2021 CVEs (page 51)
Page 51 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-45429 | Medium | 5.5 | 2022-02-04 | A Buffer Overflow vulnerablity exists in VirusTotal YARA git commit: 605b2edf07ed8eb9a2c61ba22eb2e7c362f47ba7 via yr_set_configuration in yara/libyara/libyara… |
CVE-2021-29398 | Medium | 5.3 | 2022-02-04 | Directory traversal in /northstar/Common/NorthFileManager/fileManagerObjects.jsp Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthe… |
CVE-2021-29397 | High | 7.5 | 2022-02-04 | Cleartext Transmission of Sensitive Information in /northstar/Admin/login.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote local u… |
CVE-2021-29396 | Critical | 9.8 | 2022-02-04 | Systemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to use various functionalities wi… |
CVE-2021-29395 | High | 7.5 | 2022-02-04 | Directory travesal in /northstar/filemanager/download.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to do… |
CVE-2021-29394 | Medium | 6.5 | 2022-02-04 | Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authenticated users to chang… |
CVE-2021-29393 | Critical | 9.8 | 2022-02-04 | Remote Code Execution in cominput.jsp and comoutput.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to inje… |
CVE-2021-43635 | Medium | 6.1 | 2022-02-04 | A Cross Site Scripting (XSS) vulnerability exists in Codex before 1.4.0 via Notebook/Page name field, which allows malicious users to execute arbitrary code vi… |
CVE-2021-46398 | High | 8.8 | 2022-02-04 | A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access t… |
CVE-2021-44978 | Critical | 9.8 | 2022-02-04 | iCMS <= 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution. |
CVE-2021-44977 | High | 7.5 | 2022-02-04 | In iCMS <=8.0.0, a directory traversal vulnerability allows an attacker to read arbitrary files. |
CVE-2021-44886 | Medium | 5.3 | 2022-02-04 | In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the substitute persons didn't have the same permissions as the origina… |
CVE-2021-43145 | High | 8.1 | 2022-02-04 | With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts. |
CVE-2021-44983 | Medium | 4.9 | 2022-02-04 | In taocms 3.0.1 after logging in to the background, there is an Arbitrary file download vulnerability at the File Management column. |
CVE-2021-46320 | High | 7.5 | 2022-02-04 | In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reen… |
CVE-2021-44903 | High | 7.8 | 2022-02-04 | Micro-Star International (MSI) Center Pro <= 2.0.16.0 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the atidgllk.sys, atillk64.sy… |
CVE-2021-44901 | High | 7.8 | 2022-02-04 | Micro-Star International (MSI) Dragon Center <= 2.0.116.0 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the atidgllk.sys, atillk6… |
CVE-2021-44900 | High | 7.8 | 2022-02-04 | Micro-Star International (MSI) App Player <= 4.280.1.6309 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the NTIOLib_X64.sys and B… |
CVE-2021-44899 | High | 7.8 | 2022-02-04 | Micro-Star International (MSI) Center <= 1.0.31.0 is vulnerable to multiple Privilege Escalation vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys… |
CVE-2021-46457 | Critical | 9.8 | 2022-02-04 | D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function ChgSambaUserSettings. This vulnerability al… |
CVE-2021-46456 | Critical | 9.8 | 2022-02-04 | D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanACLSettings. This vulnerability allo… |
CVE-2021-46455 | Critical | 9.8 | 2022-02-04 | D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetStationSettings. This vulnerability allo… |
CVE-2021-46454 | Critical | 9.8 | 2022-02-04 | D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanApcliSettings. This vulnerability al… |
CVE-2021-46453 | Critical | 9.8 | 2022-02-04 | D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetStaticRouteSettings. This vulnerability… |
CVE-2021-46452 | Critical | 9.8 | 2022-02-04 | D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerab… |
