2021 CVEs (page 57)
Page 57 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-46322 | Medium | 5.5 | 2022-01-20 | Duktape v2.99.99 was discovered to contain a SEGV vulnerability via the component duk_push_tval in duktape/duk_api_stack.c. |
CVE-2021-46061 | Critical | 9.8 | 2022-01-20 | An SQL Injection vulnerability exists in Sourcecodester Computer and Mobile Repair Shop Management system (RSMS) 1.0 via the code parameter in /rsms/ node app. |
CVE-2021-29785 | Medium | 5.9 | 2022-01-20 | IBM Security SOAR V42 and V43could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Secu… |
CVE-2021-44245 | Critical | 9.8 | 2022-01-20 | An SQL Injection vulnerability exists in Courcecodester COVID 19 Testing Management System (CTMS) 1.0 via the (1) username and (2) contactno parameters. |
CVE-2021-44244 | Critical | 9.8 | 2022-01-20 | An SQL Injection vulnerabiity exists in Sourcecodester Logistic Hub Parcel's Management System 1.0 via the username parameter in login.php. |
CVE-2021-44092 | Critical | 9.8 | 2022-01-20 | An SQL Injection vulnerability exists in code-projects Pharmacy Management 1.0 via the username parameter in the administer login form. |
CVE-2021-44090 | Critical | 9.8 | 2022-01-20 | An SQL Injection vulnerability exists in Sourcecodester Online Reviewer System 1.0 via the password parameter. |
CVE-2021-45417 | High | 7.8 | 2022-01-20 | AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a heap-ba… |
CVE-2021-44091 | Medium | 5.4 | 2022-01-20 | A Cross-Site Scripting (XSS) vulnerability exists in Courcecodester Multi Restaurant Table Reservation System 1.0 in register.php via the (1) fullname, (2) pho… |
CVE-2021-44829 | Medium | 6.1 | 2022-01-20 | Cross Site Scripting (XSS) vulnerability exists in index.html in AFI WebACMS through 2.1.0 via the the ID parameter. |
CVE-2021-44737 | High | 8.8 | 2022-01-20 | PJL directory traversal vulnerability in Lexmark devices through 2021-12-07 that can be leveraged to overwrite internal configuration files. |
CVE-2021-44736 | Critical | 9.8 | 2022-01-20 | The initial admin account setup wizard on Lexmark devices allow unauthenticated access to the “out of service erase” feature. |
CVE-2021-44735 | Critical | 9.8 | 2022-01-20 | Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07. |
CVE-2021-44734 | Critical | 9.8 | 2022-01-20 | Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code execution on the device. |
CVE-2021-44738 | Critical | 9.8 | 2022-01-20 | Buffer overflow vulnerability has been identified in Lexmark devices through 2021-12-07 in postscript interpreter. |
CVE-2021-32039 | Medium | 5.5 | 2022-01-20 | Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credential… |
CVE-2021-34600 | Medium | 5.5 | 2022-01-20 | Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags used for local authori… |
CVE-2021-45230 | Medium | 6.5 | 2022-01-20 | In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags th… |
CVE-2021-3866 | Medium | 5.4 | 2022-01-20 | Cross-site Scripting (XSS) - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e96… |
CVE-2021-43269 | High | 8.8 | 2022-01-20 | In Code42 app before 8.8.0, eval injection allows an attacker to change a device’s proxy configuration to use a malicious proxy auto-config (PAC) file, leading… |
CVE-2021-46028 | Medium | 4.3 | 2022-01-20 | In mblog <= 3.5.0 there is a CSRF vulnerability in the background article management. The attacker constructs a CSRF load. Once the administrator clicks a mali… |
CVE-2021-46026 | Medium | 5.4 | 2022-01-20 | mysiteforme, as of 19-12-2022, is vulnerable to Cross Site Scripting (XSS) via the add blog tag function in the blog tag in the background blog management. |
CVE-2021-4143 | Medium | 6.1 | 2022-01-19 | Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0. |
CVE-2021-46027 | Medium | 6.5 | 2022-01-19 | mysiteforme, as of 19-12-2022, has a CSRF vulnerability in the background blog management. The attacker constructs a CSRF load. Once the administrator clicks a… |
CVE-2021-46025 | Medium | 5.4 | 2022-01-19 | A Cross SIte Scripting (XSS) vulnerability exists in OneBlog <= 2.2.8. via the add function in the operation tab list in the background. |
