2021 CVEs (page 44)
Page 44 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-3631 | Medium | 6.3 | 2022-03-02 | A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled… |
CVE-2021-3623 | Medium | 6.1 | 2022-03-02 | A flaw was found in libtpms. The flaw can be triggered by specially-crafted TPM 2 command packets containing illegal values and may lead to an out-of-bounds ac… |
CVE-2021-38266 | High | 7.5 | 2022-03-02 | The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does n… |
CVE-2021-23222 | Medium | 5.9 | 2022-03-02 | A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption. |
CVE-2021-23206 | High | 7.8 | 2022-03-02 | A flaw was found in htmldoc in v1.9.12 and prior. A stack buffer overflow in parse_table() in ps-pdf.cxx may lead to execute arbitrary code and denial of servi… |
CVE-2021-23192 | High | 7.5 | 2022-03-02 | A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker c… |
CVE-2021-23191 | High | 7.8 | 2022-03-02 | A security issue was found in htmldoc v1.9.12 and before. A NULL pointer dereference in the function image_load_jpeg() in image.cxx may result in denial of ser… |
CVE-2021-23180 | High | 7.8 | 2022-03-02 | A flaw was found in htmldoc in v1.9.12 and before. Null pointer dereference in file_extension(),in file.c may lead to execute arbitrary code and denial of serv… |
CVE-2021-46270 | Low | 2.7 | 2022-03-02 | JFrog Artifactory before 7.31.10, is vulnerable to Broken Access Control where a project admin user is able to list all available repository names due to insuf… |
CVE-2021-45074 | Medium | 4.3 | 2022-03-02 | JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, whi… |
CVE-2021-41003 | Medium | 6.1 | 2022-03-02 | Multiple unauthenticated command injection vulnerabilities were discovered in the AOS-CX API interface in Aruba CX 6200F Switch Series, Aruba 6300 Switch Serie… |
CVE-2021-41002 | High | 8.1 | 2022-03-02 | Multiple authenticated remote path traversal vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch Series, Aruba 6300 S… |
CVE-2021-41001 | High | 8.8 | 2022-03-02 | An authenticated remote code execution vulnerability was discovered in the AOS-CX Network Analytics Engine (NAE) in Aruba CX 6200F Switch Series, Aruba 6300 Sw… |
CVE-2021-41000 | High | 8.8 | 2022-03-02 | Multiple authenticated remote code execution vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch Series, Aruba 6300 S… |
CVE-2021-38268 | Medium | 6.5 | 2022-03-02 | The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10… |
CVE-2021-43070 | Medium | 5.4 | 2022-03-02 | Multiple relative path traversal vulnerabilities [CWE-23] in FortiWLM management interface 8.6.2 and below, 8.5.2 and below, 8.4.2 and below, 8.3.3 and below… |
CVE-2021-38996 | Medium | 5.5 | 2022-03-02 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Fo… |
CVE-2021-44166 | Medium | 4.1 | 2022-03-02 | An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a remote attacker havin… |
CVE-2021-45864 | Medium | 5.5 | 2022-03-02 | tsMuxer git-c6a0277 was discovered to contain a segmentation fault via DTSStreamReader::findFrame in dtsStreamReader.cpp. |
CVE-2021-45863 | Medium | 5.5 | 2022-03-02 | tsMuxer git-2678966 was discovered to contain a heap-based buffer overflow via the function HevcUnit::updateBits in hevc.cpp. |
CVE-2021-45861 | Medium | 5.5 | 2022-03-02 | There is an Assertion `num <= INT_BIT' failed at BitStreamReader::skipBits in /bitStream.h:132 of tsMuxer git-c6a0277. |
CVE-2021-45860 | Medium | 5.5 | 2022-03-02 | An integer overflow in DTSStreamReader::findFrame() of tsMuxer git-2678966 allows attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2021-41652 | High | 7.5 | 2022-03-01 | Insecure permissions in the file database.sdb of BatFlat CMS v1.3.6 allows attackers to dump the entire database. |
CVE-2021-41282 | High | 8.8 | 2022-03-01 | diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The… |
CVE-2021-43077 | High | 8.8 | 2022-03-01 | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, v… |