CVE-2021-46233 | Critical | 9.8 | 2022-02-04 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function msp_info.htm. This vulnerability allows att… |
CVE-2021-46232 | Critical | 9.8 | 2022-02-04 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function version_upgrade.asp. This vulnerability all… |
CVE-2021-46231 | Critical | 9.8 | 2022-02-04 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function urlrd_opt.asp. This vulnerability allows at… |
CVE-2021-46230 | Critical | 9.8 | 2022-02-04 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function upgrade_filter. This vulnerability allows a… |
CVE-2021-46229 | Critical | 9.8 | 2022-02-04 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function usb_paswd.asp. This vulnerability allows at… |
CVE-2021-46228 | Critical | 9.8 | 2022-02-04 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function httpd_debug.asp. This vulnerability allows… |
CVE-2021-46227 | Critical | 9.8 | 2022-02-04 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function proxy_client.asp. This vulnerability allows… |
CVE-2021-46226 | Critical | 9.8 | 2022-02-04 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wget_test.asp. This vulnerability allows at… |
CVE-2021-45998 | Critical | 9.8 | 2022-02-04 | D-Link device DIR_882 DIR_882_FW1.30B06_Hotfix_02 was discovered to contain a command injection vulnerability in the LocalIPAddress parameter. This vulnerabili… |
CVE-2021-45997 | High | 7.5 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetPortMapping. This vulnerability allows attacker… |
CVE-2021-45996 | High | 7.5 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetPortMapping. This vulnerability allows attacker… |
CVE-2021-45995 | High | 7.5 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetStaticRoute. This vulnerability allows attacker… |
CVE-2021-45994 | High | 7.5 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formDelDhcpRule. This vulnerability allows attackers t… |
CVE-2021-45993 | High | 7.5 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formIPMacBindModify. This vulnerability allows attacke… |
CVE-2021-45992 | High | 7.5 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetQvlanList. This vulnerability allows attackers… |
CVE-2021-45991 | High | 7.5 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formAddVpnUsers. This vulnerability allows attackers t… |
CVE-2021-45990 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function uploadPicture. This vulnerability all… |
CVE-2021-45989 | High | 7.5 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function guestWifiRuleRefresh. This vulnerability allows attack… |
CVE-2021-45988 | High | 7.5 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formAddDnsForward. This vulnerability allows attackers… |
CVE-2021-45987 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetNetCheckTools. This vulnerabil… |
CVE-2021-45986 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetUSBShareInfo. This vulnerabili… |
CVE-2021-45742 | Critical | 9.8 | 2022-02-04 | TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers t… |
CVE-2021-45741 | High | 7.5 | 2022-02-04 | TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setIpv6Cfg. This vulnerability allows attackers to cause a De… |
CVE-2021-45740 | Critical | 9.8 | 2022-02-04 | TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the setWiFiWpsStart function. This vulnerability allows attackers to cause… |
CVE-2021-45739 | High | 7.5 | 2022-02-04 | TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function. This vulnerability allows attackers to cause a Den… |
CVE-2021-45738 | Critical | 9.8 | 2022-02-04 | TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function UploadFirmwareFile. This vulnerability allow… |
CVE-2021-45737 | High | 7.5 | 2022-02-04 | TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function. This vulnerability allows attackers to cause a Den… |
