2021 CVEs (page 52)
Page 52 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-43510 | Critical | 9.8 | 2022-02-01 | SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the username field in login.php. |
CVE-2021-43509 | Critical | 9.8 | 2022-02-01 | SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the id parameter in view-service.php. |
CVE-2021-46253 | Medium | 5.4 | 2022-02-01 | A cross-site scripting (XSS) vulnerability in the Create Post function of Anchor CMS v0.12.7 allows attackers to execute arbitrary web scripts or HTML. |
CVE-2021-45416 | Medium | 6.1 | 2022-02-01 | Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/S… |
CVE-2021-43848 | High | 7.4 | 2022-02-01 | h2o is an open source http server. In code prior to the `8c0eca3` commit h2o may attempt to access uninitialized memory. When receiving QUIC frames in certain… |
CVE-2021-41571 | Medium | 6.5 | 2022-02-01 | In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-messa… |
CVE-2021-25097 | Medium | 6.5 | 2022-02-01 | The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated use… |
CVE-2021-25093 | High | 7.5 | 2022-02-01 | The Link Library WordPress plugin before 7.2.8 does not have authorisation in place when deleting links, allowing unauthenticated users to delete arbitrary lin… |
CVE-2021-25092 | Medium | 6.5 | 2022-02-01 | The Link Library WordPress plugin before 7.2.8 does not have CSRF check when resetting library settings, allowing attackers to make a logged in admin reset arb… |
CVE-2021-25091 | Medium | 6.1 | 2022-02-01 | The Link Library WordPress plugin before 7.2.9 does not sanitise and escape the settingscopy parameter before outputting it back in an admin page, leading to a… |
CVE-2021-25089 | Medium | 6.1 | 2022-02-01 | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.69 does not sanitise and escape the updraft_restore parameter before outputting it back in… |
CVE-2021-25085 | Medium | 6.1 | 2022-02-01 | The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before outputing back in an admin page, leading to a Reflected C… |
CVE-2021-25072 | Medium | 6.5 | 2022-02-01 | The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing attacker to make a… |
CVE-2021-25063 | Medium | 6.1 | 2022-02-01 | The Skins for Contact Form 7 WordPress plugin before 2.5.1 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading t… |
CVE-2021-24983 | Medium | 6.1 | 2022-02-01 | The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not sanitise and escape POSted parameters sent to the wpassetcleanup_fetch_active_pl… |
CVE-2021-24975 | Medium | 6.1 | 2022-02-01 | The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests before outputting them in the related… |
CVE-2021-24944 | Medium | 4.8 | 2022-02-01 | The Custom Dashboard & Login Page WordPress plugin before 7.0 does not sanitise some of its settings, allowing high privilege users to perform Cross-Site Scrip… |
CVE-2021-24937 | Medium | 6.1 | 2022-02-01 | The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacu_selected_sub_tab_area parameter before outputting it back in an… |
CVE-2021-24934 | Medium | 6.1 | 2022-02-01 | The Visual CSS Style Editor WordPress plugin before 7.5.4 does not sanitise and escape the wyp_page_type parameter before outputting it back in an admin page… |
CVE-2021-24926 | Medium | 6.1 | 2022-02-01 | The Domain Check WordPress plugin before 1.0.17 does not sanitise and escape the domain parameter before outputting it back in the page, leading to a Reflected… |
CVE-2021-24919 | High | 8.8 | 2022-02-01 | The Wicked Folders WordPress plugin before 2.8.10 does not sanitise and escape the folder_id parameter before using it in a SQL statement in the wicked_folders… |
CVE-2021-24900 | Medium | 4.8 | 2022-02-01 | The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow high privilege users to perform Cross-S… |
CVE-2021-24868 | Medium | 4.3 | 2022-02-01 | The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate… |
CVE-2021-24814 | Critical | 9.6 | 2022-02-01 | The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, respond… |
CVE-2021-24775 | Medium | 5.3 | 2022-02-01 | The Document Embedder WordPress plugin before 1.7.5 contains a REST endpoint, which could allow unauthenticated users to enumerate the title of arbitrary priva… |
CVE-2021-24765 | Medium | 6.1 | 2022-02-01 | The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when… |
CVE-2021-24764 | Medium | 6.1 | 2022-02-01 | The Perfect Survey WordPress plugin before 1.5.2 does not sanitise and escape multiple parameters (id and filters[session_id] of single_statistics page, type a… |
CVE-2021-24763 | High | 8.8 | 2022-02-01 | The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the save_global_setting AJAX action, allowing unauthenti… |
CVE-2021-24762 | Critical | 9.8 | 2022-02-01 | The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_quest… |
CVE-2021-24761 | Medium | 6.5 | 2022-02-01 | The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal prevention, which cou… |
CVE-2021-24707 | Medium | 4.8 | 2022-02-01 | The Learning Courses WordPress plugin before 5.0 does not sanitise and escape the Email PDT identity token settings, which could allow high privilege users to… |
CVE-2021-24686 | Medium | 4.8 | 2022-02-01 | The SVG Support WordPress plugin before 2.3.20 does not escape the "CSS Class to target" setting before outputting it in an attribute, which could allow high p… |
CVE-2021-24648 | Medium | 6.1 | 2022-02-01 | The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before outputting back in an attribute, leadin… |
CVE-2021-43859 | High | 7.5 | 2022-02-01 | XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU ti… |
CVE-2021-41040 | High | 7.5 | 2022-02-01 | In Eclipse Wakaama, ever since its inception until 2021-01-14, the CoAP parsing code does not properly sanitize network-received data. |
CVE-2021-46669 | High | 7.5 | 2022-02-01 | MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used. |
CVE-2021-46668 | Medium | 5.5 | 2022-02-01 | MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitation… |
CVE-2021-46667 | Medium | 5.5 | 2022-02-01 | MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash. |
CVE-2021-46666 | Medium | 5.5 | 2022-02-01 | MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause. |
