2021 CVEs (page 56)
Page 56 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-25017 | Medium | 6.1 | 2022-01-24 | The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Refl… |
CVE-2021-25015 | Medium | 6.1 | 2022-01-24 | The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page, leading to a Refl… |
CVE-2021-25013 | Medium | 6.5 | 2022-01-24 | The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does not ensure that the… |
CVE-2021-25008 | Medium | 6.1 | 2022-01-24 | The Code Snippets WordPress plugin before 2.14.3 does not escape the snippets-safe-mode parameter before outputting it back in attributes, leading to a Reflect… |
CVE-2021-24989 | Medium | 6.5 | 2022-01-24 | The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the… |
CVE-2021-24985 | Medium | 6.1 | 2022-01-24 | The Easy Forms for Mailchimp WordPress plugin before 6.8.6 does not sanitise and escape the field_name and field_type parameters before outputting them back in… |
CVE-2021-24976 | Medium | 6.1 | 2022-01-24 | The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optim… |
CVE-2021-24974 | Medium | 5.4 | 2022-01-24 | The Product Feed PRO for WooCommerce WordPress plugin before 11.0.7 does not have authorisation and CSRF check in some of its AJAX actions, allowing any authen… |
CVE-2021-24968 | Medium | 5.7 | 2022-01-24 | The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX… |
CVE-2021-24965 | Medium | 5.4 | 2022-01-24 | The Five Star Restaurant Reservations WordPress plugin before 2.4.8 does not have capability and CSRF checks in the rtb_welcome_set_schedule AJAX action, allow… |
CVE-2021-24936 | High | 8.0 | 2022-01-24 | The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of them, which could allo… |
CVE-2021-24923 | Medium | 6.1 | 2022-01-24 | The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before… |
CVE-2021-24906 | High | 7.5 | 2022-01-24 | The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users… |
CVE-2021-24865 | High | 7.2 | 2022-01-24 | The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, l… |
CVE-2021-24858 | High | 7.2 | 2022-01-24 | The Cookie Notification Plugin for WordPress plugin before 1.0.9 does not sanitise or escape the id GET parameter before using it in a SQL statement, when retr… |
CVE-2021-24733 | Medium | 4.3 | 2022-01-24 | The WP Post Page Clone WordPress plugin before 1.2 allows users with a role as low as Contributor to clone and view other users' draft and password-protected p… |
CVE-2021-24696 | High | 8.8 | 2022-01-24 | The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins… |
CVE-2021-24694 | Medium | 5.4 | 2022-01-24 | The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attack vi… |
CVE-2021-24423 | Medium | 4.8 | 2022-01-24 | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privilege users to set mal… |
CVE-2021-39293 | High | 7.5 | 2022-01-24 | In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader o… |
CVE-2021-30636 | Critical | 9.8 | 2022-01-24 | In MediaTek LinkIt SDK before 4.6.1, there is a possible memory corruption due to an integer overflow during mishandled memory allocation by pvPortCalloc and p… |
CVE-2021-26706 | Critical | 9.8 | 2022-01-24 | An issue was discovered in lib_mem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for integer overflow wh… |
CVE-2021-46024 | Critical | 9.8 | 2022-01-23 | Projectworlds online-shopping-webvsite-in-php 1.0 suffers from a SQL Injection vulnerability via the "id" parameter in cart_add.php, No login is required. |
CVE-2021-45380 | Medium | 6.1 | 2022-01-23 | AppCMS 2.0.101 has a XSS injection vulnerability in \templates\m\inc_head.php |
CVE-2021-4103 | Medium | 5.4 | 2022-01-23 | Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 1.0.34. |
CVE-2021-4172 | Medium | 5.4 | 2022-01-22 | Cross-site Scripting (XSS) - Stored in GitHub repository star7th/showdoc prior to 2.10.2. |
CVE-2021-39480 | High | 7.5 | 2022-01-21 | Bingrep v0.8.5 was discovered to contain a memory allocation failure which can cause a Denial of Service (DoS). |
CVE-2021-46313 | Medium | 5.5 | 2022-01-21 | The binary MP4Box in GPAC v1.0.1 was discovered to contain a segmentation fault via the function __memmove_avx_unaligned_erms (). This vulnerability can lead t… |
