2021 CVEs (page 47)
Page 47 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-3930 | Medium | 6.5 | 2022-02-18 | An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' arg… |
CVE-2021-3657 | Critical | 9.8 | 2022-02-18 | A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers… |
CVE-2021-39026 | Medium | 5.9 | 2022-02-18 | IBM Guardium Data Encryption (GDE) 5.0.0.2 and 5.0.0.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable… |
CVE-2021-38935 | High | 7.5 | 2022-02-18 | IBM Maximo Asset Management 7.6.1.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user… |
CVE-2021-30650 | Medium | 6.1 | 2022-02-18 | A reflected cross-site scripting (XSS) vulnerability in the Symantec Layer7 API Management OAuth Toolkit (OTK) allows a remote attacker to craft a malicious UR… |
CVE-2021-26619 | High | 7.1 | 2022-02-18 | An path traversal vulnerability leading to delete arbitrary files was discovered in BigFileAgent. Remote attackers can use this vulnerability to delete arbitra… |
CVE-2021-26618 | High | 7.1 | 2022-02-18 | An improper input validation leading to arbitrary file creation was discovered in ToWord of ToOffice. Remote attackers use this vulnerability to execute arbitr… |
CVE-2021-20325 | Critical | 9.8 | 2022-02-18 | Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression compar… |
CVE-2021-20322 | High | 7.4 | 2022-02-18 | A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to q… |
CVE-2021-20321 | Medium | 4.7 | 2022-02-18 | A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific way with OverlayFS. A local use… |
CVE-2021-20320 | Medium | 5.5 | 2022-02-18 | A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a local attacker with special user privile… |
CVE-2021-20315 | Medium | 6.1 | 2022-02-18 | A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "Application menu" or "Window list" GNOM… |
CVE-2021-46372 | Medium | 5.4 | 2022-02-18 | Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown editor is vulnerable to a XSS attack when using uppercase lett… |
CVE-2021-46108 | Medium | 5.4 | 2022-02-18 | D-Link DSL-2730E CT-20131125 devices allow XSS via the username parameter to the password page in the maintenance configuration. |
CVE-2021-41599 | High | 8.8 | 2022-02-18 | A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. To exploit this vul… |
CVE-2021-4120 | High | 8.2 | 2022-02-17 | snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor… |
CVE-2021-44731 | High | 7.8 | 2022-02-17 | A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to gain… |
CVE-2021-44730 | High | 7.8 | 2022-02-17 | snapd 2.54.2 did not properly validate the location of the snap-confine binary. A local attacker who can hardlink this binary to another location to cause snap… |
CVE-2021-3155 | Low | 3.8 | 2022-02-17 | snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to re… |
CVE-2021-46319 | Critical | 9.8 | 2022-02-17 | Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicious users can use thi… |
CVE-2021-46315 | Critical | 9.8 | 2022-02-17 | Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA… |
CVE-2021-46314 | Critical | 9.8 | 2022-02-17 | A Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR8… |
CVE-2021-45382 | Critical | 9.8 | 2022-02-17 | A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via th… |
CVE-2021-46247 | High | 7.5 | 2022-02-17 | The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from ASUS CMAX6000 v1.02.00. |
CVE-2021-39034 | High | 7.5 | 2022-02-17 | IBM MQ 9.1 LTS is vulnerable to a denial of service attack caused by an issue within the channel process. IBM X-Force ID: 213964. |
CVE-2021-44868 | Critical | 9.8 | 2022-02-17 | A problem was found in ming-soft MCMS v5.1. There is a sql injection vulnerability in /ms/cms/content/list.do |
CVE-2021-46368 | High | 7.8 | 2022-02-17 | TRIGONE Remote System Monitor 3.61 is vulnerable to an unquoted path service allowing local users to launch processes with elevated privileges. |
CVE-2021-43303 | Critical | 9.8 | 2022-02-16 | Buffer overflow in PJSUA API when calling pjsua_call_dump. An attacker-controlled 'buffer' argument may cause a buffer overflow, since supplying an output buff… |
CVE-2021-43302 | Critical | 9.1 | 2022-02-16 | Read out-of-bounds in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause an out-of-bounds read when the filenam… |
CVE-2021-43301 | Critical | 9.8 | 2022-02-16 | Stack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-controlled 'file_names' argument may cause a buffer overflow since it is copied to… |
CVE-2021-43300 | Critical | 9.8 | 2022-02-16 | Stack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a… |
CVE-2021-43299 | Critical | 9.8 | 2022-02-16 | Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fi… |
CVE-2021-3242 | Critical | 9.8 | 2022-02-16 | DuxCMS v3.1.3 was discovered to contain a SQL injection vulnerability via the component s/tools/SendTpl/index?keyword=. |
CVE-2021-3781 | Critical | 9.9 | 2022-02-16 | A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This… |