CVE-2021-44777 | Medium | 5.4 | 2022-01-19 | Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5… |
CVE-2021-3816 | Medium | 5.4 | 2022-01-19 | Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the group_prefix field during the creation of a new group… |
CVE-2021-26247 | Medium | 6.1 | 2022-01-19 | As an unauthenticated remote user, visit "http://<CACTI_SERVER>/auth_changepassword.php?ref=<script>alert(1)</script>" to successfully execute the JavaScript p… |
CVE-2021-23843 | High | 8.8 | 2022-01-19 | The Bosch software tools AccessIPConfig.exe and AmcIpConfig.exe are used to configure certains settings in AMC2 devices. The tool allows putting a password pro… |
CVE-2021-23842 | Medium | 5.7 | 2022-01-19 | Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the… |
CVE-2021-23225 | Medium | 5.4 | 2022-01-19 | Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the "new_username" field during creation of… |
CVE-2021-38789 | High | 7.5 | 2022-01-19 | Allwinner R818 SoC Android Q SDK V1.0 is affected by an incorrect access control vulnerability that does not check the caller's permission, in which a third-pa… |
CVE-2021-46204 | Critical | 9.8 | 2022-01-19 | Taocms v3.0.2 was discovered to contain an arbitrary file read vulnerability via the path parameter. SQL injection vulnerability via taocms\include\Model\Artic… |
CVE-2021-46203 | Medium | 6.5 | 2022-01-19 | Taocms v3.0.2 was discovered to contain an arbitrary file read vulnerability via the path parameter. |
CVE-2021-44299 | Medium | 5.4 | 2022-01-19 | A reflected cross-site scripting (XSS) vulnerability in \lib\packages\themes\themes.php of Navigate CMS v2.9.4 allows authenticated attackers to execute arbitr… |
CVE-2021-42810 | High | 7.8 | 2022-01-19 | A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent… |
CVE-2021-33913 | Critical | 9.8 | 2022-01-19 | libspf2 before 1.2.11 has a heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from… |
CVE-2021-33912 | Critical | 9.8 | 2022-01-19 | libspf2 before 1.2.11 has a four-byte heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail mes… |
CVE-2021-38788 | High | 7.5 | 2022-01-19 | The Background service in Allwinner R818 SoC Android Q SDK V1.0 is used to manage background applications. Malicious apps can use the interface provided by the… |
CVE-2021-46030 | Medium | 5.4 | 2022-01-19 | There is a Cross Site Scripting attack (XSS) vulnerability in JavaQuarkBBS <= v2. By entering specific statements into the background tag management module, th… |
CVE-2021-44837 | Medium | 4.3 | 2022-01-19 | An issue was discovered in Delta RM 1.2. It is possible for an unprivileged user to access the same information as an admin user regarding the risk creation in… |
CVE-2021-46104 | High | 7.5 | 2022-01-19 | An issue was discovered in webp_server_go 0.4.0. There is a directory traversal vulnerability that can read arbitrary file information on the server. |
CVE-2021-45808 | High | 8.8 | 2022-01-19 | jpress v4.2.0 allows users to register an account by default. With the account, user can upload arbitrary files to the server. |
CVE-2021-38787 | High | 7.5 | 2022-01-19 | There is an integer overflow in the ION driver "/dev/ion" of Allwinner R818 SoC Android Q SDK V1.0 that could use the ioctl cmd "COMPAT_ION_IOC_SUNXI_FLUSH_RAN… |
CVE-2021-38786 | High | 7.5 | 2022-01-19 | There is a NULL pointer dereference in media/libcedarc/vdecoder of Allwinner R818 SoC Android Q SDK V1.0, which could cause a media crash (denial of service). |
CVE-2021-35687 | Medium | 5.3 | 2022-01-19 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Unified Met… |
CVE-2021-35686 | Medium | 4.3 | 2022-01-19 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Unified Met… |
CVE-2021-35683 | Critical | 9.9 | 2022-01-19 | Vulnerability in the Oracle Essbase Administration Services product of Oracle Essbase (component: EAS Console). The supported version that is affected is Prior… |
CVE-2021-35587 | Critical | 9.8 | 2022-01-19 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0… |
CVE-2021-31854 | High | 7.7 | 2022-01-19 | A command Injection Vulnerability in McAfee Agent (MA) for Windows prior to 5.7.5 allows local users to inject arbitrary shell code into the file cleanup.exe… |
CVE-2021-31821 | Medium | 5.5 | 2022-01-19 | When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Server API key in pla… |
CVE-2021-44839 | Medium | 6.5 | 2022-01-18 | An issue was discovered in Delta RM 1.2. It is possible to request a new password for any other account using the account ID. Using the /listes/DTsendmaildata/… |
CVE-2021-44838 | Medium | 4.3 | 2022-01-18 | An issue was discovered in Delta RM 1.2. Using the /risque/risque/ajax-details endpoint, with a POST request indicating the risk to access with the id paramete… |
CVE-2021-44836 | Medium | 4.3 | 2022-01-18 | An issue was discovered in Delta RM 1.2. The /risque/risque/workflow/reset endpoint is lacking access controls, and it is possible for an unprivileged user to… |
CVE-2021-44840 | Low | 2.7 | 2022-01-18 | An issue was discovered in Delta RM 1.2. Using an privileged account, it is possible to edit, create, and delete risk labels, such as Criticality and Priority… |
CVE-2021-46013 | Critical | 9.8 | 2022-01-18 | An unrestricted file upload vulnerability exists in Sourcecodester Free school management software 1.0. An attacker can leverage this vulnerability to enable r… |
CVE-2021-46005 | Medium | 5.4 | 2022-01-18 | Sourcecodester Car Rental Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via vehicalorcview parameter. |
CVE-2021-34406 | Medium | 4.7 | 2022-01-18 | NVIDIA Tegra kernel driver contains a vulnerability in NVHost, where a specific race condition can lead to a null pointer dereference, which may lead to a syst… |
CVE-2021-34405 | Medium | 5.5 | 2022-01-18 | NVIDIA Linux distributions contain a vulnerability in TrustZone’s TEE_Malloc function, where an unchecked return value causing a null pointer dereference may l… |
CVE-2021-34404 | High | 7.1 | 2022-01-18 | Android images for T210 provided by NVIDIA contain a vulnerability in BROM, where failure to limit access to AHB-DMA when BROM fails may allow an unprivileged… |
CVE-2021-34403 | High | 7.8 | 2022-01-18 | NVIDIA Linux distributions contain a vulnerability in nvmap ioctl, which allows any user with a local account to exploit a use-after-free condition, leading to… |
CVE-2021-34402 | Medium | 6.7 | 2022-01-18 | NVIDIA Tegra kernel driver contains a vulnerability in NVIDIA NVDEC, where a user with high privileges might be able to read from or write to a memory location… |
CVE-2021-34401 | High | 7.8 | 2022-01-18 | NVIDIA Linux kernel distributions contain a vulnerability in nvmap NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER, where improper access control may lead to code execu… |
CVE-2021-4083 | High | 7.0 | 2022-01-18 | A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget()… |
CVE-2021-4074 | Medium | 6.4 | 2022-01-18 | The WHMCS Bridge WordPress plugin is vulnerable to Stored Cross-Site Scripting via the cc_whmcs_bridge_url parameter found in the ~/whmcs-bridge/bridge_cp.php… |
CVE-2021-43353 | High | 8.8 | 2022-01-18 | The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function fo… |
CVE-2021-41809 | Low | 3.5 | 2022-01-18 | SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, in a preview function allowed making queries from the server with certain docu… |
CVE-2021-41808 | Low | 2.0 | 2022-01-18 | In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mit… |
CVE-2021-41807 | High | 7.5 | 2022-01-18 | Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of… |
CVE-2021-39946 | High | 8.7 | 2022-01-18 | Improper neutralization of user input in GitLab CE/EE versions 14.3 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed an attacker to exploit XSS by abusing… |
CVE-2021-39942 | Medium | 4.3 | 2022-01-18 | A denial of service vulnerability in GitLab CE/EE affecting all versions starting from 12.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all v… |
CVE-2021-39927 | Low | 3.5 | 2022-01-18 | Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and between 14.6.0 and 14.6.1 would fail to… |