CVE-2021-46311 | Medium | 5.5 | 2022-01-21 | A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_sg_destroy_routes () at scenegraph/vrml_route.c. This vulnerability can lead… |
CVE-2021-46244 | Medium | 6.5 | 2022-01-21 | A Divide By Zero vulnerability exists in HDF5 v1.13.1-1 vis the function H5T__complete_copy () at /hdf5/src/H5T.c. This vulnerability causes an aritmetic excep… |
CVE-2021-46243 | Medium | 6.5 | 2022-01-21 | An untrusted pointer dereference vulnerability exists in HDF5 v1.13.1-1 via the function H5O__dtype_decode_helper () at hdf5/src/H5Odtype.c. This vulnerability… |
CVE-2021-46242 | High | 8.8 | 2022-01-21 | HDF5 v1.13.1-1 was discovered to contain a heap-use-after free via the component H5AC_unpin_entry. |
CVE-2021-46240 | Medium | 5.5 | 2022-01-21 | A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_dump_vrml_sffield () at scene_manager/scene_dump.c. This vulnerability can l… |
CVE-2021-46239 | Medium | 5.5 | 2022-01-21 | The binary MP4Box in GPAC v1.1.0 was discovered to contain an invalid free vulnerability via the function gf_free () at utils/alloc.c. This vulnerability can l… |
CVE-2021-46238 | Medium | 5.5 | 2022-01-21 | GPAC v1.1.0 was discovered to contain a stack overflow via the function gf_node_get_name () at scenegraph/base_scenegraph.c. This vulnerability can lead to a p… |
CVE-2021-46237 | Medium | 5.5 | 2022-01-21 | An untrusted pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_node_unregister () at scenegraph/base_scenegraph.c. This vulnerability… |
CVE-2021-46236 | Medium | 5.5 | 2022-01-21 | A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_sg_vrml_field_pointer_del () at scenegraph/vrml_tools.c. This vulnerability… |
CVE-2021-46234 | Medium | 5.5 | 2022-01-21 | A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_node_unregister () at scenegraph/base_scenegraph.c. This vulnerability can l… |
CVE-2021-36339 | High | 7.8 | 2022-01-21 | The Dell EMC Virtual Appliances before 9.2.2.2 contain undocumented user accounts. A local malicious user may potentially exploit this vulnerability to get pri… |
CVE-2021-36338 | Medium | 6.3 | 2022-01-21 | Unisphere for PowerMax versions prior to 9.2.2.2 contains a privilege escalation vulnerability. An adjacent malicious user could potentially exploit this vulne… |
CVE-2021-40595 | Critical | 9.8 | 2022-01-21 | SQL injection vulnerability in Sourcecodester Online Leave Management System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the userna… |
CVE-2021-23664 | High | 8.6 | 2022-01-21 | The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redi… |
CVE-2021-23631 | High | 7.5 | 2022-01-21 | This affects all versions of package convert-svg-core; all versions of package convert-svg-to-png; all versions of package convert-svg-to-jpeg. Using a special… |
CVE-2021-23518 | High | 7.3 | 2022-01-21 | The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in… |
CVE-2021-23460 | High | 7.5 | 2022-01-21 | The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types. |
CVE-2021-4032 | Medium | 4.4 | 2022-01-21 | A vulnerability was found in the Linux kernel's KVM subsystem in arch/x86/kvm/lapic.c kvm_free_lapic when a failure allocation was detected. In this flaw the K… |
CVE-2021-4001 | Medium | 4.1 | 2022-01-21 | A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In… |
CVE-2021-44593 | High | 8.1 | 2022-01-21 | Simple College Website 1.0 is vulnerable to unauthenticated file upload & remote code execution via UNION-based SQL injection in the username parameter on /adm… |
CVE-2021-44464 | Medium | 6.3 | 2022-01-21 | Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 contains service credentials likely to be common across all instances. An attacker in possession… |
CVE-2021-43355 | High | 7.3 | 2022-01-21 | Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without authentication by the… |
CVE-2021-41835 | High | 7.3 | 2022-01-21 | Fresenius Kabi Agilia Link + version 3.0 does not enforce transport layer encryption. Therefore, transmitted data may be sent in cleartext. Transport layer enc… |
CVE-2021-40247 | Critical | 9.8 | 2022-01-21 | SQL injection vulnerability in Sourcecodester Budget and Expense Tracker System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the use… |
