2021 CVEs (page 5)
Page 5 of 227 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-47641 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: video: fbdev: cirrusfb: check pixclock to avoid divide by zero Do a sanity check on pixcl… |
CVE-2021-47640 | High | 7.8 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: powerpc/kasan: Fix early region not updated correctly The shadow's page table is not upda… |
CVE-2021-47639 | High | 7.8 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU Zap both valid and inva… |
CVE-2021-47638 | High | 7.8 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: ubifs: rename_whiteout: Fix double free for whiteout_ui->data 'whiteout_ui->data' will be… |
CVE-2021-47637 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix deadlock in concurrent rename whiteout and inode writeback Following hung task… |
CVE-2021-47636 | High | 7.1 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() Function ubifs_wbuf_write_nolo… |
CVE-2021-47635 | High | 7.8 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix to add refcount once page is set private MM defined the rule [1] very clearly… |
CVE-2021-47634 | High | 7.8 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl Hulk Robot reported a… |
CVE-2021-47633 | High | 7.1 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 The bug was found during fuzzing. Stac… |
CVE-2021-47632 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: powerpc/set_memory: Avoid spinlock recursion in change_page_attr() Commit 1f9ad21c3b38 ("… |
CVE-2021-47631 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: ARM: davinci: da850-evm: Avoid NULL pointer dereference With newer versions of GCC, there… |
CVE-2021-46686 | Critical | 9.8 | 2025-02-18 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in acmailer CGI ver.4.0.3 and earlier and acmailer DB v… |
CVE-2021-41528 | | 2025-02-07 | An error when handling authorization related to the import / export interfaces on the RISC Platform prior to the saas-2021-12-29 release can potentially be exp… | |
CVE-2021-41527 | | 2025-02-07 | An error related to the 2-factor authorization (2FA) on the RISC Platform prior to the saas-2021-12-29 release can potentially be exploited to bypass the 2FA… | |
CVE-2021-27017 | Medium | 6.6 | 2025-02-07 | Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data. This is resolved in the Puppet Agent 7.4.0 r… |
CVE-2021-3978 | High | 7.5 | 2025-01-29 | When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service def… |
CVE-2021-42718 | Medium | 4.9 | 2025-01-23 | Information Disclosure in API in Replicated Replicated Classic versions prior to 2.53.1 on all platforms allows authenticated users with Admin Console access t… |
CVE-2021-29669 | Medium | 5.4 | 2025-01-12 | IBM Jazz Foundation 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2021-20455 | Low | 3.7 | 2025-01-07 | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical e… |
CVE-2021-27285 | High | 8.4 | 2025-01-06 | An issue was discovered in Inspur ClusterEngine v4.0 that allows attackers to gain escalated Local privileges and execute arbitrary commands via /opt/tsce4/tor… |
CVE-2021-37000 | High | 7.7 | 2024-12-28 | Some Huawei wearables have a permission management vulnerability. |
CVE-2021-22484 | High | 7.5 | 2024-12-28 | Some Huawei wearables have a vulnerability of not verifying the actual data size when reading data. Successful exploitation of this vulnerability may cause… |
CVE-2021-40959 | Medium | 6.1 | 2024-12-20 | A reflected cross-site scripting vulnerability in MONITORAPP Application Insight Web Application Firewall (AIWAF) <= 4.1.6 and <=5.0 was identified on the subp… |
CVE-2021-22501 | | 2024-12-19 | Improper Restriction of XML External Entity Reference vulnerability in OpenText™ Operations Bridge Manager allows Input Data Manipulation. The vulnerability… | |
CVE-2021-26102 | Critical | 9.8 | 2024-12-19 | A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete… |
CVE-2021-32589 | High | 8.1 | 2024-12-19 | A Use After Free (CWE-416) vulnerability in FortiManager version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 and below, version 5.6… |
CVE-2021-26115 | High | 7.8 | 2024-12-19 | An OS command injection (CWE-78) vulnerability in FortiWAN version 4.5.7 and below Command Line Interface may allow a local, authenticated and unprivileged att… |
CVE-2021-26093 | High | 7.3 | 2024-12-19 | An access of uninitialized pointer (CWE-824) vulnerability in FortiWLC versions 8.6.0, 8.5.3 and earlier may allow a local and authenticated attacker to crash… |
CVE-2021-39081 | Medium | 5.9 | 2024-12-19 | IBM Cognos Analytics Mobile for Android 1.1.14 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive info… |
CVE-2021-29827 | Medium | 5.2 | 2024-12-19 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious W… |
CVE-2021-20553 | Medium | 5.4 | 2024-12-19 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary… |
CVE-2021-26281 | Medium | 5.5 | 2024-12-17 | Some parameters of the alarm clock module are improperly stored, leaking some sensitive information. |
CVE-2021-26280 | High | 7.9 | 2024-12-17 | Locally installed application can bypass the permission check and perform system operations that require permission. |
