2021 CVEs (page 50)
Page 50 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-45106 | Medium | 6.5 | 2022-02-09 | A vulnerability has been identified in SICAM TOOLBOX II (All versions). Affected applications use a circumventable access control within a database service. Th… |
CVE-2021-44912 | Medium | 5.4 | 2022-02-09 | In XE 1.116, when uploading the Normal button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .hta… |
CVE-2021-44911 | Medium | 5.4 | 2022-02-09 | XE before 1.11.6 is vulnerable to Unrestricted file upload via modules/menu/menu.admin.controller.php. When uploading the Mouse over button and When selected b… |
CVE-2021-44018 | High | 7.8 | 2022-02-09 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (All versions < SE2022… |
CVE-2021-44016 | High | 7.8 | 2022-02-09 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (All versions < SE2022… |
CVE-2021-44000 | High | 7.8 | 2022-02-09 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (All versions < SE2022… |
CVE-2021-40363 | High | 7.8 | 2022-02-09 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMA… |
CVE-2021-40360 | High | 8.8 | 2022-02-09 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMA… |
CVE-2021-37205 | High | 7.5 | 2022-02-09 | A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl… |
CVE-2021-37204 | High | 7.5 | 2022-02-09 | A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9… |
CVE-2021-37194 | High | 7.5 | 2022-02-09 | A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components… |
CVE-2021-37185 | High | 7.5 | 2022-02-09 | A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl… |
CVE-2021-3813 | Medium | 6.5 | 2022-02-09 | Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2. |
CVE-2021-46360 | High | 8.8 | 2022-02-09 | Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell throug… |
CVE-2021-46354 | High | 7.5 | 2022-02-09 | Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cm… |
CVE-2021-40837 | Medium | 4.6 | 2022-02-09 | A vulnerability affecting F-Secure antivirus engine before Capricorn update 2022-02-01_01 was discovered whereby decompression of ACE file causes the scanner s… |
CVE-2021-25939 | Low | 2.7 | 2022-02-09 | In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not… |
CVE-2021-37852 | High | 7.8 | 2022-02-09 | ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the contex… |
CVE-2021-45919 | Medium | 5.4 | 2022-02-08 | Studio 42 elFinder through 2.1.31 allows XSS via an SVG document. |
CVE-2021-45329 | Medium | 6.1 | 2022-02-08 | Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field. |
CVE-2021-45328 | Medium | 6.1 | 2022-02-08 | Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs. |
CVE-2021-45327 | Critical | 9.8 | 2022-02-08 | Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a rem… |
CVE-2021-45326 | High | 8.8 | 2022-02-08 | Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests. |
CVE-2021-45325 | High | 7.5 | 2022-02-08 | Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL. |
CVE-2021-44957 | Medium | 6.5 | 2022-02-08 | Global buffer overflow vulnerability exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23705. Issue is in the jfif_encode function at ffjpeg/src/jf… |
CVE-2021-44956 | Medium | 6.5 | 2022-02-08 | Two Heap based buffer overflow vulnerabilities exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23852. Issues that are in the jfif_decode function… |
CVE-2021-44864 | Medium | 6.5 | 2022-02-08 | TP-Link WR886N 3.0 1.0.1 Build 150127 Rel.34123n is vulnerable to Buffer Overflow. Authenticated attackers can crash router httpd services via /userRpm/PingIfr… |
CVE-2021-20877 | Medium | 4.8 | 2022-02-08 | Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw… |
CVE-2021-45281 | Medium | 6.1 | 2022-02-07 | QuickBox Pro v2.4.8 contains a cross-site scripting (XSS) vulnerability at "adminuseredit.php?usertoedit=XSS", as the user supplied input for the value of this… |
CVE-2021-3861 | High | 8.2 | 2022-02-07 | The RNDIS USB device class includes a buffer overflow vulnerability. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more informati… |
CVE-2021-3835 | High | 8.2 | 2022-02-07 | Buffer overflow in usb device class. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephy… |
CVE-2021-42833 | Critical | 9.3 | 2022-02-07 | A Use of Hardcoded Credentials vulnerability exists in AquaView versions 1.60, 7.x, and 8.x that could allow an authenticated local attacker to manipulate user… |
CVE-2021-25114 | Critical | 9.8 | 2022-02-07 | The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before u… |
CVE-2021-25108 | High | 7.1 | 2022-02-07 | The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing att… |
CVE-2021-25106 | Medium | 5.4 | 2022-02-07 | The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for authorisation and h… |
CVE-2021-25105 | Medium | 4.8 | 2022-02-07 | The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privilege users to perform Cross-Site Scriptin… |
CVE-2021-25103 | Medium | 4.7 | 2022-02-07 | The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in the url_addon/gtranslate-email.php fil… |
CVE-2021-25096 | Medium | 6.5 | 2022-02-07 | The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL |
CVE-2021-25095 | High | 7.1 | 2022-02-07 | The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX a… |
CVE-2021-25084 | Medium | 4.3 | 2022-02-07 | The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do not have authorisation checks in some of… |
CVE-2021-25077 | Medium | 6.1 | 2022-02-07 | The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in an admin page in an… |
CVE-2021-25029 | Medium | 4.8 | 2022-02-07 | The CLUEVO LMS, E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module, which could allow high privilege users to perfo… |
CVE-2021-25004 | Medium | 4.9 | 2022-02-07 | The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to… |
CVE-2021-24993 | Medium | 6.5 | 2022-02-07 | The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticat… |
CVE-2021-24947 | Medium | 6.5 | 2022-02-07 | The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_i… |
CVE-2021-24928 | Medium | 6.5 | 2022-02-07 | The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action, nor validation and esc… |
CVE-2021-24880 | Medium | 5.4 | 2022-02-07 | The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which could allow users with a role as low as… |
CVE-2021-24879 | High | 8.8 | 2022-02-07 | The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escaping in some of the fi… |
CVE-2021-24878 | Medium | 6.1 | 2022-02-07 | The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] s… |
CVE-2021-24843 | Medium | 6.5 | 2022-02-07 | The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make a logged in admin… |
CVE-2021-24839 | High | 7.5 | 2022-02-07 | The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated u… |
CVE-2021-46389 | High | 7.5 | 2022-02-07 | IIPImage High Resolution Streaming Image Server prior to commit 882925b295a80ec992063deffc2a3b0d803c3195 is affected by an integer overflow in iipsrv.fcgi thro… |
CVE-2021-46359 | High | 7.5 | 2022-02-07 | FISCO-BCOS release-3.0.0-rc2 contains a denial of service vulnerability. Some transactions may not be committed successfully, and malicious users may use this… |
CVE-2021-43929 | Medium | 6.5 | 2022-02-07 | Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in Synology DiskStatio… |
CVE-2021-43928 | Critical | 9.9 | 2022-02-07 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving component in Synology Ma… |
CVE-2021-43927 | Medium | 4.7 | 2022-02-07 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in Synology DiskStation… |
CVE-2021-43926 | Medium | 4.7 | 2022-02-07 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Mana… |
CVE-2021-43925 | Medium | 4.7 | 2022-02-07 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Mana… |
CVE-2021-41816 | Critical | 9.8 | 2022-02-06 | CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows… |
CVE-2021-39280 | High | 8.8 | 2022-02-06 | Certain Korenix JetWave devices allow authenticated users to execute arbitrary code as root via /syscmd.asp. This affects 2212X before 1.9.1, 2212S before 1.9… |
CVE-2021-38172 | Critical | 9.8 | 2022-02-05 | perM 0.4.0 has a Buffer Overflow related to strncpy. (Debian initially fixed this in 0.4.0-7.) |
CVE-2021-4154 | High | 8.8 | 2022-02-04 | A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attacker with a user privil… |
CVE-2021-4043 | Medium | 5.5 | 2022-02-04 | NULL Pointer Dereference in GitHub repository gpac/gpac prior to 1.1.0. |
CVE-2021-44779 | High | 7.3 | 2022-02-04 | Unauthenticated SQL Injection (SQLi) vulnerability discovered in [GWA] AutoResponder WordPress plugin (versions <= 2.3), vulnerable at (&listid). No patched ve… |
CVE-2021-44206 | High | 7.3 | 2022-02-04 | Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service. The following products are affected: Acronis Cyber Protect Home… |
CVE-2021-44205 | High | 7.3 | 2022-02-04 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39… |
CVE-2021-44204 | High | 7.8 | 2022-02-04 | Local privilege escalation via named pipe due to improper access control checks. The following products are affected: Acronis Cyber Protect 15 (Windows) before… |
CVE-2021-43841 | Medium | 5.4 | 2022-02-04 | XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an at… |
CVE-2021-40420 | High | 8.8 | 2022-02-04 | A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.1.0.52543. A specially-crafted PDF document can trigg… |
CVE-2021-40403 | Medium | 6.3 | 2022-02-04 | An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked… |
