2021 CVEs (page 43)
Page 43 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-41181 | Low | 2.4 | 2022-03-08 | Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen s… |
CVE-2021-41180 | Medium | 4.7 | 2022-03-08 | Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud… |
CVE-2021-44478 | Medium | 6.1 | 2022-03-08 | A vulnerability has been identified in Polarion ALM (All versions < V21 R2 P2), Polarion WebClient for SVN (All versions). A cross-site scripting is present du… |
CVE-2021-42020 | High | 7.5 | 2022-03-08 | A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RU… |
CVE-2021-42019 | Medium | 5.9 | 2022-03-08 | A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RU… |
CVE-2021-42018 | Medium | 5.9 | 2022-03-08 | A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RU… |
CVE-2021-42017 | Medium | 5.9 | 2022-03-08 | A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2200, RUGG… |
CVE-2021-42016 | High | 7.5 | 2022-03-08 | A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2200, RUGG… |
CVE-2021-41543 | Medium | 6.5 | 2022-03-08 | A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The handling… |
CVE-2021-41542 | Medium | 6.1 | 2022-03-08 | A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The User Man… |
CVE-2021-41541 | Medium | 6.1 | 2022-03-08 | A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The Group Ma… |
CVE-2021-37209 | Medium | 6.7 | 2022-03-08 | A vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.8), RUGGEDCOM i801 (All versions < V4.3.8), RUGGEDCOM i802 (All versions < V4.3.8)… |
CVE-2021-37208 | Critical | 9.6 | 2022-03-08 | A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RU… |
CVE-2021-43944 | High | 7.2 | 2022-03-08 | This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of… |
CVE-2021-36809 | Medium | 6.1 | 2022-03-08 | A local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privileges, potentially resulting in a denial of service… |
CVE-2021-38989 | Medium | 5.5 | 2022-03-07 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Fo… |
CVE-2021-38988 | Medium | 5.5 | 2022-03-07 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Fo… |
CVE-2021-4199 | High | 7.8 | 2022-03-07 | Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe as used in Bitdefender Total Security, Interne… |
CVE-2021-4198 | Medium | 6.1 | 2022-03-07 | A NULL Pointer Dereference vulnerability in the messaging_ipc.dll component as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint… |
CVE-2021-25098 | Medium | 6.5 | 2022-03-07 | The Pricing Tables WordPress Plugin WordPress plugin before 3.1.3 does not verify the CSRF nonce when removing posts, allowing attackers to make a logged in ad… |
CVE-2021-25087 | High | 7.5 | 2022-03-07 | The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unauthenticated attacker… |
CVE-2021-25039 | Medium | 6.1 | 2022-03-07 | The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.0 does not sanitise and escape the wmcc_content_type, wmcc_source_blog and wmcc_reco… |
CVE-2021-25038 | Medium | 6.1 | 2022-03-07 | The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmus_source_blog and wmus_record_per_page parameters be… |
CVE-2021-25009 | Medium | 5.3 | 2022-03-07 | The CorreosExpress WordPress plugin through 2.6.0 generates log files which are publicly accessible, and contain sensitive information such as sender/receiver… |
CVE-2021-24961 | Medium | 5.4 | 2022-03-07 | The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 does not escape some of its shortcode argume… |
CVE-2021-24960 | Medium | 5.4 | 2022-03-07 | The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contribut… |
CVE-2021-24953 | Medium | 6.1 | 2022-03-07 | The Advanced iFrame WordPress plugin before 2022 does not sanitise and escape the ai_config_id parameter before outputting it back in an admin page, leading to… |
CVE-2021-24952 | High | 8.8 | 2022-03-07 | The Conversios.io WordPress plugin before 4.6.2 does not sanitise, validate and escape the sync_progressive_data parameter for the tvcajax_product_sync_bantch_… |
CVE-2021-24826 | Medium | 5.4 | 2022-03-07 | The Custom Content Shortcode WordPress plugin before 4.0.2 does not escape custom fields before outputting them, which could allow Contributor+ (v < 4.0.1) or… |
CVE-2021-24825 | Medium | 4.3 | 2022-03-07 | The Custom Content Shortcode WordPress plugin before 4.0.2 does not validate the data passed to its load shortcode, which could allow Contributor+ (v < 4.0.1)… |
CVE-2021-24824 | Medium | 4.3 | 2022-03-07 | The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, t… |
CVE-2021-24821 | Medium | 5.4 | 2022-03-07 | The Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the Descripti… |
CVE-2021-24810 | Medium | 4.8 | 2022-03-07 | The WP Event Manager WordPress plugin before 3.1.23 does not escape some of its Field Editor settings when outputting them, allowing high privilege users to pe… |