CVE-2021-45736 | High | 7.5 | 2022-02-04 | TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setL2tpServerCfg. This vulnerability allows attackers to caus… |
CVE-2021-45735 | High | 7.5 | 2022-02-04 | TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to use the HTTP protocol for authentication into the admin interface, allowing attackers to intercept use… |
CVE-2021-45734 | High | 7.5 | 2022-02-04 | TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setUrlFilterRules. This vulnerability allows attackers to cau… |
CVE-2021-45733 | Critical | 9.8 | 2022-02-04 | TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function NTPSyncWithHost. This vulnerability allows a… |
CVE-2021-44882 | Critical | 9.8 | 2022-02-04 | D-Link device DIR_878_FW1.30B08_Hotfix_02 was discovered to contain a command injection vulnerability in the twsystem function. This vulnerability allows attac… |
CVE-2021-44881 | Critical | 9.8 | 2022-02-04 | D-Link device DIR_882 DIR_882_FW1.30B06_Hotfix_02 was discovered to contain a command injection vulnerability in the twsystem function. This vulnerability allo… |
CVE-2021-44880 | Critical | 9.8 | 2022-02-04 | D-Link devices DIR_878 DIR_878_FW1.30B08_Hotfix_02 and DIR_882 DIR_882_FW1.30B06_Hotfix_02 were discovered to contain a command injection vulnerability in the… |
CVE-2021-44247 | Critical | 9.8 | 2022-02-04 | Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain command injection vuln… |
CVE-2021-44246 | High | 7.5 | 2022-02-04 | Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain a stack overflow in th… |
CVE-2021-45268 | High | 8.8 | 2022-02-03 | A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution (RCE) on the Hosting… |
CVE-2021-44866 | High | 7.5 | 2022-02-03 | An issue was discovered in Online-Movie-Ticket-Booking-System 1.0. The file about.php does not perform input validation on the 'id' paramter. An attacker can a… |
CVE-2021-43615 | High | 8.2 | 2022-02-03 | An issue was discovered in HddPassword in Insyde InsydeH2O with kernel 5.1 before 05.16.23, 5.2 before 05.26.23, 5.3 before 05.35.23, 5.4 before 05.43.22, and… |
CVE-2021-43323 | High | 8.2 | 2022-02-03 | An issue was discovered in UsbCoreDxe in Insyde InsydeH2O with kernel 5.5 before 05.51.45, 5.4 before 05.43.45, 5.3 before 05.35.45, 5.2 before 05.26.45, 5.1 b… |
CVE-2021-42554 | High | 8.2 | 2022-02-03 | An issue was discovered in Insyde InsydeH2O with Kernel 5.0 before 05.08.42, Kernel 5.1 before 05.16.42, Kernel 5.2 before 05.26.42, Kernel 5.3 before 05.35.42… |
CVE-2021-42113 | High | 8.2 | 2022-02-03 | An issue was discovered in StorageSecurityCommandDxe in Insyde InsydeH2O with Kernel 5.1 before 05.14.28, Kernel 5.2 before 05.24.28, and Kernel 5.3 before 05… |
CVE-2021-42060 | High | 8.2 | 2022-02-03 | An issue was discovered in Insyde InsydeH2O Kernel 5.0 through 05.08.41, Kernel 5.1 through 05.16.41, Kernel 5.2 before 05.23.22, and Kernel 5.3 before 05.32.2… |
CVE-2021-42059 | Medium | 6.7 | 2022-02-03 | An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.08.41, Kernel 5.1 before 05.16.41, Kernel 5.2 before 05.26.41, Kernel 5.3 before 05.35.41, and… |
CVE-2021-41841 | High | 8.2 | 2022-02-03 | An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System M… |
CVE-2021-41840 | High | 8.2 | 2022-02-03 | An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the Syste… |
CVE-2021-41839 | High | 8.2 | 2022-02-03 | An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. Because of an Untrusted Pointer Dereference that causes SMM memory… |
CVE-2021-41838 | High | 8.2 | 2022-02-03 | An issue was discovered in SdHostDriver in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System… |
CVE-2021-41837 | High | 8.2 | 2022-02-03 | An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. Because of an Untrusted Pointer Dereference that causes SMM memory cor… |
CVE-2021-33627 | High | 8.2 | 2022-02-03 | An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.09.11, 5.1 before 05.17.11, 5.2 before 05.27.11, 5.3 before 05.36.11, 5.4 before 05.44.11, and… |