CVE-2021-40401 | High | 8.6 | 2022-02-04 | A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and Gerbv forked 2… |
CVE-2021-38960 | High | 7.5 | 2022-02-04 | IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive information. IBM X-Force ID: 212047. |
CVE-2021-38130 | Medium | 6.5 | 2022-02-04 | A potential Information leakage vulnerability has been identified in versions of Micro Focus Voltage SecureMail Mail Relay prior to 7.3.0.1. The vulnerability… |
CVE-2021-36152 | Critical | 9.8 | 2022-02-04 | Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service. This affects versions <= 0.15.0. Users should update to version 0.16… |
CVE-2021-36151 | Medium | 5.5 | 2022-02-04 | In Apache Gobblin, the Hadoop token is written to a temp file that is visible to all local users on Unix-like systems. This affects versions <= 0.15.0. Users s… |
CVE-2021-32732 | High | 7.5 | 2022-02-04 | ### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tied to that email by… |
CVE-2021-32036 | Medium | 5.4 | 2022-02-04 | An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource dep… |
CVE-2021-29219 | High | 7.8 | 2022-02-04 | A potential local buffer overflow vulnerability has been identified in HPE FlexNetwork 5130 EL Switch Series version: Prior to 5130_EI_7.10.R3507P02. HPE has m… |
CVE-2021-29218 | Medium | 6.7 | 2022-02-04 | A local unquoted search path security vulnerability has been identified in HPE Agentless Management Service for Windows version(s): Prior to 1.44.0.0, 10.96.0… |
CVE-2021-28503 | High | 7.4 | 2022-02-04 | The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows… |
CVE-2021-22288 | High | 7.5 | 2022-02-04 | Improper Input Validation vulnerability in the ABB SPIET800 and PNI800 module allows an attacker to cause the denial of service or make the module unresponsive. |
CVE-2021-22286 | High | 7.5 | 2022-02-04 | Improper Input Validation vulnerability in the ABB SPIET800 and PNI800 module allows an attacker to cause the denial of service or make the module unresponsive. |
CVE-2021-22285 | High | 7.5 | 2022-02-04 | Improper Handling of Exceptional Conditions, Improper Check for Unusual or Exceptional Conditions vulnerability in the ABB SPIET800 and PNI800 module that allo… |
CVE-2021-22284 | High | 8.4 | 2022-02-04 | Incorrect Permission Assignment for Critical Resource vulnerability in OPC Server for AC 800M allows an attacker to execute arbitrary code in the node running… |
CVE-2021-21971 | Medium | 5.9 | 2022-02-04 | An out-of-bounds write vulnerability exists in the URL_decode functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload… |
CVE-2021-21970 | High | 8.1 | 2022-02-04 | An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. The HandleIncomingSea… |
CVE-2021-21969 | High | 8.1 | 2022-02-04 | An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. The HandleIncomingSea… |
CVE-2021-21968 | High | 8.3 | 2022-02-04 | A file write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can… |
CVE-2021-21965 | Critical | 9.3 | 2022-02-04 | A denial of service vulnerability exists in the SeaMax remote configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted… |
CVE-2021-21964 | High | 7.4 | 2022-02-04 | A denial of service vulnerability exists in the Modbus configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted network… |
CVE-2021-21963 | Medium | 5.9 | 2022-02-04 | An information disclosure vulnerability exists in the Web Server functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted man-in-th… |
CVE-2021-21962 | High | 8.1 | 2022-02-04 | A heap-based buffer overflow vulnerability exists in the OTA Update u-download functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A series of spe… |
CVE-2021-21961 | Critical | 10.0 | 2022-02-04 | A stack-based buffer overflow vulnerability exists in the NBNS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted network pac… |
CVE-2021-21960 | Critical | 10.0 | 2022-02-04 | A stack-based buffer overflow vulnerability exists in both the LLMNR functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted netwo… |
CVE-2021-21959 | High | 8.1 | 2022-02-04 | A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. This misconfiguration significantly simplifies a man-in… |
CVE-2021-46671 | Medium | 5.3 | 2022-02-04 | options.c in atftp before 0.7.5 reads past the end of an array, and consequently discloses server-side /etc/group data to a remote client. |
CVE-2021-45408 | Medium | 6.1 | 2022-02-04 | Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "refer… |
CVE-2021-23507 | High | 7.5 | 2022-02-04 | The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into… |
CVE-2021-23497 | High | 7.5 | 2022-02-04 | This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. **Note:** Thi… |
CVE-2021-23470 | High | 8.2 | 2022-02-04 | This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious… |