CVE-2021-3773 | Critical | 9.8 | 2022-02-16 | A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for further use in traditional network attacks. |
CVE-2021-3760 | High | 7.8 | 2022-02-16 | A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat to confidentiality, integrity, and system availabili… |
CVE-2021-3753 | Medium | 4.7 | 2022-02-16 | A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to… |
CVE-2021-3752 | High | 7.1 | 2022-02-16 | A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a ra… |
CVE-2021-3578 | High | 7.8 | 2022-02-16 | A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer val… |
CVE-2021-3560 | High | 7.8 | 2022-02-16 | It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user… |
CVE-2021-4134 | High | 7.2 | 2022-02-16 | The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the ~… |
CVE-2021-4106 | High | 7.8 | 2022-02-16 | A vulnerability in Snow Inventory Java Scanner allows an attacker to run malicious code at a higher level of privileges. This issue affects: SNOW Snow Inventor… |
CVE-2021-3557 | Medium | 6.5 | 2022-02-16 | A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unp… |
CVE-2021-3551 | High | 7.8 | 2022-02-16 | A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allow… |
CVE-2021-39301 | High | 8.8 | 2022-02-16 | Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code executio… |
CVE-2021-39300 | High | 8.8 | 2022-02-16 | Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code executio… |
CVE-2021-39299 | High | 8.8 | 2022-02-16 | Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code executio… |
CVE-2021-39298 | High | 8.8 | 2022-02-16 | A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbit… |
CVE-2021-39297 | High | 8.8 | 2022-02-16 | Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code executio… |
CVE-2021-23682 | High | 7.3 | 2022-02-16 | This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string… |
CVE-2021-22050 | High | 7.5 | 2022-02-16 | ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy. A malicious actor with network access to ESXi may exploit this issue to create a… |
CVE-2021-22043 | High | 7.5 | 2022-02-16 | VMware ESXi contains a TOCTOU (Time-of-check Time-of-use) vulnerability that exists in the way temporary files are handled. A malicious actor with access to se… |
CVE-2021-22042 | High | 7.8 | 2022-02-16 | VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets. A malicious actor with privileges within… |
CVE-2021-22041 | Medium | 6.7 | 2022-02-16 | VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on… |
CVE-2021-22040 | Medium | 6.7 | 2022-02-16 | VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges… |
CVE-2021-21966 | Medium | 5.3 | 2022-02-16 | An information disclosure vulnerability exists in the HTTP Server /ping.html functionality of Texas Instruments CC3200 SimpleLink Solution NWP 2.9.0.0. A speci… |
CVE-2021-21958 | High | 7.8 | 2022-02-16 | A heap-based buffer overflow vulnerability exists in the Hword HwordApp.dll functionality of Hancom Office 2020 11.0.0.2353. A specially-crafted malformed file… |
CVE-2021-26726 | High | 8.8 | 2022-02-16 | A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges… |
CVE-2021-45391 | High | 7.5 | 2022-02-16 | A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in the goform/setIPv6Status binary file /usr/sbin/httpd… |
CVE-2021-46252 | Medium | 6.5 | 2022-02-15 | A Cross-Site Request Forgery (CSRF) in RequirementsBypassPage.php of Scratch Wiki scratch-confirmaccount-v3 allows attackers to modify account request requirem… |
CVE-2021-46251 | Medium | 6.1 | 2022-02-15 | A reflected cross-site scripting (XSS) in ScratchOAuth2 before commit 1603f04e44ef67dde6ccffe866d2dca16defb293 allows attackers to execute arbitrary web script… |
CVE-2021-46250 | Critical | 10.0 | 2022-02-15 | An issue in SOA2Login::commented of ScratchOAuth2 before commit a91879bd58fa83b09283c0708a1864cdf067c64a allows attackers to authenticate as other users on dow… |
CVE-2021-46249 | Medium | 6.5 | 2022-02-15 | An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089fdd366dd40775d6 all… |
CVE-2021-35380 | High | 7.5 | 2022-02-15 | A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to… |
CVE-2021-46321 | Critical | 9.8 | 2022-02-15 | Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the wifiBasicCfg module. This vulnerability allows attackers… |
CVE-2021-46265 | Critical | 9.8 | 2022-02-15 | Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the wanBasicCfg module. This vulnerability allows attackers t… |
CVE-2021-46264 | Critical | 9.8 | 2022-02-15 | Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the onlineList module. This vulnerability allows attackers to… |
CVE-2021-46263 | Critical | 9.8 | 2022-02-15 | Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the wifiTime module. This vulnerability allows attackers to c… |
