2021 CVEs (page 45)
Page 45 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-22431 | Critical | 9.8 | 2022-02-25 | There is a vulnerability when configuring permission isolation in smartphones. Successful exploitation of this vulnerability may cause out-of-bounds access. |
CVE-2021-22430 | Critical | 9.8 | 2022-02-25 | There is a logic bypass vulnerability in smartphones. Successful exploitation of this vulnerability may cause code injection. |
CVE-2021-22429 | Critical | 9.8 | 2022-02-25 | There is a memory address out of bounds in smartphones. Successful exploitation of this vulnerability may cause malicious code to be executed. |
CVE-2021-22426 | Critical | 9.8 | 2022-02-25 | There is a memory address out of bounds in smartphones. Successful exploitation of this vulnerability may cause malicious code to be executed. |
CVE-2021-22395 | High | 7.5 | 2022-02-25 | There is a code injection vulnerability in smartphones. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-22394 | Critical | 9.1 | 2022-02-25 | There is a buffer overflow vulnerability in smartphones. Successful exploitation of this vulnerability may cause DoS of the apps during Multi-Screen Collaborat… |
CVE-2021-22319 | High | 7.5 | 2022-02-25 | There is an improper verification vulnerability in smartphones. Successful exploitation of this vulnerability may cause integer overflows. |
CVE-2021-38993 | Medium | 5.5 | 2022-02-25 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the smbcd daemon to cause a denial of service. IBM X-… |
CVE-2021-45977 | Critical | 9.8 | 2022-02-25 | JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 202… |
CVE-2021-45229 | Medium | 6.1 | 2022-02-25 | It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow v… |
CVE-2021-34361 | Medium | 5.3 | 2022-02-25 | A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attacke… |
CVE-2021-34359 | Medium | 6.9 | 2022-02-25 | A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attacke… |
CVE-2021-43745 | Medium | 5.5 | 2022-02-24 | A Denial of Service vulnerabilty exists in Trilium Notes 0.48.6 in the setupPage function |
CVE-2021-39364 | High | 7.5 | 2022-02-24 | Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow command spoofing (for camera control) after ARP cache poisoning has been achieved. |
CVE-2021-39363 | Critical | 9.8 | 2022-02-24 | Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow a video replay attack after ARP cache poisoning has been achieved. |
CVE-2021-29220 | High | 7.2 | 2022-02-24 | Multiple buffer overflow security vulnerabilities have been identified in HPE iLO Amplifier Pack version(s): Prior to 2.12. These vulnerabilities could be expl… |
CVE-2021-29217 | Medium | 6.1 | 2022-02-24 | A remote URL redirection vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5. HPE has provided a software update to resolve t… |
CVE-2021-29216 | Medium | 6.1 | 2022-02-24 | A remote cross-site scripting vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5. HPE has provided a software update to reso… |
CVE-2021-44665 | Medium | 6.5 | 2022-02-24 | A Directory Traversal vulnerability exists in the Xerte Project Xerte through 3.10.3 when downloading a project file via download.php. |
CVE-2021-44664 | High | 8.8 | 2022-02-24 | An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously craf… |
CVE-2021-4021 | High | 7.5 | 2022-02-24 | A vulnerability was found in Radare2 in versions prior to 5.6.2, 5.6.0, 5.5.4 and 5.5.2. Mapping a huge section filled with zeros of an ELF64 binary for MIPS a… |
CVE-2021-44663 | Critical | 9.8 | 2022-02-24 | A Remote Code Execution (RCE) vulnerability exists in the Xerte Project Xerte through 3.8.4 via a crafted php file through elfinder in connetor.php. |
CVE-2021-44662 | Medium | 6.1 | 2022-02-24 | A Site Scripting (XSS) vulnerability exists in the Xerte Project Xerte through 3.8.4 via the link parameter in print.php. |
CVE-2021-44533 | Medium | 5.3 | 2022-02-24 | Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subj… |
CVE-2021-44532 | Medium | 5.3 | 2022-02-24 | Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certifica… |
CVE-2021-44531 | High | 7.4 | 2022-02-24 | Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-const… |
CVE-2021-3700 | Medium | 6.4 | 2022-02-24 | A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This iss… |
CVE-2021-3610 | High | 7.5 | 2022-02-24 | A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c. This issue is due to an… |
CVE-2021-3608 | Medium | 6.0 | 2022-02-24 | A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHI… |
CVE-2021-3607 | Medium | 6.0 | 2022-02-24 | An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVR… |
CVE-2021-3596 | Medium | 6.5 | 2022-02-24 | A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg.c. This issue is due to not checking th… |
CVE-2021-26252 | High | 7.8 | 2022-02-24 | A flaw was found in htmldoc in v1.9.12. Heap buffer overflow in pspdf_prepare_page(),in ps-pdf.cxx may lead to execute arbitrary code and denial of service. |
CVE-2021-39038 | Medium | 5.4 | 2022-02-24 | IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to hijack the clickin… |
CVE-2021-38995 | Medium | 5.5 | 2022-02-24 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Fo… |
CVE-2021-38994 | Medium | 5.5 | 2022-02-24 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Fo… |
CVE-2021-4030 | High | 8.0 | 2022-02-24 | A cross-site request forgery vulnerability in the HTTP daemon of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary commands if they c… |
CVE-2021-4029 | High | 8.8 | 2022-02-24 | A command injection vulnerability in the CGI program of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary OS commands via a LAN inter… |
CVE-2021-45746 | High | 7.5 | 2022-02-24 | A Directory Traversal vulnerability exists in WeBankPartners wecube-platform 3.2.1 via the file variable in PluginPackageController.java. |
CVE-2021-44967 | High | 8.8 | 2022-02-24 | A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user uplo… |
CVE-2021-44610 | Critical | 9.8 | 2022-02-24 | Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) URLs, (2) lang_id, (3) tmpl_id, (4) mod_rewrite (5) eta_doctype. (6) met… |
CVE-2021-44608 | Medium | 5.4 | 2022-02-24 | Multiple Cross Site Scripting (XSS) vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) file parameter and (2) type parameter in an edit action in… |
CVE-2021-44607 | Medium | 5.4 | 2022-02-24 | A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file. |
CVE-2021-44567 | Critical | 9.8 | 2022-02-24 | An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php. |
CVE-2021-44566 | Medium | 5.4 | 2022-02-24 | A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 4.3 via the SanitizeMarkDown function in ProgramFunctions/MarkDownHTML.fnc.php. |
CVE-2021-44565 | Medium | 5.4 | 2022-02-24 | A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious… |
CVE-2021-44550 | Critical | 9.8 | 2022-02-24 | An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159). |
CVE-2021-43724 | Medium | 4.8 | 2022-02-24 | A Cross Site Scripting (XSS) vulnerability exits in Subrion CMS through 4.2.1 in the Create Page functionality of the admin Account via a SGV file. |
CVE-2021-25636 | High | 7.5 | 2022-02-24 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since… |
CVE-2021-43943 | Medium | 4.8 | 2022-02-24 | Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrary HTML or JavaScr… |
CVE-2021-35689 | Critical | 9.8 | 2022-02-24 | A potential vulnerability in the Oracle Talent Acquisition Cloud - Taleo Enterprise Edition. This high severity potential vulnerability allows attackers to per… |
CVE-2021-26092 | Medium | 4.7 | 2022-02-24 | Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 t… |
CVE-2021-4070 | Critical | 9.1 | 2022-02-23 | Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0. |
CVE-2021-43826 | High | 7.5 | 2022-02-22 | Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:`… |
CVE-2021-43825 | Medium | 6.1 | 2022-02-22 | Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop further processing of re… |
CVE-2021-43824 | High | 7.5 | 2022-02-22 | Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT req… |
CVE-2021-46699 | High | 7.8 | 2022-02-22 | A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.1). Affected application contains a stack based buffer overflow vulnerability wh… |
CVE-2021-46162 | High | 7.8 | 2022-02-22 | A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.1). Affected application contains an out of bounds write past the end of an allo… |
CVE-2021-4115 | Medium | 5.5 | 2022-02-21 | There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from thi… |
CVE-2021-44568 | Medium | 6.5 | 2022-02-21 | Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via the resolve_dependencies function at sr… |
CVE-2021-44141 | Medium | 4.3 | 2022-02-21 | All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the… |
CVE-2021-27797 | Critical | 9.8 | 2022-02-21 | Brocade Fabric OS before Brocade Fabric OS v8.2.1c, v8.1.2h, and all versions of Brocade Fabric OS v8.0.x and v7.x contain documented hard-coded credentials, w… |
CVE-2021-27796 | Medium | 6.5 | 2022-02-21 | A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated attacker within the restricted shell envir… |
CVE-2021-27755 | Medium | 5.5 | 2022-02-21 | "Sametime Android potential path traversal vulnerability when using File class" |