CVE-2021-26279 | Medium | 5.9 | 2024-12-17 | Some parameters of the weather module are improperly stored, leaking some sensitive information. |
CVE-2021-26278 | Medium | 6.3 | 2024-12-17 | The wifi module exposes the interface and has improper permission control, leaking sensitive information about the device. |
CVE-2021-32007 | Low | 3.5 | 2024-12-13 | This issue affects: Secomea GateManager Version 9.5 and all prior versions. Protection Mechanism Failure vulnerability in web server of Secomea GateManager to… |
CVE-2021-29892 | Medium | 5.9 | 2024-12-03 | IBM Cognos Controller 11.0.0 and 11.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Tra… |
CVE-2021-23282 | Medium | 5.2 | 2024-11-25 | Eaton Intelligent Power Manager (IPM) prior to 1.70 is vulnerable to stored Cross site scripting. The vulnerability exists due to insufficient validation of in… |
CVE-2021-38135 | High | 8.6 | 2024-11-22 | Possible External Service Interaction attack in iManager has been discovered in OpenText™ iManager 3.2.6.0000. |
CVE-2021-38134 | Medium | 6.1 | 2024-11-22 | Possible XSS in iManager URL for access Component has been discovered in OpenText™ iManager 3.2.5.0000. |
CVE-2021-38119 | Medium | 6.1 | 2024-11-22 | Possible Reflected Cross-Site Scripting (XSS) Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000. |
CVE-2021-38118 | Medium | 5.5 | 2024-11-22 | Possible improper input validation Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000. |
CVE-2021-38117 | High | 8.8 | 2024-11-22 | Possible Command injection Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000. |
CVE-2021-38116 | High | 8.8 | 2024-11-22 | Possible Elevation of Privilege Vulnerability in iManager has been discovered in OpenText™ iManager. This impacts all versions before 3.2.5 |
CVE-2021-30299 | Medium | 6.7 | 2024-11-22 | Possible out of bound access in audio module due to lack of validation of user provided input. |
CVE-2021-1465 | Medium | 4.3 | 2024-11-18 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a directory tra… |
CVE-2021-1462 | Medium | 6.7 | 2024-11-18 | A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to elevate privileges on an affected system. To e… |
CVE-2021-1461 | Medium | 4.9 | 2024-11-18 | A vulnerability in the Image Signature Verification feature of Cisco SD-WAN Software could allow an authenticated, remote attacker with Administrator-leve… |
CVE-2021-1444 | Medium | 6.1 | 2024-11-18 | A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software c… |
CVE-2021-1440 | Medium | 6.8 | 2024-11-18 | A vulnerability in the implementation of the Resource Public Key Infrastructure (RPKI) feature of Cisco IOS XR Software could allow an unauthenticated, re… |
CVE-2021-1425 | Medium | 4.3 | 2024-11-18 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) could allow an… |
CVE-2021-1424 | Medium | 5.3 | 2024-11-18 | A vulnerability in the ipsecmgr process of Cisco ASR 5000 Series Software (StarOS) could allow an unauthenticated, remote attacker to cause a denial of se… |
CVE-2021-1410 | Medium | 4.3 | 2024-11-18 | A vulnerability in the distribution list feature of Cisco Webex Meetings could allow an authenticated, remote attacker to modify a distribution list that… |
CVE-2021-1379 | Medium | 6.5 | 2024-11-18 | Multiple vulnerabilities in the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) implementations for Cisco IP Phone Series 68xx/78xx… |
CVE-2021-1285 | High | 7.4 | 2024-11-18 | Multiple Cisco products are affected by a vulnerability in the Ethernet Frame Decoder of the Snort detection engine that could allow an unauthenticated, a… |
CVE-2021-1234 | Medium | 5.3 | 2024-11-18 | A vulnerability in the cluster management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to view sensitive inf… |
CVE-2021-1232 | Medium | 6.5 | 2024-11-18 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary fil… |
CVE-2021-1132 | Medium | 5.3 | 2024-11-18 | A vulnerability in the API subsystem and in the web-management interface of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remo… |
CVE-2021-34753 | Medium | 5.8 | 2024-11-15 | A vulnerability in the payload inspection for Ethernet Industrial Protocol (ENIP) traffic for Cisco Firepower Threat Defense (FTD) Software could allow an unau… |
CVE-2021-34752 | Medium | 6.7 | 2024-11-15 | A vulnerability in the CLI of Cisco FTD Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands… |
CVE-2021-34751 | Medium | 4.3 | 2024-11-15 | A vulnerability in the administrative web-based GUI configuration manager of Cisco Firepower Management Center (FMC) Software could allow an authenticated, rem… |
CVE-2021-34750 | Medium | 4.3 | 2024-11-15 | A vulnerability in the administrative web-based GUI configuration manager of Cisco Firepower Management Center Software could allow an authenticated, remote at… |
CVE-2021-1494 | Medium | 5.8 | 2024-11-15 | Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configur… |
CVE-2021-1491 | Medium | 6.5 | 2024-11-15 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary fil… |
CVE-2021-1484 | Medium | 6.5 | 2024-11-15 | A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to inject arbitrary commands on an affected s… |