CVE-2021-46262 | Critical | 9.8 | 2022-02-15 | Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the PPPoE module. This vulnerability allows attackers to caus… |
CVE-2021-37354 | Critical | 9.8 | 2022-02-15 | Xerox Phaser 4622 v35.013.01.000 was discovered to contain a buffer overflow in the function sub_3226AC via the TIMEZONE variable. This vulnerability allows at… |
CVE-2021-33945 | Critical | 9.8 | 2022-02-15 | RICOH Printer series SP products 320DN, SP 325DNw, SP 320SN, SP 320SFN, SP 325SNw, SP 325SFNw, SP 330SN, Aficio SP 3500SF, SP 221S, SP 220SNw, SP 221SNw, SP 22… |
CVE-2021-42714 | High | 7.8 | 2022-02-15 | Splashtop Remote Client (Business Edition) through 3.4.8.3 creates a Temporary File in a Directory with Insecure Permissions. |
CVE-2021-42713 | High | 7.8 | 2022-02-15 | Splashtop Remote Client (Personal Edition) through 3.4.6.1 creates a Temporary File in a Directory with Insecure Permissions. |
CVE-2021-43050 | High | 8.4 | 2022-02-15 | The Auth Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Container Edition contains an easily exploitable vulnerability that allows an unauthen… |
CVE-2021-43049 | Critical | 9.8 | 2022-02-15 | The Database component of TIBCO Software Inc.'s TIBCO BusinessConnect Container Edition contains an easily exploitable vulnerability that allows an unauthentic… |
CVE-2021-44960 | Medium | 6.5 | 2022-02-15 | In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function handled the XMLDocument object improperly, returning a null poin… |
CVE-2021-43734 | High | 7.5 | 2022-02-15 | kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host. |
CVE-2021-42712 | High | 7.8 | 2022-02-15 | Splashtop Streamer through 3.4.8.3 creates a Temporary File in a Directory with Insecure Permissions. |
CVE-2021-41552 | High | 8.8 | 2022-02-15 | CommScope SURFboard SBG6950AC2 9.1.103AA23 devices allow Command Injection. |
CVE-2021-46558 | Medium | 5.4 | 2022-02-15 | Multiple cross-site scripting (XSS) vulnerabilities in the Add User module of Issabel PBX 20200102 allows attackers to execute arbitrary web scripts or HTML vi… |
CVE-2021-46557 | Medium | 5.4 | 2022-02-15 | Vicidial 2.14-783a was discovered to contain a cross-site scripting (XSS) vulnerability via the input tabs. |
CVE-2021-43948 | Medium | 4.3 | 2022-02-15 | Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of private objects via an… |
CVE-2021-43941 | Medium | 6.5 | 2022-02-15 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPage.jspa and Importer… |
CVE-2021-43940 | High | 7.8 | 2022-02-15 | Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a D… |
CVE-2021-43953 | Medium | 4.3 | 2022-02-15 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU monitoring settings v… |
CVE-2021-43950 | Medium | 4.3 | 2022-02-15 | Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source configuration informat… |
CVE-2021-43952 | Medium | 4.3 | 2022-02-15 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Si… |
CVE-2021-4201 | Critical | 9.6 | 2022-02-14 | Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, i… |
CVE-2021-46463 | Critical | 9.8 | 2022-02-14 | njs through 0.7.1, used in NGINX, was discovered to contain a control flow hijack caused by a Type Confusion vulnerability in njs_promise_perform_then(). |
CVE-2021-46462 | High | 7.5 | 2022-02-14 | njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njs_object_set_prototype in /src/njs_object.c. |
CVE-2021-46461 | Critical | 9.8 | 2022-02-14 | njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c. |
CVE-2021-45005 | Critical | 9.8 | 2022-02-14 | Artifex MuJS v1.1.3 was discovered to contain a heap buffer overflow which is caused by conflicting JumpList of nested try/finally statements. |
CVE-2021-45310 | Medium | 5.3 | 2022-02-14 | Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access restriction. Users i… |
CVE-2021-45348 | High | 7.5 | 2022-02-14 | An Arbitrary File Deletion vulnerability exists in SourceCodester Attendance Management System v1.0 via the csv parameter in admin/pageUploadCSV.php, which can… |
CVE-2021-43106 | Medium | 6.1 | 2022-02-14 | A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online (TWO) 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP h… |
CVE-2021-45347 | High | 7.5 | 2022-02-14 | An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name in the cookie to use… |
CVE-2021-45346 | Medium | 4.3 | 2022-02-14 | A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is… |
CVE-2021-39080 | Medium | 6.5 | 2022-02-14 | Due to weak obfuscation, IBM Cognos Analytics Mobile for Android application prior to version 1.1.14 , an attacker could be able to reverse engineer the codeba… |
CVE-2021-39079 | Medium | 5.4 | 2022-02-14 | IBM Cognos Analytics Mobile for Android applications prior to version 1.1.14 is vulnerable to cross-site scripting. This vulnerability allows users to embed ar… |
CVE-2021-45392 | High | 7.5 | 2022-02-14 | A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in page /goform/setIPv6Status via the prefixDelegate par… |