2022-03-10 | Ming 0.4.8 has an out-of-bounds read vulnerability in the function decompileIF() in the decompile.c file that causes a direct segmentation fault and leads to d… |
CVE-2021-34340 | Medium | 6.5 | 2022-03-10 | Ming 0.4.8 has an out-of-bounds buffer access issue in the function decompileINCR_DECR() in decompiler.c file that causes a direct segmentation fault and leads… |
CVE-2021-34339 | Medium | 6.5 | 2022-03-10 | Ming 0.4.8 has an out-of-bounds buffer access issue in the function getString() in decompiler.c file that causes a direct segmentation fault and leads to denia… |
CVE-2021-34338 | Medium | 6.5 | 2022-03-10 | Ming 0.4.8 has an out-of-bounds buffer overwrite issue in the function getName() in decompiler.c file that causes a direct segmentation fault and leads to deni… |
CVE-2021-34122 | Medium | 5.5 | 2022-03-10 | The function bitstr_tell at bitstr.c in ffjpeg commit 4ab404e has a NULL pointer dereference. |
CVE-2021-33852 | Medium | 5.4 | 2022-03-10 | A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack… |
CVE-2021-33851 | Medium | 5.4 | 2022-03-10 | A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack… |
CVE-2021-33293 | Critical | 9.1 | 2022-03-10 | Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine() in parser.c. |
CVE-2021-32436 | Medium | 6.5 | 2022-03-10 | An out-of-bounds read in the function write_title() in subs.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via unspecified ve… |
CVE-2021-32435 | Medium | 5.5 | 2022-03-10 | Stack-based buffer overflow in the function get_key in parse.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via unspecified v… |
CVE-2021-32434 | Medium | 5.5 | 2022-03-10 | abcm2ps v8.14.11 was discovered to contain an out-of-bounds read in the function calculate_beam at draw.c. |
CVE-2021-32025 | High | 8.1 | 2022-03-10 | An elevation of privilege vulnerability in the QNX Neutrino Kernel of affected versions of QNX Software Development Platform version(s) 6.4.0 to 7.0, QNX Momen… |
CVE-2021-32006 | Medium | 5.0 | 2022-03-10 | This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Permission Issues vulnerability in LinkManager web portal of Secomea Gate… |
CVE-2021-32005 | Medium | 6.5 | 2022-03-10 | Cross-site Scripting (XSS) vulnerability in log view of Secomea SiteManager allows a logged in user to store javascript for later execution. This issue affects… |
CVE-2021-28488 | Medium | 6.5 | 2022-03-10 | Ericsson Network Manager (ENM) before 21.2 has incorrect access-control behavior (that only affects the level of access available to persons who were already g… |
CVE-2021-20269 | Medium | 5.5 | 2022-03-10 | A flaw was found in the permissions of a log file created by kexec-tools. This flaw allows a local unprivileged user to read this file and leak kernel internal… |
CVE-2021-38296 | High | 7.5 | 2022-03-10 | Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it u… |
CVE-2021-22783 | High | 8.8 | 2022-03-09 | A CWE-200: Information Exposure vulnerability exists which could allow a session hijack when the door panel is communicating with the door. Affected Product: R… |
CVE-2021-36777 | High | 8.1 | 2022-03-09 | A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a… |
CVE-2021-41241 | Medium | 4.3 | 2022-03-08 | Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a gr… |
CVE-2021-41239 | Medium | 5.3 | 2022-03-08 | Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumerati… |