2021 CVEs (page 55)
Page 55 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-36347 | High | 7.2 | 2022-01-25 | iDRAC9 versions prior to 5.00.20.00 and iDRAC8 versions prior to 2.82.82.82 contain a stack-based buffer overflow vulnerability. An authenticated remote attack… |
CVE-2021-36346 | Medium | 5.3 | 2022-01-25 | Dell iDRAC 8 prior to version 2.82.82.82 contain a denial of service vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerabi… |
CVE-2021-36296 | High | 7.2 | 2022-01-25 | Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious user with privileges ma… |
CVE-2021-36295 | High | 7.2 | 2022-01-25 | Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious user with privileges ma… |
CVE-2021-36294 | Critical | 9.8 | 2022-01-25 | Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability. A remote unauthenticated attacker may exploit this vulne… |
CVE-2021-36289 | High | 7.8 | 2022-01-25 | Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain a sensitive information disclosure vulnerability. A local malicious user may exploit this vulner… |
CVE-2021-43799 | High | 8.6 | 2022-01-25 | Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server prior to 4.9, the ini… |
CVE-2021-4145 | Medium | 6.5 | 2022-01-25 | A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced in mirror_wait_on_c… |
CVE-2021-4133 | High | 8.8 | 2022-01-25 | A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accou… |
CVE-2021-45729 | Medium | 5.4 | 2022-01-25 | The Privilege Escalation vulnerability discovered in the WP Google Map WordPress plugin (versions <= 1.8.0) allows authenticated low-role users to create, edit… |
CVE-2021-43298 | Critical | 9.8 | 2022-01-25 | The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that a… |
CVE-2021-41598 | High | 8.8 | 2022-01-25 | A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authoriz… |
CVE-2021-40337 | Medium | 4.2 | 2022-01-25 | Cross-site Scripting (XSS) vulnerability in Hitachi Energy LinkOne allows an attacker that manages to exploit the vulnerability can take advantage to exploit m… |
CVE-2021-40167 | High | 7.8 | 2022-01-25 | A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation… |
CVE-2021-40159 | High | 7.8 | 2022-01-25 | An Information Disclosure vulnerability for JT files in Autodesk Inventor 2022, 2021, 2020, 2019 in conjunction with other vulnerabilities may lead to code exe… |
CVE-2021-40158 | High | 7.8 | 2022-01-25 | A maliciously crafted JT file in Autodesk Inventor 2022, 2021, 2020, 2019 and AutoCAD 2022 may be forced to read beyond allocated boundaries when parsing the J… |
CVE-2021-38129 | Low | 3.3 | 2022-01-25 | Escalation of privileges vulnerability in Micro Focus in Micro Focus Operations Agent, affecting versions 12.x up to and including 12.21. The vulnerability cou… |
CVE-2021-39031 | High | 8.8 | 2022-01-25 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injection. By using a speci… |
CVE-2021-46087 | Medium | 5.4 | 2022-01-25 | In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the… |
CVE-2021-46086 | High | 7.5 | 2022-01-25 | xzs-mysql >= t3.4.0 is vulnerable to Insecure Permissions. The front end of this open source system is an online examination system. There is an unsafe vulnera… |
CVE-2021-46085 | Medium | 6.5 | 2022-01-25 | OneBlog <= 2.2.8 is vulnerable to Insecure Permissions. Low level administrators can delete high-level administrators beyond their authority. |
CVE-2021-46084 | Medium | 5.4 | 2022-01-25 | uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via "close registration information" input box. |
CVE-2021-46083 | Medium | 5.4 | 2022-01-25 | uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via the input box of the statistical code. |
CVE-2021-46034 | Medium | 6.1 | 2022-01-25 | A problem was found in ForestBlog, as of 2021-12-29, there is a XSS vulnerability that can be injected through the nickname input box. |
CVE-2021-43863 | High | 7.5 | 2022-01-25 | The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. The Nextcloud Android app uses content providers to manage… |
CVE-2021-34870 | Medium | 6.5 | 2022-01-25 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR XR1000 1.0.0.52_1.0.38 routers. Aut… |
CVE-2021-34869 | High | 8.8 | 2022-01-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the… |
CVE-2021-34868 | High | 8.8 | 2022-01-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the… |
CVE-2021-34867 | High | 8.2 | 2022-01-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the… |
CVE-2021-34866 | High | 7.8 | 2022-01-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first obtain the ability… |
CVE-2021-34865 | High | 8.8 | 2022-01-25 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of multiple NETGEAR routers. Authentication is not requ… |
CVE-2021-46089 | Critical | 9.8 | 2022-01-25 | In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges. |
CVE-2021-46033 | Critical | 9.8 | 2022-01-25 | In ForestBlog, as of 2021-12-28, File upload can bypass verification. |
CVE-2021-3850 | Critical | 9.1 | 2022-01-25 | Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21. |
CVE-2021-45847 | Medium | 5.5 | 2022-01-25 | Several missing input validations in the 3MF parser component of Slic3r libslic3r 1.3.0 can each allow an attacker to cause an application crash using a crafte… |
CVE-2021-45846 | Medium | 5.5 | 2022-01-25 | A flaw in the AMF parser of Slic3r libslic3r 1.3.0 allows an attacker to cause an application crash using a crafted AMF document, where a metadata tag lacks a… |
CVE-2021-46113 | High | 8.8 | 2022-01-25 | In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files using the file uplo… |
CVE-2021-45845 | High | 7.8 | 2022-01-25 | The Path Sanity Check script of FreeCAD 0.19 is vulnerable to OS command injection, allowing an attacker to execute arbitrary commands via a crafted FCStd docu… |
CVE-2021-45844 | High | 7.8 | 2022-01-25 | Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to inject OS commands via a crafted filename. |
CVE-2021-45803 | High | 8.8 | 2022-01-25 | MartDevelopers iResturant 1.0 is vulnerable to SQL Injection. SQL Injection occurs because this view parameter value is added to the SQL query without addition… |
CVE-2021-45802 | Critical | 9.8 | 2022-01-25 | MartDevelopers iResturant 1.0 is vulnerable to SQL Injection. SQL Injection occurs because the email and phone parameter values are added to the SQL query with… |
CVE-2021-45343 | Medium | 5.5 | 2022-01-25 | In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted DXF document. |
CVE-2021-45342 | High | 7.8 | 2022-01-25 | A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using… |
CVE-2021-45029 | Critical | 9.8 | 2022-01-25 | Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1. |
CVE-2021-45341 | High | 8.8 | 2022-01-25 | A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using… |
CVE-2021-45340 | Medium | 6.5 | 2022-01-25 | In Libsixel prior to and including v1.10.3, a NULL pointer dereference in the stb_image.h component of libsixel allows attackers to cause a denial of service (… |
CVE-2021-46483 | High | 7.8 | 2022-01-25 | Jsish v3.5.0 was discovered to contain a heap buffer overflow via BooleanConstructor at src/jsiBool.c. |
CVE-2021-46482 | High | 7.8 | 2022-01-25 | Jsish v3.5.0 was discovered to contain a heap buffer overflow via NumberConstructor at src/jsiNumber.c. |
CVE-2021-46481 | Medium | 5.5 | 2022-01-25 | Jsish v3.5.0 was discovered to contain a memory leak via linenoise at src/linenoise.c. |
CVE-2021-46480 | Medium | 5.5 | 2022-01-25 | Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiValueObjDelete in src/jsiEval.c. This vulnerability can lead to a Denial of Service (DoS). |
CVE-2021-46478 | Medium | 5.5 | 2022-01-25 | Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiClearStack in src/jsiEval.c. This vulnerability can lead to a Denial of Service (DoS). |
CVE-2021-46477 | Medium | 5.5 | 2022-01-25 | Jsish v3.5.0 was discovered to contain a heap buffer overflow via RegExp_constructor in src/jsiRegexp.c. This vulnerability can lead to a Denial of Service (Do… |
CVE-2021-46475 | Medium | 5.5 | 2022-01-25 | Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsi_ArraySliceCmd in src/jsiArray.c. This vulnerability can lead to a Denial of Service (DoS). |