CVE-2021-33625 | High | 7.5 | 2022-02-03 | An issue was discovered in Kernel 5.x in Insyde InsydeH2O, affecting HddPassword. Software SMI services that use the Communicate() function of the EFI_SMM_COMM… |
CVE-2021-43522 | High | 7.5 | 2022-02-03 | An issue was discovered in Insyde InsydeH2O with kernel 5.1 through 2021-11-08, 5.2 through 2021-11-08, and 5.3 through 2021-11-08. A StorageSecurityCommandDxe… |
CVE-2021-39021 | Medium | 5.3 | 2022-02-02 | IBM Guardium Data Encryption (GDE) 5.0.0.2 behaves differently or sends different responses under different circumstances in a way that is observable to an una… |
CVE-2021-42642 | High | 7.5 | 2022-02-02 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticat… |
CVE-2021-42641 | High | 7.5 | 2022-02-02 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticat… |
CVE-2021-42640 | Critical | 9.1 | 2022-02-02 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticat… |
CVE-2021-42639 | Medium | 6.1 | 2022-02-02 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to multiple reflected cross site scripting vulnerabilities. Attacker controlled input is… |
CVE-2021-42637 | Critical | 9.8 | 2022-02-02 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use user-controlled input to craft a URL, resulting in a Server Side Request Forgery (SSRF) vulnerabili… |
CVE-2021-42633 | Medium | 5.3 | 2022-02-02 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to SQL Injection, which may allow an attacker to access additional audit records. |
CVE-2021-41018 | High | 8.8 | 2022-02-02 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below all… |
CVE-2021-39070 | Critical | 9.8 | 2022-02-02 | IBM Security Verify Access 10.0.0.0, 10.0.1.0 and 10.0.2.0 with the advanced access control authentication service enabled could allow an attacker to authentic… |
CVE-2021-39066 | High | 8.8 | 2022-02-02 | IBM Financial Transaction Manager 3.2.4 does not invalidate session any existing session identifier gives an attacker the opportunity to steal authenticated se… |
CVE-2021-39044 | High | 8.8 | 2022-02-02 | IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2021-36193 | Medium | 6.7 | 2022-02-02 | Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code ex… |
CVE-2021-24043 | Critical | 9.1 | 2022-02-02 | A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsApp for iOS v2.21.230… |
CVE-2021-43073 | High | 8.8 | 2022-02-02 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and b… |
CVE-2021-43062 | Medium | 6.1 | 2022-02-02 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below… |
CVE-2021-42753 | High | 8.1 | 2022-02-02 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb management interface 6.4.1 and below, 6.3… |
CVE-2021-41016 | High | 7.8 | 2022-02-02 | A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiExtender version 7.0.1 and below, 4.2.3 and below, 4.1.7… |
CVE-2021-36177 | Medium | 4.2 | 2022-02-02 | An improper access control vulnerability [CWE-284] in FortiAuthenticator HA service 6.3.2 and below, 6.2.x, 6.1.x, 6.0.x may allow an attacker on the same vlan… |
CVE-2021-42638 | High | 8.1 | 2022-02-01 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below do not sanitize user input resulting in pre-auth remote code execution. |
CVE-2021-46093 | Critical | 9.8 | 2022-02-01 | eliteCMS v1.0 is vulnerable to Insecure Permissions via manage_uploads.php. |
CVE-2021-38560 | Medium | 6.1 | 2022-02-01 | Ivanti Service Manager 2021.1 allows reflected XSS via the appName parameter associated with ConfigDB calls, such as in RelocateAttachments.aspx. |
CVE-2021-44746 | Medium | 5.3 | 2022-02-01 | UNIVERGE DT 820 V3.2.7.0 and prior, UNIVERGE DT 830 V5.2.7.0 and prior, UNIVERGE DT 930 V2.4.0.0 and prior, IP Phone Manager V8.9.1 and prior, Data Maintenance… |
CVE-2021-44451 | Medium | 6.5 | 2022-02-01 | Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed… |