CVE-2021-33966 | Medium | 5.4 | 2022-01-21 | Cross site scripting (XSS) vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page. |
CVE-2021-33848 | Medium | 5.4 | 2022-01-21 | Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 is vulnerable to reflected cross-site scripting attacks. An attacker could inject… |
CVE-2021-33846 | Medium | 5.9 | 2022-01-21 | Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 issues authentication tokens to authenticated users that are signed with a symmetr… |
CVE-2021-33843 | Medium | 5.3 | 2022-01-21 | Fresenius Kabi Agilia SP MC WiFi vD25 and prior has a default configuration page accessible without authentication. An attacker may use this functionality to c… |
CVE-2021-31562 | Medium | 6.5 | 2022-01-21 | The SSL/TLS configuration of Fresenius Kabi Agilia Link + version 3.0 has serious deficiencies that may allow an attacker to compromise SSL/TLS sessions in dif… |
CVE-2021-23236 | High | 7.5 | 2022-01-21 | Requests may be used to interrupt the normal operation of the device. When exploited, Fresenius Kabi Agilia Link+ version 3.0 must be rebooted via a hard reset… |
CVE-2021-23233 | High | 7.3 | 2022-01-21 | Sensitive endpoints in Fresenius Kabi Agilia Link+ v3.0 and prior can be accessed without any authentication information such as the session cookie. An attacke… |
CVE-2021-23207 | Medium | 6.5 | 2022-01-21 | An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed ve… |
CVE-2021-23196 | High | 7.3 | 2022-01-21 | The web application on Agilia Link+ version 3.0 implements authentication and session management mechanisms exclusively on the client-side and does not protect… |
CVE-2021-23195 | Medium | 5.3 | 2022-01-21 | Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 has the option for automated indexing (directory listing) activated. When accessin… |
CVE-2021-4016 | Medium | 4.0 | 2022-01-21 | Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot directory. An… |
CVE-2021-46309 | Critical | 9.8 | 2022-01-21 | An SQL Injection vulnerability exists in Sourcecodester Employee and Visitor Gate Pass Logging System 1.0 via the username parameter. |
CVE-2021-46308 | Critical | 9.8 | 2022-01-21 | An SQL Injection vulnerability exists in Sourcecodester Online Railway Reservation Sysytem 1.0 via the sid parameter. |
CVE-2021-46307 | Critical | 9.8 | 2022-01-21 | An SQL Injection vulnerability exists in Projectworlds Online Examination System 1.0 via the eid parameter in account.php. |
CVE-2021-46201 | Critical | 9.8 | 2022-01-21 | An SQL Injection vulnerability exists in Sourcecodester Online Resort Management System 1.0 via the id parameterv in /orms/ node. |
CVE-2021-46200 | Critical | 9.8 | 2022-01-21 | An SQL Injection vulnerability exists in Sourcecodester Simple Music Clour Community System 1.0 via the email parameter in /music/ajax.php. |
CVE-2021-46198 | Critical | 9.8 | 2022-01-21 | An SQL Injection vulnerability exists in Sourceodester Courier Management System 1.0 via the email parameter in /cms/ajax.php app. |
CVE-2021-40855 | Critical | 9.8 | 2022-01-21 | The EU Technical Specifications for Digital COVID Certificates before 1.1 mishandle certificate governance. A non-production public key certificate could have… |
CVE-2021-35004 | Critical | 9.8 | 2022-01-21 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link TL-WA1201 1.0.1 Build 20200709 rel.66244(5553) wirele… |
CVE-2021-35003 | Critical | 9.8 | 2022-01-21 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer C90 1.0.6 Build 20200114 rel.73164(5553) route… |
CVE-2021-46351 | Medium | 5.5 | 2022-01-20 | There is an Assertion 'local_tza == ecma_date_local_time_zone_adjustment (date_value)' failed at /jerry-core/ecma/builtin-objects/ecma-builtin-date-prototype.c… |
CVE-2021-46350 | Medium | 5.5 | 2022-01-20 | There is an Assertion 'ecma_is_value_object (value)' failed at jerryscript/jerry-core/ecma/base/ecma-helpers-value.c in JerryScript 3.0.0. |
CVE-2021-46349 | Medium | 5.5 | 2022-01-20 | There is an Assertion 'type == ECMA_OBJECT_TYPE_GENERAL || type == ECMA_OBJECT_TYPE_PROXY' failed at /jerry-core/ecma/operations/ecma-objects.c in JerryScript… |
CVE-2021-46348 | Medium | 5.5 | 2022-01-20 | There is an Assertion 'ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p)' failed at /jerry-core/ecma/base/ecma-literal-storage.c in JerryScript 3.0.0. |
CVE-2021-46347 | Medium | 5.5 | 2022-01-20 | There is an Assertion 'ecma_object_check_class_name_is_object (obj_p)' failed at /jerry-core/ecma/operations/ecma-objects.c in JerryScript 3.0.0. |
CVE-2021-46346 | Medium | 5.5 | 2022-01-20 | There is an Assertion 'local_tza == ecma_date_local_time_zone_adjustment (date_value)' failed at /jerry-core/ecma/builtin-objects/ecma-builtin-date-prototype.c… |
CVE-2021-46345 | Medium | 5.5 | 2022-01-20 | There is an Assertion 'cesu8_cursor_p == cesu8_end_p' failed at /jerry-core/lit/lit-strings.c in JerryScript 3.0.0. |
CVE-2021-46344 | Medium | 5.5 | 2022-01-20 | There is an Assertion 'flags & PARSER_PATTERN_HAS_REST_ELEMENT' failed at /jerry-core/parser/js/js-parser-expr.c in JerryScript 3.0.0. |
CVE-2021-46343 | Medium | 5.5 | 2022-01-20 | There is an Assertion 'context_p->token.type == LEXER_LITERAL' failed at /jerry-core/parser/js/js-parser-expr.c in JerryScript 3.0.0. |
CVE-2021-46342 | Medium | 5.5 | 2022-01-20 | There is an Assertion 'ecma_is_lexical_environment (obj_p) || !ecma_op_object_is_fast_array (obj_p)' failed at /jerry-core/ecma/base/ecma-helpers.c in JerryScr… |
CVE-2021-46340 | Medium | 5.5 | 2022-01-20 | There is an Assertion 'context_p->stack_top_uint8 == SCAN_STACK_TRY_STATEMENT || context_p->stack_top_uint8 == SCAN_STACK_CATCH_STATEMENT' failed at /parser/js… |
CVE-2021-46339 | Medium | 5.5 | 2022-01-20 | There is an Assertion 'lit_is_valid_cesu8_string (string_p, string_size)' failed at /base/ecma-helpers-string.c(ecma_new_ecma_string_from_utf8) in JerryScript… |
CVE-2021-46338 | Medium | 5.5 | 2022-01-20 | There is an Assertion 'ecma_is_lexical_environment (object_p)' failed at /base/ecma-helpers.c(ecma_get_lex_env_type) in JerryScript 3.0.0. |
CVE-2021-46337 | Medium | 5.5 | 2022-01-20 | There is an Assertion 'page_p != NULL' failed at /parser/js/js-parser-mem.c(parser_list_get) in JerryScript 3.0.0. |
CVE-2021-46336 | Medium | 5.5 | 2022-01-20 | There is an Assertion 'opts & PARSER_CLASS_LITERAL_CTOR_PRESENT' failed at /parser/js/js-parser-expr.c(parser_parse_class_body) in JerryScript 3.0.0. |
CVE-2021-46335 | Medium | 5.5 | 2022-01-20 | Moddable SDK v11.5.0 was discovered to contain a NULL pointer dereference in the component fx_Function_prototype_hasInstance. |
CVE-2021-46334 | High | 7.8 | 2022-01-20 | Moddable SDK v11.5.0 was discovered to contain a stack buffer overflow via the component __interceptor_strcat. |
CVE-2021-46333 | Medium | 5.5 | 2022-01-20 | Moddable SDK v11.5.0 was discovered to contain an invalid memory access vulnerability via the component __asan_memmove. |
CVE-2021-46332 | High | 7.8 | 2022-01-20 | Moddable SDK v11.5.0 was discovered to contain a heap-buffer-overflow via xs/sources/xsDataView.c in fxUint8Getter. |
CVE-2021-46331 | Medium | 5.5 | 2022-01-20 | Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsProxy.c in fxProxyGetPrototype. |
CVE-2021-46330 | Medium | 5.5 | 2022-01-20 | Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsDataView.c in fx_ArrayBuffer_prototype_concat. |
CVE-2021-46329 | Medium | 5.5 | 2022-01-20 | Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via the component _fini. |
CVE-2021-46328 | High | 7.8 | 2022-01-20 | Moddable SDK v11.5.0 was discovered to contain a heap-buffer-overflow via the component __libc_start_main. |
CVE-2021-46327 | Medium | 5.5 | 2022-01-20 | Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsArray.c in fx_Array_prototype_sort. |
CVE-2021-46326 | High | 7.8 | 2022-01-20 | Moddable SDK v11.5.0 was discovered to contain a heap-buffer-overflow via the component __asan_memcpy. |
CVE-2021-46325 | High | 7.8 | 2022-01-20 | Espruino 2v10.246 was discovered to contain a stack buffer overflow via src/jsutils.c in vcbprintf. |
CVE-2021-46324 | High | 7.8 | 2022-01-20 | Espruino 2v11.251 was discovered to contain a stack buffer overflow via src/jsvar.c in jsvNewFromString. |
CVE-2021-46323 | Medium | 5.5 | 2022-01-20 | Espruino 2v11.251 was discovered to contain a SEGV vulnerability via src/jsinteractive.c in jsiGetDeviceFromClass. |