CVE-2021-46474 | Medium | 5.5 | 2022-01-25 | Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiEvalCodeSub in src/jsiEval.c. This vulnerability can lead to a Denial of Service (DoS). |
CVE-2021-44994 | Medium | 5.5 | 2022-01-25 | There is an Assertion ''JERRY_CONTEXT (jmem_heap_allocated_size) == 0'' failed at /jerry-core/jmem/jmem-heap.c in Jerryscript 3.0.0. |
CVE-2021-44993 | Medium | 5.5 | 2022-01-25 | There is an Assertion ''ecma_is_value_boolean (base_value)'' failed at /jerry-core/ecma/operations/ecma-get-put-value.c in Jerryscript 3.0.0. |
CVE-2021-44992 | Medium | 5.5 | 2022-01-25 | There is an Assertion ''ecma_object_is_typedarray (obj_p)'' failed at /jerry-core/ecma/operations/ecma-typedarray-object.c in Jerryscript 3.0.0. |
CVE-2021-44988 | High | 7.8 | 2022-01-25 | Jerryscript v3.0.0 and below was discovered to contain a stack overflow via ecma_find_named_property in ecma-helpers.c. |
CVE-2021-43394 | Critical | 9.8 | 2022-01-24 | Unisys OS 2200 Messaging Integration Services (NTSI) 7R3B IC3 and IC4, 7R3C, and 7R3D has an Incorrect Implementation of an Authentication Algorithm. An LDAP p… |
CVE-2021-46451 | Critical | 9.8 | 2022-01-24 | An SQL Injection vulnerabilty exists in Sourcecodester Online Project Time Management System 1.0 via the pid parameter in the load_file function. |
CVE-2021-45226 | Medium | 6.5 | 2022-01-24 | An issue was discovered in COINS Construction Cloud 11.12. Due to improper validation of user-controlled HTTP headers, attackers can cause it to send password-… |
CVE-2021-45225 | Medium | 6.1 | 2022-01-24 | An issue was discovered in COINS Construction Cloud 11.12. Due to improper input neutralization, it is vulnerable to reflected cross-site scripting (XSS) via m… |
CVE-2021-45224 | Medium | 6.1 | 2022-01-24 | An issue was discovered in COINS Construction Cloud 11.12. In several locations throughout the application, JavaScript code is passed as a URL parameter. Attac… |
CVE-2021-45223 | Medium | 6.5 | 2022-01-24 | An issue was discovered in COINS Construction Cloud 11.12. Due to insufficient input neutralization, it is vulnerable to denial of service attacks via forced s… |
CVE-2021-45222 | High | 8.8 | 2022-01-24 | An issue was discovered in COINS Construction Cloud 11.12. Due to logical flaws in the human ressources interface, it is vulnerable to privilege escalation by… |
CVE-2021-43589 | Medium | 6.0 | 2022-01-24 | Dell EMC Unity, Dell EMC UnityVSA and Dell EMC Unity XT versions prior to 5.1.2.0.5.007 contain an operating system (OS) command injection Vulnerability. A loc… |
CVE-2021-43588 | Medium | 4.3 | 2022-01-24 | Dell EMC Data Protection Central version 19.5 contains an Improper Input Validation Vulnerability. A remote unauthenticated attacker could potentially exploit… |
CVE-2021-36349 | Medium | 4.3 | 2022-01-24 | Dell EMC Data Protection Central versions 19.5 and prior contain a Server Side Request Forgery vulnerability in the DPC DNS client processing. A remote malicio… |
CVE-2021-36343 | High | 7.5 | 2022-01-24 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2021-36342 | High | 7.5 | 2022-01-24 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2021-43420 | Critical | 9.8 | 2022-01-24 | SQL injection vulnerability in Login.php in Sourcecodester Online Payment Hub v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the usern… |
CVE-2021-42168 | Medium | 6.1 | 2022-01-24 | Cross Site Scripting (XSS) in Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) by oretnom23, allows attackers to gain the PHPSESID or other unspecif… |
CVE-2021-41930 | Medium | 6.1 | 2022-01-24 | Cross site scripting (XSS) vulnerability in Sourcecodester Online Covid Vaccination Scheduler System v1 by oretnom23, allows attackers to execute arbitrary cod… |
CVE-2021-41928 | Critical | 9.8 | 2022-01-24 | SQL injection in Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) 1.0 by oretnom23, allows attackers to execute arbitrary code via the rid parameter… |
CVE-2021-41929 | Medium | 6.1 | 2022-01-24 | Cross Site Scripting (XSS) in Sourcecodester The Electric Billing Management System 1.0 by oretnom23, allows attackers to execute arbitrary code via the about… |