CVE-2021-24778 | High | 7.2 | 2022-03-07 | The test parameter of the xmlfeed in the Tradetracker-Store WordPress plugin before 4.6.60 is not sanitised, escaped or validated before inserting to a SQL sta… |
CVE-2021-24777 | High | 7.2 | 2022-03-07 | The view submission functionality in the Hotscot Contact Form WordPress plugin before 1.3 makes a get request with the sub_id parameter which not sanitised, es… |
CVE-2021-24216 | High | 7.2 | 2022-03-07 | The All-in-One WP Migration WordPress plugin before 7.41 does not validate uploaded files' extension, which allows administrators to upload PHP files on their… |
CVE-2021-44749 | Medium | 5.5 | 2022-03-06 | A vulnerability affecting F-Secure SAFE browser protection was discovered improper URL handling can be triggered to cause universal cross-site scripting throug… |
CVE-2021-44748 | Medium | 5.5 | 2022-03-06 | A vulnerability affecting F-Secure SAFE browser was discovered whereby browsers loads images automatically this vulnerability can be exploited remotely by an a… |
CVE-2021-46704 | Critical | 9.8 | 2022-03-06 | In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/pi… |
CVE-2021-46703 | Critical | 9.8 | 2022-03-06 | In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment (if… |
CVE-2021-46384 | Critical | 9.8 | 2022-03-04 | https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template… |
CVE-2021-46353 | Medium | 5.3 | 2022-03-04 | An information disclosure in web interface in D-Link DIR-X1860 before 1.03 RevA1 allows a remote unauthenticated attacker to send a specially crafted HTTP requ… |
CVE-2021-44827 | High | 8.8 | 2022-03-04 | There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the X_TP_ExternalIPv6Address HT… |
CVE-2021-40846 | High | 7.5 | 2022-03-04 | An issue was discovered in Rhinode Trading Paints through 2.0.36. TP Updater.exe uses cleartext HTTP to check, and request, updates. Thus, attackers can man-in… |
CVE-2021-32008 | Critical | 9.9 | 2022-03-04 | This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Improper Limitation of a Pathname to restricted directory, allows logged… |
CVE-2021-27756 | High | 7.5 | 2022-03-04 | "TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record… |
CVE-2021-43590 | Medium | 6.0 | 2022-03-04 | Dell EMC Enterprise Storage Analytics for vRealize Operations, versions 4.0.1 to 6.2.1, contain a Plain-text password storage vulnerability. A local high privi… |
CVE-2021-3737 | High | 7.5 | 2022-03-04 | A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to… |
CVE-2021-3656 | High | 8.8 | 2022-03-04 | A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provi… |
CVE-2021-27757 | High | 7.5 | 2022-03-04 | " Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to another control spher… |
CVE-2021-3575 | High | 7.8 | 2022-03-04 | A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to ex… |
CVE-2021-3428 | Medium | 5.5 | 2022-03-04 | A flaw was found in the Linux kernel. A denial of service problem is identified if an extent tree is corrupted in a crafted ext4 filesystem in fs/ext4/extents… |
CVE-2021-20319 | High | 7.8 | 2022-03-04 | An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature veri… |
CVE-2021-20303 | Medium | 6.1 | 2022-03-04 | A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit a crafted file to be processed by OpenEXR could trig… |
CVE-2021-20302 | Medium | 5.5 | 2022-03-04 | A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to be processed by Open… |
CVE-2021-20300 | Medium | 5.5 | 2022-03-04 | A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows an attacker who can submit a crafted file that is proc… |
CVE-2021-46382 | Medium | 6.1 | 2022-03-04 | Unauthenticated cross-site scripting (XSS) in Netgear WAC120 AC Access Point may lead to mulitple attacks like session hijacking even clipboard hijacking. |
CVE-2021-46381 | High | 7.5 | 2022-03-04 | Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow]. |
CVE-2021-46379 | Medium | 6.1 | 2022-03-04 | DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrusted site. |
CVE-2021-3744 | Medium | 5.5 | 2022-03-04 | A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denia… |
CVE-2021-3743 | High | 7.1 | 2022-03-04 | An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a local attacker to ga… |
CVE-2021-23214 | High | 8.1 | 2022-03-04 | When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject… |
CVE-2021-46378 | High | 7.5 | 2022-03-04 | DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration download. |
CVE-2021-46394 | Critical | 9.8 | 2022-03-04 | There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. The v13 variable is directly retrieved fr… |
CVE-2021-46393 | Critical | 9.8 | 2022-03-04 | There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. The v10 variable is directly retrieved fr… |