CVE-2021-39892 | Medium | 4.3 | 2022-01-18 | In all versions of GitLab CE/EE since version 12.0, a lower privileged user can import users from projects that they don't have a maintainer role on and disclo… |
CVE-2021-37867 | Medium | 4.3 | 2022-01-18 | Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthori… |
CVE-2021-37866 | Medium | 4.7 | 2022-01-18 | Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reu… |
CVE-2021-37865 | Medium | 4.3 | 2022-01-18 | Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated… |
CVE-2021-37864 | Low | 2.6 | 2022-01-18 | Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of arc… |
CVE-2021-29872 | Medium | 5.4 | 2022-01-18 | IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of… |
CVE-2021-29632 | High | 7.5 | 2022-01-18 | In FreeBSD 13.0-STABLE before n247428-9352de39c3dc, 12.2-STABLE before r370674, 13.0-RELEASE before p6, and 12.2-RELEASE before p12, certain conditions involvi… |
CVE-2021-29215 | Critical | 9.8 | 2022-01-18 | A potential security vulnerability in HPE Ezmeral Data Fabric that may allow a remote access restriction bypass in the TEZ MapR ecosystem component was discove… |
CVE-2021-4146 | Medium | 4.3 | 2022-01-18 | Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6. |
CVE-2021-44217 | Medium | 6.1 | 2022-01-18 | In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attacke… |
CVE-2021-41551 | Medium | 4.9 | 2022-01-18 | Leostream Connection Broker 9.0.40.17 allows administrators to conduct directory traversal attacks by uploading z ZIP file that contains a symbolic link. |
CVE-2021-41550 | High | 7.2 | 2022-01-18 | Leostream Connection Broker 9.0.40.17 allows administrator to upload and execute Perl code. |
CVE-2021-38697 | Critical | 9.8 | 2022-01-18 | SoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows attackers to upload files with any file extension which can lead t… |
CVE-2021-38696 | High | 7.5 | 2022-01-18 | SoftVibe SARABAN for INFOMA 1.1 has Incorrect Access Control vulnerability, that allows attackers to access signature files on the application without any auth… |
CVE-2021-38695 | Medium | 5.4 | 2022-01-18 | SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting (XSS) that allows users to store scripts in certain fields (e.g. subject, descript… |
CVE-2021-38785 | High | 7.5 | 2022-01-18 | There is a NULL pointer deference in the Allwinner R818 SoC Android Q SDK V1.0 camera driver /dev/cedar_dev that could use the ioctl cmd IOCTL_GET_IOMMU_ADDR t… |
CVE-2021-38784 | High | 7.5 | 2022-01-18 | There is a NULL pointer dereference in the syscall open_exec function of Allwinner R818 SoC Android Q SDK V1.0 that could executable a malicious file to cause… |
CVE-2021-38694 | High | 7.5 | 2022-01-18 | SoftVibe SARABAN for INFOMA 1.1 allows SQL Injection. |
CVE-2021-22566 | Critical | 9.8 | 2022-01-18 | An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as executable from an unprivileged context. T… |
CVE-2021-38783 | High | 7.5 | 2022-01-18 | There is a Out-of-Bound Write in the Allwinner R818 SoC Android Q SDK V1.0 camera driver "/dev/cedar_dev" through iotcl cmd IOCTL_SET_PROC_INFO and IOCTL_COPY_… |
CVE-2021-33965 | High | 8.8 | 2022-01-18 | China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/set_ZRMesh which receives parameters by POST request, and the parameter mesh_en… |
CVE-2021-45394 | High | 8.8 | 2022-01-18 | An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious <link> tag in… |
CVE-2021-33964 | High | 8.8 | 2022-01-18 | China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRRuleFilter/set_firewall_level which receives parameters by POST request, and the par… |
CVE-2021-44757 | Critical | 9.1 | 2022-01-18 | Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive in… |
CVE-2021-42357 | Medium | 6.1 | 2022-01-17 | When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that includ… |
CVE-2021-38965 | High | 8.8 | 2022-01-17 | IBM FileNet Content Manager 5.5.4, 5.5.6, and 5.5.7 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specia… |
CVE-2021-33040 | Medium | 6.1 | 2022-01-17 | managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS. |
CVE-2021-3862 | Medium | 4.8 | 2022-01-17 | icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |