2021 CVEs (page 48)
Page 48 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-46371 | High | 7.5 | 2022-02-14 | antd-admin 5.5.0 is affected by an incorrect access control vulnerability. Unauthorized access to some interfaces in the foreground leads to leakage of sensiti… |
CVE-2021-45421 | High | 7.5 | 2022-02-14 | Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. A potential attacker can use this misconfiguration to access all… |
CVE-2021-45420 | Critical | 9.8 | 2022-02-14 | Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_u… |
CVE-2021-45444 | High | 7.8 | 2022-02-14 | In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs b… |
CVE-2021-44879 | Medium | 5.5 | 2022-02-14 | In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference. |
CVE-2021-25115 | Medium | 6.4 | 2022-02-14 | The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly, therefore… |
CVE-2021-25110 | Medium | 4.3 | 2022-02-14 | The Futurio Extra WordPress plugin before 1.6.3 allows any logged in user, such as subscriber, to extract any other user's email address. |
CVE-2021-25109 | Low | 2.7 | 2022-02-14 | The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from th… |
CVE-2021-25107 | Medium | 6.1 | 2022-02-14 | The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthe… |
CVE-2021-25050 | Medium | 4.8 | 2022-02-14 | The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting atta… |
CVE-2021-25033 | Medium | 6.1 | 2022-02-14 | The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an… |
CVE-2021-25018 | Medium | 5.4 | 2022-02-14 | The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any a… |
CVE-2021-25014 | Low | 3.5 | 2022-02-14 | The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated… |
CVE-2021-24904 | Medium | 4.8 | 2022-02-14 | The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, which coul… |
CVE-2021-24874 | Medium | 6.1 | 2022-02-14 | The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before output… |
CVE-2021-24446 | Medium | 5.4 | 2022-02-14 | The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in… |
CVE-2021-4102 | High | 8.8 | 2022-02-11 | Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-4101 | High | 8.8 | 2022-02-11 | Heap buffer overflow in Swiftshader in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2021-4100 | High | 8.8 | 2022-02-11 | Object lifecycle issue in ANGLE in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2021-4099 | High | 8.8 | 2022-02-11 | Use after free in Swiftshader in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-4098 | High | 7.4 | 2022-02-11 | Insufficient data validation in Mojo in Google Chrome prior to 96.0.4664.110 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2021-46366 | High | 8.8 | 2022-02-11 | An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSR… |
CVE-2021-46365 | High | 7.8 | 2022-02-11 | An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file. |
CVE-2021-46364 | High | 7.8 | 2022-02-11 | A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file. |
CVE-2021-46363 | High | 7.8 | 2022-02-11 | An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas ma… |
CVE-2021-46362 | Critical | 9.8 | 2022-02-11 | A Server-Side Template Injection (SSTI) vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute… |
CVE-2021-46361 | Critical | 9.8 | 2022-02-11 | An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted Fre… |
CVE-2021-23555 | Critical | 9.8 | 2022-02-11 | The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stackt… |
CVE-2021-20001 | Critical | 9.8 | 2022-02-11 | It was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu blend, before 2.12.16 configured insecure permissions for the u… |
CVE-2021-4046 | Medium | 5.4 | 2022-02-11 | The m_txtNom y m_txtCognoms parameters in TCMAN GIM v8.01 allow an attacker to perform persistent XSS attacks. This vulnerability could be used to carry out a… |
CVE-2021-4035 | Low | 3.5 | 2022-02-11 | A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit thi… |
CVE-2021-44111 | Medium | 4.4 | 2022-02-11 | A Directory Traversal vulnerability exists in S-Cart 6.7 via download in sc-admin/backup. |
CVE-2021-39688 | Medium | 5.5 | 2022-02-11 | In TBD of TBD, there is a possible out of bounds read due to TBD. This could lead to local information disclosure with no additional execution privileges neede… |
CVE-2021-39687 | Medium | 5.5 | 2022-02-11 | In HandleTransactionIoEvent of actuator_driver.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information d… |
CVE-2021-39677 | High | 7.5 | 2022-02-11 | In startVideoStream() there is a possibility of an OOB Read in the heap, when the camera buffer is ‘zero’ in size.Product: AndroidVersions: Android-11Android I… |
CVE-2021-39676 | High | 7.8 | 2022-02-11 | In writeThrowable of AndroidFuture.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to… |
CVE-2021-39675 | Critical | 9.8 | 2022-02-11 | In GKI_getbuf of gki_buffer.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with n… |
CVE-2021-39674 | High | 7.8 | 2022-02-11 | In btm_sec_connected and btm_sec_disconnected of btm_sec.cc file , there is a possible use after free. This could lead to local escalation of privilege with Us… |
CVE-2021-39672 | High | 7.8 | 2022-02-11 | In fastboot, there is a possible secure boot bypass due to a configuration error. This could lead to local escalation of privilege with no additional execution… |
CVE-2021-39671 | Medium | 6.5 | 2022-02-11 | In code generated by aidl_const_expressions.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to information disclosure wi… |
CVE-2021-39669 | High | 7.8 | 2022-02-11 | In onCreate of InstallCaCertificateWarning.java, there is a possible way to mislead an user about CA installation circumstances due to a tapjacking/overlay att… |
CVE-2021-39668 | High | 7.8 | 2022-02-11 | In onActivityViewReady of DetailDialog.kt, there is a possible Intent Redirect due to a confused deputy. This could lead to local escalation of privilege that… |
CVE-2021-39666 | Medium | 5.5 | 2022-02-11 | In extract of MediaMetricsItem.h, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with… |
CVE-2021-39665 | Medium | 6.5 | 2022-02-11 | In checkSpsUpdated of AAVCAssembler.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure… |
CVE-2021-39664 | Medium | 5.5 | 2022-02-11 | In LoadedPackage::Load of LoadedArsc.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure… |
CVE-2021-39663 | High | 7.8 | 2022-02-11 | In openFileAndEnforcePathPermissionsHelper of MediaProvider.java, there is a possible bypass of a permissions check due to a confused deputy. This could lead t… |
CVE-2021-39662 | High | 7.8 | 2022-02-11 | In checkUriPermission of MediaProvider.java , there is a possible way to gain access to the content of media provider collections due to a missing permission c… |
CVE-2021-39658 | Critical | 9.8 | 2022-02-11 | ismsEx service is a vendor service in unisoc equipment。ismsEx service is an extension of sms system service，but it does not check the permissions of the caller… |
CVE-2021-39635 | Critical | 9.1 | 2022-02-11 | ims_ex is a vendor system service used to manage VoLTE in unisoc devices，But it does not verify the caller's permissions，so that normal apps (No phone permissi… |
CVE-2021-39631 | Medium | 5.5 | 2022-02-11 | In clear_data_dlg_text of strings.xml, there is a possible situation when "Clear storage" functionality sets up the wrong security/privacy expectations due to… |
CVE-2021-39619 | High | 7.8 | 2022-02-11 | In updatePackageMappingsData of UsageStatsService.java, there is a possible way to bypass security and privacy settings of app usage due to an unusual root cau… |
CVE-2021-39616 | Critical | 9.8 | 2022-02-11 | Summary:Product: AndroidVersions: Android SoCAndroid ID: A-204686438 |
CVE-2021-34235 | Critical | 9.8 | 2022-02-11 | Tokheim Profleet DiaLOG 11.005.02 is affected by SQL Injection. The component is the Field__UserLogin parameter on the logon page. |
CVE-2021-31932 | Critical | 9.8 | 2022-02-11 | Nokia BTS TRS web console FTM_W20_FP2_2019.08.16_0010 allows Authentication Bypass. A malicious unauthenticated user can get access to all the functionalities… |
CVE-2021-22824 | High | 7.5 | 2022-02-11 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in denial of service, due to missing length check on user-supplied… |
CVE-2021-22823 | Critical | 9.1 | 2022-02-11 | A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of the user running IG… |
CVE-2021-22806 | High | 7.5 | 2022-02-11 | A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could cause data exfiltration and unauthorized access when accessing a malicio… |
CVE-2021-22805 | Critical | 9.1 | 2022-02-11 | A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of the user running IG… |
CVE-2021-22804 | High | 7.5 | 2022-02-11 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause disclosure of arbitrary files being read in the con… |
CVE-2021-22803 | Critical | 9.8 | 2022-02-11 | A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead to remote code execution through a number of paths, when an att… |
CVE-2021-22802 | Critical | 9.8 | 2022-02-11 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution due to missing length check on user suppl… |
CVE-2021-22801 | Critical | 9.8 | 2022-02-11 | A CWE-269: Improper Privilege Management vulnerability exists that could cause an arbitrary command execution when the software is configured with specially cr… |
CVE-2021-22800 | High | 7.5 | 2022-02-11 | A CWE-20: Improper Input Validation vulnerability exists that could cause a Denial of Service when a crafted packet is sent to the controller over network port… |
CVE-2021-22798 | High | 7.5 | 2022-02-11 | A CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause Sensitive data such as login credentials being exposed when a Network is… |
CVE-2021-22796 | High | 7.8 | 2022-02-11 | A CWE-287: Improper Authentication vulnerability exists that could allow remote code execution when a malicious file is uploaded. Affected Product: C-Bus Toolk… |
CVE-2021-22788 | High | 7.5 | 2022-02-11 | A CWE-787: Out-of-bounds Write vulnerability exists that could cause denial of service when an attacker sends a specially crafted HTTP request to the web serve… |
CVE-2021-22787 | High | 7.5 | 2022-02-11 | A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted HTTP reque… |
CVE-2021-22785 | High | 7.5 | 2022-02-11 | A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to leak when an attacker… |
CVE-2021-22748 | High | 8.8 | 2022-02-11 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow a remote code execution when a f… |
CVE-2021-0524 | Medium | 5.5 | 2022-02-11 | In isServiceDistractionOptimized of CarPackageManagerService.java, there is a possible disclosure of installed packages due to side channel information disclos… |
CVE-2021-45387 | Medium | 5.5 | 2022-02-11 | tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv4() at tree.c. |
CVE-2021-45386 | Medium | 5.5 | 2022-02-11 | tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv6() at tree.c |
CVE-2021-23597 | High | 7.5 | 2022-02-11 | This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. **Note:** This… |
CVE-2021-45385 | Medium | 6.5 | 2022-02-11 | A Null Pointer Dereference vulnerability exits in ffjpeg d5cfd49 (2021-12-06) in bmp_load(). When the size information in metadata of the bmp is out of range… |
CVE-2021-42940 | Critical | 9.9 | 2022-02-11 | A Cross Site Scripting (XSS) vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upload a SVG file cont… |
CVE-2021-45402 | Medium | 5.5 | 2022-02-11 | The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction… |
CVE-2021-38679 | Medium | 6.5 | 2022-02-11 | An improper authentication vulnerability has been reported to affect QNAP NAS running Kazoo Server. If exploited, this vulnerability allows attackers to compro… |
CVE-2021-46355 | Medium | 5.4 | 2022-02-11 | OCS Inventory 2.9.1 is affected by Cross Site Scripting (XSS). To exploit the vulnerability, the attacker needs to manipulate the name of some device on your c… |
CVE-2021-44521 | Critical | 9.1 | 2022-02-11 | When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_de… |
CVE-2021-35077 | High | 8.4 | 2022-02-11 | Possible use after free scenario in compute offloads to DSP while multiple calls spawn a dynamic process in Snapdragon Auto, Snapdragon Compute, Snapdragon Con… |
CVE-2021-35075 | High | 8.4 | 2022-02-11 | Possible null pointer dereference due to lack of WDOG structure validation during registration in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industri… |
CVE-2021-35074 | High | 8.4 | 2022-02-11 | Possible integer overflow due to improper fragment datatype while calculating number of fragments in a request message in Snapdragon Auto, Snapdragon Connectiv… |
CVE-2021-35069 | High | 7.8 | 2022-02-11 | Improper validation of data length received from DMA buffer can lead to memory corruption. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sna… |
CVE-2021-35068 | High | 8.4 | 2022-02-11 | Lack of null check while freeing the device information buffer in the Bluetooth HFP protocol can lead to a NULL pointer dereference in Snapdragon Auto, Snapdra… |
CVE-2021-30326 | High | 7.5 | 2022-02-11 | Possible assertion due to improper size validation while processing the DownlinkPreemption IE in an RRC Reconfiguration/RRC Setup message in Snapdragon Auto, S… |
CVE-2021-30325 | Medium | 6.7 | 2022-02-11 | Possible out of bound access of DCI resources due to lack of validation process and resource allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon Cons… |
CVE-2021-30324 | Medium | 6.7 | 2022-02-11 | Possible out of bound write due to lack of boundary check for the maximum size of buffer when sending a DCI packet to remote process in Snapdragon Auto, Snapdr… |
CVE-2021-30323 | High | 7.8 | 2022-02-11 | Improper validation of maximum size of data write to EFS file can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Sn… |
CVE-2021-30322 | High | 7.8 | 2022-02-11 | Possible out of bounds write due to improper validation of number of GPIOs configured in an internal parameters array in Snapdragon Auto, Snapdragon Compute, S… |
CVE-2021-30318 | High | 8.4 | 2022-02-11 | Improper validation of input when provisioning the HDCP key can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snap… |
CVE-2021-30317 | Critical | 9.3 | 2022-02-11 | Improper validation of program headers containing ELF metadata can lead to image verification bypass in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect… |
CVE-2021-30309 | High | 7.8 | 2022-02-11 | Improper size validation of QXDM commands can lead to memory corruption in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon M… |
CVE-2021-44970 | Medium | 5.4 | 2022-02-10 | MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php. |
CVE-2021-44969 | Medium | 4.8 | 2022-02-10 | Taocms v3.0.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Management Column component. |
CVE-2021-42000 | Medium | 5.3 | 2022-02-10 | When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple paral… |
CVE-2021-45364 | Critical | 9.8 | 2022-02-10 | A Code Execution vulnerability exists in Statamic Version through 3.2.26 via SettingsController.php. NOTE: the vendor indicates that there was an error in publ… |
CVE-2021-44850 | Medium | 6.8 | 2022-02-10 | On Xilinx Zynq-7000 SoC devices, physical modification of an SD boot image allows for a buffer overflow attack in the ROM. Because the Zynq-7000's boot image h… |
CVE-2021-45357 | Medium | 6.1 | 2022-02-10 | Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in include/functions.inc.php. |
CVE-2021-44892 | High | 8.8 | 2022-02-10 | A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtain server control… |
CVE-2021-41445 | Medium | 6.1 | 2022-02-10 | A reflected cross-site-scripting attack in web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to execute code… |