CVE-2021-44321 | Medium | 5.0 | 2022-03-04 | Mini-Inventory-and-Sales-Management-System is affected by Cross Site Request Forgery (CSRF), where an attacker can update/delete items in the inventory. The at… |
CVE-2021-43393 | Medium | 6.2 | 2022-03-04 | STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to abuse signature verification. This is associated with the ECDSA signa… |
CVE-2021-43392 | Medium | 6.2 | 2022-03-04 | STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to obtain information on cryptographic secrets. This is associated with… |
CVE-2021-3640 | High | 7.0 | 2022-03-03 | A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way trigge… |
CVE-2021-3638 | Medium | 6.5 | 2022-03-03 | An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write o… |
CVE-2021-26948 | High | 7.8 | 2022-03-03 | Null pointer dereference in the htmldoc v1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service via a crafted html file. |
CVE-2021-26259 | High | 7.8 | 2022-03-03 | A flaw was found in htmldoc in v1.9.12. Heap buffer overflow in render_table_row(),in ps-pdf.cxx may lead to arbitrary code execution and denial of service. |
CVE-2021-4002 | Medium | 4.4 | 2022-03-03 | A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligne… |
CVE-2021-3762 | Critical | 9.8 | 2022-03-03 | A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when… |
CVE-2021-38578 | High | 7.4 | 2022-03-03 | Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize. |
CVE-2021-3620 | Medium | 5.5 | 2022-03-03 | A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the… |
CVE-2021-3609 | High | 7.0 | 2022-03-03 | .A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash… |
CVE-2021-3602 | Medium | 5.5 | 2022-03-03 | An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RU… |
CVE-2021-45819 | Medium | 6.4 | 2022-03-03 | Wordline HIDCCEMonitorSVC before v5.2.4.3 contains an unquoted service path which allows attackers to escalate privileges to the system level. |
CVE-2021-43774 | Medium | 4.9 | 2022-03-03 | A risky-algorithm issue was discovered on Fujifilm DocuCentre-VI C4471 1.8 devices. An attacker that obtained access to the administrative web interface of a p… |
CVE-2021-40637 | Medium | 6.1 | 2022-03-03 | OS4ED openSIS 8.0 is affected by cross-site scripting (XSS) in EmailCheckOthers.php. An attacker can inject JavaScript code to get the user's cookie and take o… |
CVE-2021-40636 | High | 7.5 | 2022-03-03 | OS4ED openSIS 8.0 is affected by SQL Injection in CheckDuplicateName.php, which can extract information from the database. |
CVE-2021-40635 | High | 7.5 | 2022-03-03 | OS4ED openSIS 8.0 is affected by SQL injection in ChooseCpSearch.php, ChooseRequestSearch.php. An attacker can inject a SQL query to extract information from t… |
CVE-2021-42950 | High | 8.8 | 2022-03-03 | Remote Code Execution (RCE) vulnerability exists in Zepl Notebooks all previous versions before October 25 2021. Users can register for an account and are allo… |
CVE-2021-44343 | High | 7.8 | 2022-03-03 | David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occur… |
CVE-2021-44335 | High | 7.8 | 2022-03-03 | David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occur… |
CVE-2021-38269 | Medium | 5.4 | 2022-03-03 | Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 before fix pack 23, 7.2… |
CVE-2021-38267 | Medium | 5.4 | 2022-03-03 | Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack… |
CVE-2021-38265 | Medium | 5.4 | 2022-03-03 | Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTM… |
CVE-2021-38264 | Medium | 6.1 | 2022-03-03 | Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script… |
CVE-2021-38263 | Medium | 6.1 | 2022-03-03 | Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7… |
CVE-2021-4076 | High | 7.5 | 2022-03-02 | A flaw exists in tang, a network-based cryptographic binding server, which could result in leak of private keys. |
CVE-2021-3772 | Medium | 6.5 | 2022-03-02 | A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP… |
CVE-2021-3738 | High | 8.8 | 2022-03-02 | In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These han… |
CVE-2021-3716 | Low | 3.1 | 2022-03-02 | A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject… |
CVE-2021-3715 | High | 7.8 | 2022-03-02 | A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled changing of classificati… |
CVE-2021-3677 | Medium | 6.5 | 2022-03-02 | A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database use… |
CVE-2021-3667 | Medium | 6.5 | 2022-03-02 | An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a loc… |
CVE-2021-3658 | Medium | 6.5 | 2022-03-02 | bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered do… |
CVE-2021-3654 | Medium | 6.1 | 2022-03-02 | A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL. |