CVE-2021-43075 | High | 8.8 | 2022-03-01 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and be… |
CVE-2021-41193 | Critical | 9.8 | 2022-03-01 | wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnerability in versions prior to 7.1.12 allo… |
CVE-2021-32586 | High | 7.7 | 2022-03-01 | An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker to alter the enviro… |
CVE-2021-36171 | High | 8.1 | 2022-03-01 | The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6.0.6 may allow a remote unauthenticated… |
CVE-2021-36166 | Critical | 9.8 | 2022-03-01 | An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication… |
CVE-2021-38986 | Medium | 5.4 | 2022-03-01 | IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system… |
CVE-2021-38955 | Medium | 4.4 | 2022-03-01 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a local user with elevated privileges to cause a denial of service due to a file creation vulnerability in the… |
CVE-2021-46387 | Medium | 6.1 | 2022-03-01 | ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads to bypass security restriction to achiev… |
CVE-2021-44238 | High | 7.2 | 2022-03-01 | AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE) via /aya/module/admin/ust_tab_e.inc.php, |
CVE-2021-44747 | Medium | 4.6 | 2022-03-01 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Linux Security whereby the Fmlib component used in certain F-Secure products can crash while… |
CVE-2021-4039 | Critical | 9.8 | 2022-03-01 | A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device. |
CVE-2021-35036 | Medium | 6.5 | 2022-03-01 | A cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50(ABTL.0)b2k could allow an authenticated attacker to obtain se… |
CVE-2021-43619 | High | 7.8 | 2022-03-01 | Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. In the IPC model, a psa_fwu_write caller from SPE or NSPE… |
CVE-2021-44962 | Medium | 5.5 | 2022-03-01 | An out-of-bounds read vulnerability exists in the GCode::extrude() functionality of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. A specially crafted stl f… |
CVE-2021-44961 | Medium | 5.5 | 2022-03-01 | A memory leakage flaw exists in the class PerimeterGenerator of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. Specially crafted stl files can exhaust avail… |
CVE-2021-42951 | High | 8.8 | 2022-03-01 | A Remote Code Execution (RCE) vulnerability exists in Algorithmia MSOL all versions before October 10 2021 of SaaS. Users can register for an account and are a… |
CVE-2021-42767 | Critical | 9.1 | 2022-03-01 | A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local… |
CVE-2021-45414 | Critical | 9.8 | 2022-02-28 | A Remote Code Execution (RCE) vulnerability exists in DataRobot through 2021-10-28 because it allows submission of a Docker environment or Java driver. |
CVE-2021-41112 | High | 8.1 | 2022-02-28 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a… |
CVE-2021-41111 | Medium | 6.4 | 2022-02-28 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an authenticated user wit… |
CVE-2021-44342 | High | 7.8 | 2022-02-28 | David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow via function ok_png_transform_scanline() in "/ok_png.c:494". |
CVE-2021-44331 | High | 7.8 | 2022-02-28 | ARM astcenc 3.2.0 is vulnerable to Buffer Overflow in function encode_ise(). |
CVE-2021-44340 | High | 7.8 | 2022-02-28 | David Brackeen ok-file-formats dev version is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow o… |
CVE-2021-44339 | High | 7.8 | 2022-02-28 | David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occur… |
CVE-2021-44334 | High | 7.8 | 2022-02-28 | David Brackeen ok-file-formats 97f78ca is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occur… |
CVE-2021-43086 | Critical | 9.8 | 2022-02-28 | ARM astcenc 3.2.0 is vulnerable to Buffer Overflow. When the compression function of the astc-encoder project with -cl option was used, a stack-buffer-overflow… |
CVE-2021-4222 | Medium | 4.8 | 2022-02-28 | The WP-Paginate WordPress plugin before 2.1.4 does not sanitise and escape its preset settings, allowing high privilege users such as admin to perform Cross-Si… |
CVE-2021-25118 | Medium | 5.3 | 2022-02-28 | The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints… |
CVE-2021-25112 | Medium | 6.1 | 2022-02-28 | The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Refle… |
CVE-2021-25081 | Medium | 6.5 | 2022-02-28 | The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow attackers to make… |
CVE-2021-25042 | Medium | 5.4 | 2022-02-28 | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allow… |
CVE-2021-25034 | Medium | 6.1 | 2022-02-28 | The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user] shortcode is used, leading to Reflected Cross… |
CVE-2021-25011 | Medium | 5.7 | 2022-02-28 | The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow… |
CVE-2021-25010 | Critical | 9.6 | 2022-02-28 | The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary sni… |
CVE-2021-24994 | Medium | 6.1 | 2022-02-28 | The Migration, Backup, Staging WordPress plugin before 0.9.69 does not have authorisation when adding remote storages, and does not sanitise as well as escape… |
CVE-2021-24977 | Medium | 6.1 | 2022-02-28 | The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing unauthenticated us… |
CVE-2021-24971 | Medium | 5.4 | 2022-02-28 | The WP Responsive Menu WordPress plugin before 3.1.7.1 does not have capability and CSRF checks in the wpr_live_update AJAX action, as well as do not sanitise… |
CVE-2021-24933 | Medium | 5.4 | 2022-02-28 | The Dynamic Widgets WordPress plugin through 1.5.16 does not escape the prefix parameter before outputting it back in an attribute when using the term_tree AJA… |
CVE-2021-24920 | Medium | 4.8 | 2022-02-28 | The StatCounter WordPress plugin before 2.0.7 does not sanitise and escape the Project ID and Secure Code settings, which could allow high privilege users to p… |
CVE-2021-24913 | Medium | 4.3 | 2022-02-28 | The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, allowing attackers to… |
CVE-2021-24903 | Medium | 4.8 | 2022-02-28 | The GRAND FlaGallery WordPress plugin through 6.1.2 does not sanitise and escape some of its gallery settings, which could allow high privilege users to perfor… |
CVE-2021-24901 | Medium | 4.8 | 2022-02-28 | The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting, which could allow high privilege users to perform Cross-Sit… |
CVE-2021-24898 | Medium | 4.8 | 2022-02-28 | The EditableTable WordPress plugin through 0.1.4 does not sanitise and escape any of the Table and Column fields, which could allow high privilege users to per… |
CVE-2021-24864 | High | 8.8 | 2022-02-28 | The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the post_id parameter before using it in a SQL statement in the admin dashboard, le… |
CVE-2021-24823 | High | 8.1 | 2022-02-28 | The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to m… |
CVE-2021-24820 | Medium | 6.5 | 2022-02-28 | The Cost Calculator WordPress plugin through 1.6 allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions <= 1.6) to perform path tra… |
CVE-2021-24803 | High | 8.8 | 2022-02-28 | The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin… |
CVE-2021-24730 | Medium | 4.3 | 2022-02-28 | The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX action, al… |
CVE-2021-24704 | High | 8.8 | 2022-02-28 | In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an u… |
CVE-2021-24689 | Medium | 4.9 | 2022-02-28 | The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server… |
CVE-2021-24688 | Medium | 4.3 | 2022-02-28 | The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_delete_filed one wh… |
CVE-2021-43945 | Medium | 4.8 | 2022-02-28 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrary HTML or JavaScrip… |
CVE-2021-21708 | High | 8.2 | 2022-02-27 | In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits… |
