2021 CVEs (page 5)
Page 5 of 235 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-41528 | | 2025-02-07 | An error when handling authorization related to the import / export interfaces on the RISC Platform prior to the saas-2021-12-29 release can potentially be exp… | |
CVE-2021-41527 | | 2025-02-07 | An error related to the 2-factor authorization (2FA) on the RISC Platform prior to the saas-2021-12-29 release can potentially be exploited to bypass the 2FA… | |
CVE-2021-27017 | Medium | 6.6 | 2025-02-07 | Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data. This is resolved in the Puppet Agent 7.4.0 r… |
CVE-2021-3978 | High | 7.5 | 2025-01-29 | When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service def… |
CVE-2021-42718 | Medium | 4.9 | 2025-01-23 | Information Disclosure in API in Replicated Replicated Classic versions prior to 2.53.1 on all platforms allows authenticated users with Admin Console access t… |
CVE-2021-29669 | Medium | 5.4 | 2025-01-12 | IBM Jazz Foundation 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2021-20455 | Low | 3.7 | 2025-01-07 | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical e… |
CVE-2021-27285 | High | 8.4 | 2025-01-06 | An issue was discovered in Inspur ClusterEngine v4.0 that allows attackers to gain escalated Local privileges and execute arbitrary commands via /opt/tsce4/tor… |
CVE-2021-37000 | High | 7.7 | 2024-12-28 | Some Huawei wearables have a permission management vulnerability. |
CVE-2021-22484 | High | 7.5 | 2024-12-28 | Some Huawei wearables have a vulnerability of not verifying the actual data size when reading data. Successful exploitation of this vulnerability may cause… |
CVE-2021-40959 | Medium | 6.1 | 2024-12-20 | A reflected cross-site scripting vulnerability in MONITORAPP Application Insight Web Application Firewall (AIWAF) <= 4.1.6 and <=5.0 was identified on the subp… |
CVE-2021-22501 | | 2024-12-19 | Improper Restriction of XML External Entity Reference vulnerability in OpenText™ Operations Bridge Manager allows Input Data Manipulation. The vulnerability… | |
CVE-2021-26102 | Critical | 9.8 | 2024-12-19 | A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete… |
CVE-2021-32589 | High | 8.1 | 2024-12-19 | A Use After Free (CWE-416) vulnerability in FortiManager version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 and below, version 5.6… |
CVE-2021-26115 | High | 7.8 | 2024-12-19 | An OS command injection (CWE-78) vulnerability in FortiWAN version 4.5.7 and below Command Line Interface may allow a local, authenticated and unprivileged att… |
CVE-2021-26093 | High | 7.3 | 2024-12-19 | An access of uninitialized pointer (CWE-824) vulnerability in FortiWLC versions 8.6.0, 8.5.3 and earlier may allow a local and authenticated attacker to crash… |
CVE-2021-39081 | Medium | 5.9 | 2024-12-19 | IBM Cognos Analytics Mobile for Android 1.1.14 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive info… |
CVE-2021-29827 | Medium | 5.2 | 2024-12-19 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious W… |
CVE-2021-20553 | Medium | 5.4 | 2024-12-19 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary… |
CVE-2021-26281 | Medium | 5.5 | 2024-12-17 | Some parameters of the alarm clock module are improperly stored, leaking some sensitive information. |
CVE-2021-26280 | High | 7.9 | 2024-12-17 | Locally installed application can bypass the permission check and perform system operations that require permission. |
CVE-2021-26279 | Medium | 5.9 | 2024-12-17 | Some parameters of the weather module are improperly stored, leaking some sensitive information. |
CVE-2021-26278 | Medium | 6.3 | 2024-12-17 | The wifi module exposes the interface and has improper permission control, leaking sensitive information about the device. |
CVE-2021-32007 | Low | 3.5 | 2024-12-13 | This issue affects: Secomea GateManager Version 9.5 and all prior versions. Protection Mechanism Failure vulnerability in web server of Secomea GateManager to… |
CVE-2021-29892 | Medium | 5.9 | 2024-12-03 | IBM Cognos Controller 11.0.0 and 11.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Tra… |
CVE-2021-23282 | Medium | 5.2 | 2024-11-25 | Eaton Intelligent Power Manager (IPM) prior to 1.70 is vulnerable to stored Cross site scripting. The vulnerability exists due to insufficient validation of in… |
CVE-2021-38135 | High | 8.6 | 2024-11-22 | Possible External Service Interaction attack in iManager has been discovered in OpenText™ iManager 3.2.6.0000. |
CVE-2021-38134 | Medium | 6.1 | 2024-11-22 | Possible XSS in iManager URL for access Component has been discovered in OpenText™ iManager 3.2.5.0000. |
CVE-2021-38119 | Medium | 6.1 | 2024-11-22 | Possible Reflected Cross-Site Scripting (XSS) Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000. |
CVE-2021-38118 | Medium | 5.5 | 2024-11-22 | Possible improper input validation Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000. |
CVE-2021-38117 | High | 8.8 | 2024-11-22 | Possible Command injection Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000. |
CVE-2021-38116 | High | 8.8 | 2024-11-22 | Possible Elevation of Privilege Vulnerability in iManager has been discovered in OpenText™ iManager. This impacts all versions before 3.2.5 |
CVE-2021-30299 | Medium | 6.7 | 2024-11-22 | Possible out of bound access in audio module due to lack of validation of user provided input. |
CVE-2021-1465 | Medium | 4.3 | 2024-11-18 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a directory tra… |
CVE-2021-1462 | Medium | 6.7 | 2024-11-18 | A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to elevate privileges on an affected system. To e… |
CVE-2021-1461 | Medium | 4.9 | 2024-11-18 | A vulnerability in the Image Signature Verification feature of Cisco SD-WAN Software could allow an authenticated, remote attacker with Administrator-leve… |
CVE-2021-1444 | Medium | 6.1 | 2024-11-18 | A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software c… |
CVE-2021-1440 | Medium | 6.8 | 2024-11-18 | A vulnerability in the implementation of the Resource Public Key Infrastructure (RPKI) feature of Cisco IOS XR Software could allow an unauthenticated, re… |
CVE-2021-1425 | Medium | 4.3 | 2024-11-18 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) could allow an… |
CVE-2021-1424 | Medium | 5.3 | 2024-11-18 | A vulnerability in the ipsecmgr process of Cisco ASR 5000 Series Software (StarOS) could allow an unauthenticated, remote attacker to cause a denial of se… |
CVE-2021-1410 | Medium | 4.3 | 2024-11-18 | A vulnerability in the distribution list feature of Cisco Webex Meetings could allow an authenticated, remote attacker to modify a distribution list that… |
CVE-2021-1379 | Medium | 6.5 | 2024-11-18 | Multiple vulnerabilities in the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) implementations for Cisco IP Phone Series 68xx/78xx… |
CVE-2021-1285 | High | 7.4 | 2024-11-18 | Multiple Cisco products are affected by a vulnerability in the Ethernet Frame Decoder of the Snort detection engine that could allow an unauthenticated, a… |
CVE-2021-1234 | Medium | 5.3 | 2024-11-18 | A vulnerability in the cluster management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to view sensitive inf… |
CVE-2021-1232 | Medium | 6.5 | 2024-11-18 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary fil… |
CVE-2021-1132 | Medium | 5.3 | 2024-11-18 | A vulnerability in the API subsystem and in the web-management interface of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remo… |
CVE-2021-34753 | Medium | 5.8 | 2024-11-15 | A vulnerability in the payload inspection for Ethernet Industrial Protocol (ENIP) traffic for Cisco Firepower Threat Defense (FTD) Software could allow an unau… |
CVE-2021-34752 | Medium | 6.7 | 2024-11-15 | A vulnerability in the CLI of Cisco FTD Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands… |
CVE-2021-34751 | Medium | 4.3 | 2024-11-15 | A vulnerability in the administrative web-based GUI configuration manager of Cisco Firepower Management Center (FMC) Software could allow an authenticated, rem… |
CVE-2021-34750 | Medium | 4.3 | 2024-11-15 | A vulnerability in the administrative web-based GUI configuration manager of Cisco Firepower Management Center Software could allow an authenticated, remote at… |
CVE-2021-1494 | Medium | 5.8 | 2024-11-15 | Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configur… |
CVE-2021-1491 | Medium | 6.5 | 2024-11-15 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary fil… |
CVE-2021-1484 | Medium | 6.5 | 2024-11-15 | A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to inject arbitrary commands on an affected s… |
CVE-2021-1483 | Medium | 6.4 | 2024-11-15 | A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information… |
CVE-2021-1482 | Medium | 6.4 | 2024-11-15 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorizati… |
CVE-2021-1481 | Medium | 4.3 | 2024-11-15 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher que… |
CVE-2021-1470 | Medium | 4.9 | 2024-11-15 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct SQL inject… |
CVE-2021-1466 | Medium | 5.4 | 2024-11-15 | A vulnerability in the vDaemon service of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to cause a buffer overflow on an affe… |
CVE-2021-1464 | Medium | 5.0 | 2024-11-15 | A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization checking and gain restricted access… |
CVE-2021-3991 | Medium | 4.3 | 2024-11-15 | An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. A user with restricted permissions in the 'Reception' sectio… |
CVE-2021-3988 | Medium | 6.1 | 2024-11-15 | A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occurs when editing book… |
CVE-2021-3987 | Medium | 4.3 | 2024-11-15 | An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public sh… |
CVE-2021-3986 | Medium | 4.3 | 2024-11-15 | A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file… |
CVE-2021-3902 | Critical | 9.8 | 2024-11-15 | An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserializatio… |
CVE-2021-3841 | Medium | 5.4 | 2024-11-15 | sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows at… |
CVE-2021-3838 | Critical | 9.8 | 2024-11-15 | DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() func… |
CVE-2021-3742 | High | 8.8 | 2024-11-15 | A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0. The vulnerability allows an atta… |
CVE-2021-3741 | Medium | 5.4 | 2024-11-15 | A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerability occurs when a use… |
CVE-2021-3740 | Medium | 6.8 | 2024-11-15 | A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions on other devices wh… |
CVE-2021-27704 | Medium | 6.5 | 2024-11-12 | Appspace 6.2.4 is affected by Incorrect Access Control via the Appspace Web Portal password reset page. |
CVE-2021-27703 | Medium | 5.4 | 2024-11-12 | Sercomm Model Etisalat Model S3- AC2100 is affected by Cross Site Scripting (XSS) via the firmware update page. |
CVE-2021-27702 | High | 7.3 | 2024-11-12 | Sercomm Router Etisalat Model S3- AC2100 is affected by Incorrect Access Control via the diagnostic utility in the router dashboard. |
CVE-2021-27701 | Medium | 4.7 | 2024-11-12 | SOCIFI Socifi Guest wifi as SAAS is affected by Cross Site Request Forgery (CSRF) via the Socifi wifi portal. The application does not contain a CSRF token and… |
CVE-2021-27700 | High | 7.6 | 2024-11-12 | SOCIFI Socifi Guest wifi as SAAS wifi portal is affected by Insecure Permissions. Any authorized customer with partner mode can switch to another customer dash… |
CVE-2021-41737 | High | 7.5 | 2024-11-10 | In Faust 2.23.1, an input file with the lines "// r visualisation tCst" and "//process = +: L: abM-^Q;" and "process = route(3333333333333333333,2,1,2,3,1) : *… |
CVE-2021-35473 | Critical | 9.1 | 2024-11-10 | An issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in the OAuth2.0 handler, i.e., it does not verify access token vali… |
CVE-2021-4452 | High | 7.1 | 2024-10-16 | The Google Language Translator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in versions up to, and including, 6… |
CVE-2021-4451 | Medium | 6.6 | 2024-10-16 | The NinjaFirewall plugin for WordPress is vulnerable to Authenticated PHAR Deserialization in versions up to, and including, 4.3.3. This allows authenticated a… |
CVE-2021-4450 | High | 8.8 | 2024-10-16 | The Post Grid plugin for WordPress is vulnerable to blind SQL Injection via post metadata in versions up to, and including, 2.1.12 due to insufficient escaping… |
CVE-2021-4449 | Critical | 9.8 | 2024-10-16 | The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, an… |
CVE-2021-4448 | High | 7.3 | 2024-10-16 | The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability… |
CVE-2021-4447 | High | 8.8 | 2024-10-16 | The Essential Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to and including 4.6.4 due to a lack of restricti… |
CVE-2021-4446 | Medium | 6.3 | 2024-10-16 | The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to missing capability c… |
CVE-2021-4445 | Medium | 6.5 | 2024-10-16 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. This is due to missing… |
CVE-2021-4444 | High | 7.3 | 2024-10-16 | The Product Filter by WooBeWoo plugin for WordPress is vulnerable to authorization bypass in versions up to, and including 1.4.9 due to missing authorization c… |
CVE-2021-4443 | Critical | 9.8 | 2024-10-16 | The WordPress Mega Menu plugin for WordPress is vulnerable to Arbitrary File Creation in versions up to, and including, 2.0.6 via the compiler_save AJAX action… |
CVE-2021-37577 | Medium | 6.8 | 2024-10-01 | Bluetooth LE and BR/EDR Secure Connections pairing and Secure Simple Pairing using the Passkey entry protocol in Bluetooth Core Specifications 2.1 through 5.3… |
CVE-2021-38963 | High | 8.0 | 2024-09-25 | IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a CSV injection vulnerabi… |
CVE-2021-38023 | High | 8.8 | 2024-09-23 | Use after free in Extensions in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2021-27917 | High | 7.3 | 2024-09-18 | Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report. |
CVE-2021-27916 | High | 8.1 | 2024-09-17 | Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access th… |
CVE-2021-27915 | High | 7.6 | 2024-09-17 | Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic application which could be exploited by a logged in use… |
CVE-2021-38133 | High | 7.4 | 2024-09-12 | Possible External Service Interaction attack in eDirectory has been discovered in OpenText™ eDirectory. This impact all version before 9.2.6.0000. |
CVE-2021-38132 | Medium | 5.3 | 2024-09-12 | Possible External Service Interaction attack in eDirectory has been discovered in OpenText™ eDirectory. This impact all version before 9.2.6.0000. |
CVE-2021-38131 | Medium | 5.4 | 2024-09-12 | Possible Cross-Site Scripting (XSS) Vulnerability in eDirectory has been discovered in OpenText™ eDirectory 9.2.5.0000. |
CVE-2021-22533 | Medium | 6.5 | 2024-09-12 | Possible Insertion of Sensitive Information into Log File Vulnerability in eDirectory has been discovered in OpenText™ eDirectory 9.2.4.0000. |
CVE-2021-22532 | High | 7.6 | 2024-09-12 | Possible NLDAP Denial of Service attack Vulnerability in eDirectory has been discovered in OpenText™ eDirectory before 9.2.4.0000. |
CVE-2021-22518 | Medium | 5.8 | 2024-09-12 | A vulnerability identified in OpenText™ Identity Manager AzureAD Driver that allows logging of sensitive information into log file. This impacts all versions… |
CVE-2021-22503 | Medium | 5.4 | 2024-09-12 | Possible Improper Neutralization of Input During Web Page Generation Vulnerability in eDirectory has been discovered in OpenText™ eDirectory 9.2.3.0000. |
CVE-2021-4442 | Medium | 5.5 | 2024-08-29 | In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity tests to TCP_QUEUE_SEQ Qingyu Li reported a syzkaller bug where the repro… |