CVE-2021-41660 | Critical | 9.8 | 2022-01-24 | SQL injection vulnerability in Sourcecodester Patient Appointment Scheduler System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the… |
CVE-2021-41659 | Critical | 9.8 | 2022-01-24 | SQL injection vulnerability in Sourcecodester Banking System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username or password f… |
CVE-2021-35005 | Low | 3.3 | 2022-01-24 | This vulnerability allows local attackers to disclose sensitive information on affected installations of TeamViewer. An attacker must first obtain the ability… |
CVE-2021-41658 | Medium | 5.4 | 2022-01-24 | Cross Site Scripting (XSS) in Sourcecodester Student Quarterly Grading System by oretnom23, allows attackers to execute arbitrary code via the fullname and use… |
CVE-2021-4088 | High | 8.4 | 2022-01-24 | SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authen… |
CVE-2021-41472 | Critical | 9.8 | 2022-01-24 | SQL injection vulnerability in Sourcecodester Simple Membership System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username and… |
CVE-2021-41471 | Critical | 9.8 | 2022-01-24 | SQL injection vulnerability in Sourcecodester South Gate Inn Online Reservation System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via… |
CVE-2021-40909 | Critical | 9.6 | 2022-01-24 | Cross site scripting (XSS) vulnerability in sourcecodester PHP CRUD without Refresh/Reload using Ajax and DataTables Tutorial v1 by oretnom23, allows remote at… |
CVE-2021-40908 | Critical | 9.8 | 2022-01-24 | SQL injection vulnerability in Login.php in Sourcecodester Purchase Order Management System v1 by oretnom23, allows attackers to execute arbitrary SQL commands… |
CVE-2021-40907 | Critical | 9.8 | 2022-01-24 | SQL injection vulnerability in Sourcecodester Storage Unit Rental Management System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the… |
CVE-2021-40596 | Critical | 9.8 | 2022-01-24 | SQL injection vulnerability in Login.php in sourcecodester Online Learning System v2 by oretnom23, allows attackers to execute arbitrary SQL commands via the f… |
CVE-2021-44981 | High | 8.8 | 2022-01-24 | In QuickBox Pro v2.5.8 and below, the config.php file has a variable which takes a GET parameter value and parses it into a shell_exec(''); function without pr… |
CVE-2021-25083 | Medium | 6.1 | 2022-01-24 | The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the s… |
CVE-2021-25080 | Medium | 6.1 | 2022-01-24 | The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORW… |
CVE-2021-25079 | Medium | 6.1 | 2022-01-24 | The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and s… |
CVE-2021-25078 | Medium | 6.1 | 2022-01-24 | The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, al… |
CVE-2021-25076 | High | 8.8 | 2022-01-24 | The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers das… |
CVE-2021-25074 | Medium | 6.1 | 2022-01-24 | The WebP Converter for Media WordPress plugin before 4.0.3 contains a file (passthru.php) which does not validate the src parameter before redirecting the user… |
CVE-2021-25073 | High | 8.8 | 2022-01-24 | The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, allowing attackers to make a logged in ad… |
CVE-2021-25062 | Medium | 6.1 | 2022-01-24 | The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the file_url before outputting it back in an admin page, leadin… |
CVE-2021-25049 | Medium | 4.8 | 2022-01-24 | The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Si… |
CVE-2021-25045 | High | 7.2 | 2022-01-24 | The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forum_id parameter before using it in a SQL statement when editing a forum, l… |
CVE-2021-25035 | Medium | 6.1 | 2022-01-24 | The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting it back in an admin… |
CVE-2021-25031 | Medium | 6.1 | 2022-01-24 | The Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape the effects paramete… |
CVE-2021-25028 | Medium | 6.1 | 2022-01-24 | The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leadi… |