CVE-2021-3967 | High | 8.8 | 2022-02-26 | Improper Access Control in GitHub repository zulip/zulip prior to 4.10. |
CVE-2021-46702 | Medium | 5.5 | 2022-02-26 | Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to bypass the intended anonymity feature… |
CVE-2021-44132 | High | 7.8 | 2022-02-25 | A command injection vulnerability in the function formImportOMCIShell of C-DATA ONU4FERW V2.1.13_X139 allows attackers to execute arbitrary commands via a craf… |
CVE-2021-42952 | Critical | 9.9 | 2022-02-25 | Zepl Notebooks before 2021-10-25 are affected by a sandbox escape vulnerability. Upon launching Remote Code Execution from the Notebook, users can then use tha… |
CVE-2021-23495 | Medium | 5.4 | 2022-02-25 | The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter. |
CVE-2021-42244 | Medium | 6.1 | 2022-02-25 | A cross-site scripting (XSS) vulnerability in PaquitoSoftware Notimoo v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted title or mes… |
CVE-2021-40046 | Critical | 9.8 | 2022-02-25 | PCManager versions 11.1.1.95 has a privilege escalation vulnerability. Successful exploit could allow the attacker to access certain resource beyond its privil… |
CVE-2021-40043 | High | 7.8 | 2022-02-25 | The laser command injection vulnerability exists on AIS-BW80H-00 versions earlier than AIS-BW80H-00 9.0.3.4(H100SP13C00). The devices cannot effectively defend… |
CVE-2021-37504 | Medium | 6.1 | 2022-02-25 | A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML… |
CVE-2021-37103 | Medium | 5.5 | 2022-02-25 | There is an improper permission management vulnerability in the Wallet apps. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-37027 | High | 7.5 | 2022-02-25 | There is a DoS vulnerability in smartphones. Successful exploitation of this vulnerability may affect service integrity. |
CVE-2021-26617 | High | 8.1 | 2022-02-25 | This issues due to insufficient verification of the various input values from user’s input. The vulnerability allows remote attackers to execute malicious code… |
CVE-2021-22489 | High | 7.5 | 2022-02-25 | There is a DoS vulnerability in smartphones. Successful exploitation of this vulnerability may affect service availability. |
CVE-2021-22480 | Critical | 9.8 | 2022-02-25 | The interface of a certain HarmonyOS module has an integer overflow vulnerability. Successful exploitation of this vulnerability may lead to heap memory overfl… |
CVE-2021-22479 | Medium | 5.5 | 2022-02-25 | The interface of a certain HarmonyOS module has an invalid address access vulnerability. Successful exploitation of this vulnerability may lead to kernel crash. |
CVE-2021-22478 | Medium | 5.5 | 2022-02-25 | The interface of a certain HarmonyOS module has a UAF vulnerability. Successful exploitation of this vulnerability may lead to information leakage. |
CVE-2021-22448 | Critical | 9.1 | 2022-02-25 | There is an improper verification vulnerability in smartphones. Successful exploitation of this vulnerability may cause unauthorized read and write of some fil… |
CVE-2021-22441 | Medium | 5.5 | 2022-02-25 | Some Huawei products have an integer overflow vulnerability. Successful exploitation of this vulnerability may lead to kernel crash. |
CVE-2021-22437 | High | 7.0 | 2022-02-25 | There is a software integer overflow leading to a TOCTOU condition in smartphones. Successful exploitation of this vulnerability may cause random address acces… |
CVE-2021-22434 | Critical | 9.8 | 2022-02-25 | There is a memory address out of bounds vulnerability in smartphones. Successful exploitation of this vulnerability may cause malicious code to be executed. |
CVE-2021-22433 | Critical | 9.8 | 2022-02-25 | There is a memory address out of bounds in smartphones. Successful exploitation of this vulnerability may cause malicious code to be executed. |
CVE-2021-22432 | Critical | 9.8 | 2022-02-25 | There is a vulnerability when configuring permission isolation in smartphones. Successful exploitation of this vulnerability may cause out-of-bounds access. |