CVE-2021-1483 | Medium | 6.4 | 2024-11-15 | A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information… |
CVE-2021-1482 | Medium | 6.4 | 2024-11-15 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorizati… |
CVE-2021-1481 | Medium | 4.3 | 2024-11-15 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher que… |
CVE-2021-1470 | Medium | 4.9 | 2024-11-15 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct SQL inject… |
CVE-2021-1466 | Medium | 5.4 | 2024-11-15 | A vulnerability in the vDaemon service of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to cause a buffer overflow on an affe… |
CVE-2021-1464 | Medium | 5.0 | 2024-11-15 | A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization checking and gain restricted access… |
CVE-2021-3991 | Medium | 4.3 | 2024-11-15 | An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. A user with restricted permissions in the 'Reception' sectio… |
CVE-2021-3988 | Medium | 6.1 | 2024-11-15 | A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occurs when editing book… |
CVE-2021-3987 | Medium | 4.3 | 2024-11-15 | An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public sh… |
CVE-2021-3986 | Medium | 4.3 | 2024-11-15 | A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file… |
CVE-2021-3902 | Critical | 9.8 | 2024-11-15 | An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserializatio… |
CVE-2021-3841 | Medium | 5.4 | 2024-11-15 | sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows at… |
CVE-2021-3838 | Critical | 9.8 | 2024-11-15 | DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() func… |
CVE-2021-3742 | High | 8.8 | 2024-11-15 | A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0. The vulnerability allows an atta… |
CVE-2021-3741 | Medium | 5.4 | 2024-11-15 | A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerability occurs when a use… |
CVE-2021-3740 | Medium | 6.8 | 2024-11-15 | A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions on other devices wh… |
CVE-2021-27704 | Medium | 6.5 | 2024-11-12 | Appspace 6.2.4 is affected by Incorrect Access Control via the Appspace Web Portal password reset page. |
CVE-2021-27703 | Medium | 5.4 | 2024-11-12 | Sercomm Model Etisalat Model S3- AC2100 is affected by Cross Site Scripting (XSS) via the firmware update page. |
CVE-2021-27702 | High | 7.3 | 2024-11-12 | Sercomm Router Etisalat Model S3- AC2100 is affected by Incorrect Access Control via the diagnostic utility in the router dashboard. |
CVE-2021-27701 | Medium | 4.7 | 2024-11-12 | SOCIFI Socifi Guest wifi as SAAS is affected by Cross Site Request Forgery (CSRF) via the Socifi wifi portal. The application does not contain a CSRF token and… |
CVE-2021-27700 | High | 7.6 | 2024-11-12 | SOCIFI Socifi Guest wifi as SAAS wifi portal is affected by Insecure Permissions. Any authorized customer with partner mode can switch to another customer dash… |
CVE-2021-41737 | High | 7.5 | 2024-11-10 | In Faust 2.23.1, an input file with the lines "// r visualisation tCst" and "//process = +: L: abM-^Q;" and "process = route(3333333333333333333,2,1,2,3,1) : *… |
CVE-2021-35473 | Critical | 9.1 | 2024-11-10 | An issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in the OAuth2.0 handler, i.e., it does not verify access token vali… |
CVE-2021-4452 | High | 7.1 | 2024-10-16 | The Google Language Translator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in versions up to, and including, 6… |
CVE-2021-4451 | Medium | 6.6 | 2024-10-16 | The NinjaFirewall plugin for WordPress is vulnerable to Authenticated PHAR Deserialization in versions up to, and including, 4.3.3. This allows authenticated a… |
CVE-2021-4450 | High | 8.8 | 2024-10-16 | The Post Grid plugin for WordPress is vulnerable to blind SQL Injection via post metadata in versions up to, and including, 2.1.12 due to insufficient escaping… |
CVE-2021-4449 | Critical | 9.8 | 2024-10-16 | The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, an… |
CVE-2021-4448 | High | 7.3 | 2024-10-16 | The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability… |
CVE-2021-4447 | High | 8.8 | 2024-10-16 | The Essential Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to and including 4.6.4 due to a lack of restricti… |
CVE-2021-4446 | Medium | 6.3 | 2024-10-16 | The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to missing capability c… |
CVE-2021-4445 | Medium | 6.5 | 2024-10-16 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. This is due to missing… |
CVE-2021-4444 | High | 7.3 | 2024-10-16 | The Product Filter by WooBeWoo plugin for WordPress is vulnerable to authorization bypass in versions up to, and including 1.4.9 due to missing authorization c… |
CVE-2021-4443 | Critical | 9.8 | 2024-10-16 | The WordPress Mega Menu plugin for WordPress is vulnerable to Arbitrary File Creation in versions up to, and including, 2.0.6 via the compiler_save AJAX action… |
CVE-2021-37577 | Medium | 6.8 | 2024-10-01 | Bluetooth LE and BR/EDR Secure Connections pairing and Secure Simple Pairing using the Passkey entry protocol in Bluetooth Core Specifications 2.1 through 5.3… |
CVE-2021-38963 | High | 8.0 | 2024-09-25 | IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a CSV injection vulnerabi… |