CVE-2021-27753 | Medium | 5.5 | 2022-02-21 | "Sametime Android PathTraversal Vulnerability" |
CVE-2021-26256 | Medium | 4.7 | 2022-02-21 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6). |
CVE-2021-44142 | High | 8.8 | 2022-02-21 | The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a N… |
CVE-2021-45008 | High | 8.8 | 2022-02-21 | Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights. OTE: the vendor states that… |
CVE-2021-4208 | High | 7.2 | 2022-02-21 | The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the product_id POST parameter before using it in a SQL statement, leading to a SQL… |
CVE-2021-25101 | Medium | 4.8 | 2022-02-21 | The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attr… |
CVE-2021-25100 | Medium | 6.1 | 2022-02-21 | The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to… |
CVE-2021-25099 | Medium | 6.1 | 2022-02-21 | The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated re… |
CVE-2021-25082 | High | 8.8 | 2022-02-21 | The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Loc… |
CVE-2021-25075 | Low | 3.5 | 2022-02-21 | The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_s… |
CVE-2021-25069 | High | 8.8 | 2022-02-21 | The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statement, leading to a SQL… |
CVE-2021-25060 | Medium | 5.4 | 2022-02-21 | The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfw… |
CVE-2021-25058 | Medium | 5.4 | 2022-02-21 | The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text fi… |
CVE-2021-25057 | Medium | 5.4 | 2022-02-21 | The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field fo… |
CVE-2021-25055 | Medium | 6.1 | 2022-02-21 | The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter. |
CVE-2021-24921 | Medium | 6.1 | 2022-02-21 | The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before outputting them back in attributes, leadi… |
CVE-2021-24867 | Critical | 9.8 | 2022-02-21 | Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes… |
CVE-2021-46701 | High | 7.2 | 2022-02-20 | PreMiD 2.2.0 allows unintended access via the websocket transport. An attacker can receive events from a socket and emit events to a socket, potentially interf… |
CVE-2021-45083 | High | 7.1 | 2022-02-20 | An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be ex… |
CVE-2021-45081 | Medium | 5.9 | 2022-02-20 | An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS. |
CVE-2021-45007 | Medium | 6.5 | 2022-02-20 | Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to insert data on the user and admin panel. NOTE: the ve… |
CVE-2021-46700 | Medium | 6.5 | 2022-02-19 | In libsixel 1.8.6, sixel_encoder_output_without_macro (called from sixel_encoder_encode_frame in encoder.c) has a double free. |
CVE-2021-45082 | High | 7.8 | 2022-02-19 | An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules… |
CVE-2021-44302 | High | 8.8 | 2022-02-19 | BaiCloud-cms v2.5.7 was discovered to contain multiple SQL injection vulnerabilities via the tongji and baidu_map parameters in /user/ztconfig.php. |
CVE-2021-29656 | Critical | 9.8 | 2022-02-18 | Pexip Infinity Connect before 1.8.0 mishandles TLS certificate validation. The allow list is not properly checked. |
CVE-2021-29655 | Critical | 9.8 | 2022-02-18 | Pexip Infinity Connect before 1.8.0 omits certain provisioning authenticity checks. Thus, untrusted code may execute. |
CVE-2021-46110 | Critical | 9.8 | 2022-02-18 | Online Shopping Portal v3.1 was discovered to contain multiple time-based SQL injection vulnerabilities via the email and contactno parameters. |
CVE-2021-40841 | Medium | 6.5 | 2022-02-18 | A Path Traversal vulnerability for a log file in LiveConfig 2.12.2 allows authenticated attackers to read files on the underlying server. |
CVE-2021-40840 | Medium | 5.4 | 2022-02-18 | A Stored XSS issue exists in the admin/users user administration form in LiveConfig 2.12.2. |
CVE-2021-46656 | High | 7.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to expl… |
CVE-2021-46655 | High | 7.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to expl… |
CVE-2021-46654 | Medium | 5.5 | 2022-02-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required… |
CVE-2021-46653 | High | 7.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to expl… |
CVE-2021-46652 | High | 7.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to expl… |
CVE-2021-46651 | Medium | 5.5 | 2022-02-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interac… |
CVE-2021-46650 | Medium | 5.5 | 2022-02-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interac… |
CVE-2021-46649 | Medium | 5.5 | 2022-02-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interac… |