CVE-2021-46665 | Medium | 5.5 | 2022-02-01 | MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations. |
CVE-2021-46664 | Medium | 5.5 | 2022-02-01 | MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr. |
CVE-2021-46663 | Medium | 5.5 | 2022-02-01 | MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements. |
CVE-2021-46662 | Medium | 5.5 | 2022-02-01 | MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction with a nested subquery. |
CVE-2021-46661 | Medium | 5.5 | 2022-02-01 | MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE). |
CVE-2021-46459 | High | 7.5 | 2022-01-31 | Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=add_user. These vulnerabilities can be… |
CVE-2021-44114 | Medium | 4.8 | 2022-01-31 | Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Stock Management System in PHP/OOP 1.0, which allows remote malicious users to execute arbitr… |
CVE-2021-42635 | High | 8.1 | 2022-01-31 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use a hardcoded APP_KEY value, leading to pre-auth remote code execution. |
CVE-2021-42631 | High | 8.1 | 2022-01-31 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below deserializes attacker controlled leading to pre-auth remote code execution. |
CVE-2021-46458 | High | 7.5 | 2022-01-31 | Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=add_post. This vulnerability can be exploited t… |
CVE-2021-40042 | Medium | 6.5 | 2022-01-31 | There is a release of invalid pointer vulnerability in some Huawei products, successful exploit may cause the process and service abnormal. Affected product ve… |
CVE-2021-40033 | Medium | 5.5 | 2022-01-31 | There is an information exposure vulnerability on several Huawei Products. The vulnerability is due to that the software does not properly protect certain info… |
CVE-2021-31617 | Critical | 9.8 | 2022-01-31 | In ASQ in Stormshield Network Security (SNS) 1.0.0 through 2.7.8, 2.8.0 through 2.16.0, 3.0.0 through 3.7.20, 3.8.0 through 3.11.8, and 4.0.1 through 4.2.2, mi… |
CVE-2021-28962 | High | 7.2 | 2022-01-31 | Stormshield Network Security (SNS) before 4.2.2 allows a read-only administrator to gain privileges via CLI commands. |
CVE-2021-46101 | High | 7.5 | 2022-01-31 | In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly. |
CVE-2021-44255 | High | 7.2 | 2022-01-31 | Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration backup file containi… |
CVE-2021-23521 | Medium | 5.5 | 2022-01-31 | This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is crafted with an entry containing a symbo… |
CVE-2021-23520 | Medium | 5.5 | 2022-01-31 | The package juce-framework/juce before 6.1.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) via the ZipFile::uncompressEntry function… |
CVE-2021-45079 | Critical | 9.1 | 2022-01-31 | In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP… |
CVE-2021-34805 | High | 7.5 | 2022-01-31 | An issue was discovered in FAUST iServer before 9.0.019.019.7. For each URL request, it accesses the corresponding .fau file on the operating system without pr… |
CVE-2021-27971 | High | 7.8 | 2022-01-31 | Alps Alpine Touchpad Driver 10.3201.101.215 is vulnerable to DLL Injection. |
CVE-2021-46660 | Critical | 9.8 | 2022-01-30 | Signiant Manager+Agents before 15.1 allows XML External Entity (XXE) attacks. |
CVE-2021-46659 | Medium | 5.5 | 2022-01-29 | MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to each VIEW. |
CVE-2021-46658 | Medium | 5.5 | 2022-01-29 | save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_window_func=true for a subquery. |
CVE-2021-46657 | Medium | 5.5 | 2022-01-29 | get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY. |
CVE-2021-4160 | Medium | 5.9 | 2022-01-28 | There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Im… |
CVE-2021-46448 | Critical | 9.8 | 2022-01-28 | H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/customers.php?page=1&cID. |
CVE-2021-46447 | Medium | 5.4 | 2022-01-28 | A cross-site scripting (XSS) vulnerability in H.H.G Multistore v5.1.0 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload… |
CVE-2021-46446 | Critical | 9.8 | 2022-01-28 | H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_access_group_edit&aagID. |
CVE-2021-46445 | Critical | 9.8 | 2022-01-28 | H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/categories.php?box_group_id. |
CVE-2021-46444 | Critical | 9.8 | 2022-01-28 | H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_group_edit&agID. |
CVE-2021-44419 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44418 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44417 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44416 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44415 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44414 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44413 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44412 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44411 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44410 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44409 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44408 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44407 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44406 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44405 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44404 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44403 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44402 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44401 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44400 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44399 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44398 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44397 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44396 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44395 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44393 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44392 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44391 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44390 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44389 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |