2021 CVEs (page 58)
Page 58 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-4164 | High | 8.8 | 2022-01-17 | calibre-web is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-25067 | Medium | 5.4 | 2022-01-17 | The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpb_post admin page. |
CVE-2021-25065 | Medium | 5.4 | 2022-01-17 | The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page. |
CVE-2021-25061 | Medium | 5.4 | 2022-01-17 | The WP Booking System WordPress plugin before 2.0.15 was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page. |
CVE-2021-25046 | Medium | 5.4 | 2022-01-17 | The Modern Events Calendar Lite WordPress plugin before 6.2.0 alloed any logged-in user, even a subscriber user, may add a category whose parameters are incorr… |
CVE-2021-25037 | Medium | 6.5 | 2022-01-17 | The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Je… |
CVE-2021-25036 | High | 8.8 | 2022-01-17 | The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was discovered during an internal audit by the Jetpack Sc… |
CVE-2021-25025 | Medium | 4.3 | 2022-01-17 | The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with… |
CVE-2021-25024 | Medium | 6.1 | 2022-01-17 | The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scrip… |
CVE-2021-25005 | Medium | 4.8 | 2022-01-17 | The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting… |
CVE-2021-24909 | Medium | 6.1 | 2022-01-17 | The ACF Photo Gallery Field WordPress plugin before 1.7.5 does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_edit.php fi… |
CVE-2021-24838 | Medium | 6.1 | 2022-01-17 | The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being… |
CVE-2021-3857 | Medium | 5.4 | 2022-01-17 | chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3853 | Medium | 6.1 | 2022-01-17 | chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-4171 | Critical | 9.8 | 2022-01-17 | calibre-web is vulnerable to Business Logic Errors |
CVE-2021-4170 | Medium | 5.4 | 2022-01-16 | calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-44537 | High | 7.8 | 2022-01-15 | ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execution. |
CVE-2021-33828 | High | 8.8 | 2022-01-15 | The files_antivirus component before 1.0.0 for ownCloud mishandles the protection mechanism by which malicious files (that have been uploaded to a public share… |
CVE-2021-33827 | High | 7.2 | 2022-01-15 | The files_antivirus component before 1.0.0 for ownCloud allows OS Command Injection via the administration settings. |
CVE-2021-42555 | High | 7.5 | 2022-01-15 | Pexip Infinity before 26.2 allows temporary remote Denial of Service (abort) because of missing call-setup input validation. |
CVE-2021-35969 | High | 7.5 | 2022-01-15 | Pexip Infinity before 26 allows temporary remote Denial of Service (abort) because of missing call-setup input validation. |
CVE-2021-33499 | High | 7.5 | 2022-01-15 | Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 2 of 2). |
CVE-2021-33498 | High | 7.5 | 2022-01-15 | Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 1 of 2). |
CVE-2021-32545 | High | 7.5 | 2022-01-15 | Pexip Infinity before 26 allows remote denial of service because of missing RTMP input validation. |
CVE-2021-44049 | High | 7.8 | 2022-01-15 | CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe… |
CVE-2021-33963 | Critical | 9.8 | 2022-01-15 | China Mobile An Lianbao WF-1 v1.0.1 router web interface through /api/ZRMacClone/mac_addr_clone receives parameters by POST request, and the parameter macType… |
CVE-2021-24044 | Critical | 9.8 | 2022-01-15 | By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator fu… |
CVE-2021-46171 | Medium | 5.5 | 2022-01-14 | Modex v2.11 was discovered to contain a NULL pointer dereference in set_create_id() at xtract.c. |
CVE-2021-46170 | High | 7.5 | 2022-01-14 | An issue was discovered in JerryScript commit a6ab5e9. There is an Use-After-Free in lexer_compare_identifier_to_string in js-lexer.c file. |
CVE-2021-46169 | Medium | 5.5 | 2022-01-14 | Modex v2.11 was discovered to contain an Use-After-Free vulnerability via the component tcache. |
CVE-2021-46168 | Medium | 5.5 | 2022-01-14 | Spin v6.5.1 was discovered to contain an out-of-bounds write in lex() at spinlex.c. |
CVE-2021-46195 | Medium | 5.5 | 2022-01-14 | GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denia… |
CVE-2021-46022 | Medium | 5.5 | 2022-01-14 | An Use-After-Free vulnerability in rec_mset_elem_destroy() at rec-mset.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash. |
CVE-2021-46021 | Medium | 5.5 | 2022-01-14 | An Use-After-Free vulnerability in rec_record_destroy() at rec-record.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash. |
CVE-2021-46020 | High | 7.5 | 2022-01-14 | An untrusted pointer dereference in mrb_vm_exec() of mruby v3.0.0 can lead to a segmentation fault or application crash. |
CVE-2021-46019 | Medium | 5.5 | 2022-01-14 | An untrusted pointer dereference in rec_db_destroy() at rec-db.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash. |
CVE-2021-45773 | High | 7.5 | 2022-01-14 | A NULL pointer dereference in CS104_IPAddress_setFromString at src/iec60870/cs104/cs104_slave.c of lib60870 commit 0d5e76e can lead to a segmentation fault or… |
CVE-2021-45769 | High | 7.5 | 2022-01-14 | A NULL pointer dereference in AcseConnection_parseMessage at src/mms/iso_acse/acse.c of libiec61850 v1.5.0 can lead to a segmentation fault or application cras… |
CVE-2021-45767 | Medium | 5.5 | 2022-01-14 | GPAC 1.1.0 was discovered to contain an invalid memory address dereference via the function lsr_read_id(). This vulnerability can lead to a Denial of Service (… |
CVE-2021-45764 | Medium | 5.5 | 2022-01-14 | GPAC v1.1.0 was discovered to contain an invalid memory address dereference via the function shift_chunk_offsets.isra(). |
CVE-2021-45406 | High | 8.8 | 2022-01-14 | In SalonERP 3.0.1, a SQL injection vulnerability allows an attacker to inject payload using 'sql' parameter in SQL query while generating a report. Upon succes… |
CVE-2021-45068 | High | 7.8 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds write vulnerab… |
CVE-2021-45067 | Medium | 5.5 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Access of Memory Location Af… |
CVE-2021-45064 | High | 7.8 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability… |
CVE-2021-45063 | Medium | 5.5 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability… |
CVE-2021-45062 | High | 7.8 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability… |
CVE-2021-45061 | High | 7.8 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds write vulnerab… |
CVE-2021-45060 | High | 7.8 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds read vulnerabi… |
CVE-2021-45052 | Low | 3.3 | 2022-01-14 | Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2021-45051 | Low | 3.3 | 2022-01-14 | Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an use-after-free vulnerability in the processing of Format event acti… |
CVE-2021-44828 | High | 7.8 | 2022-01-14 | Arm Mali GPU Kernel Driver (Midgard r26p0 through r30p0, Bifrost r0p0 through r34p0, and Valhall r19p0 through r34p0) allows a non-privileged user to achieve w… |
CVE-2021-44743 | High | 7.8 | 2022-01-14 | Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary co… |
CVE-2021-44742 | Low | 3.3 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds read vulnerabi… |
CVE-2021-44741 | Low | 3.3 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a Null pointer dereference vuln… |
CVE-2021-44740 | Low | 3.3 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a Null pointer dereference vuln… |
CVE-2021-44739 | Medium | 4.3 | 2022-01-14 | Acrobat Reader DC ActiveX Control versions 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Information… |
CVE-2021-44715 | Low | 3.3 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds read vulnerabi… |
CVE-2021-44714 | Low | 2.5 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a Violation of Secure Design Pr… |
CVE-2021-44713 | Medium | 5.5 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability… |
CVE-2021-44712 | Medium | 5.5 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Access of Memory Location Af… |
CVE-2021-44711 | High | 7.8 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Integer Overflow or Wraparou… |
CVE-2021-44710 | High | 7.8 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability… |
CVE-2021-44709 | High | 7.8 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a heap overflow vulnerability d… |
CVE-2021-44708 | High | 7.8 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a heap overflow vulnerability d… |
CVE-2021-44707 | High | 7.8 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds write vulnerab… |
CVE-2021-44706 | High | 7.8 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability… |
CVE-2021-44705 | High | 7.8 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability… |
CVE-2021-44704 | High | 7.8 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability… |
CVE-2021-44703 | High | 7.8 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a stack buffer overflow vulnera… |
CVE-2021-44702 | Medium | 4.3 | 2022-01-14 | Acrobat Reader DC ActiveX Control versions 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Information… |
CVE-2021-44701 | High | 7.8 | 2022-01-14 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability… |
CVE-2021-44700 | Medium | 5.5 | 2022-01-14 | Adobe Illustrator versions 25.4.2 (and earlier) and 26.0.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2021-44530 | Critical | 9.8 | 2022-01-14 | An injection vulnerability exists in a third-party library used in UniFi Network Version 6.5.53 and earlier (Log4J CVE-2021-44228) allows a malicious actor to… |
CVE-2021-44234 | Medium | 5.5 | 2022-01-14 | SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitiv… |
CVE-2021-43752 | Low | 3.3 | 2022-01-14 | Adobe Illustrator versions 25.4.2 (and earlier) and 26.0.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2021-42067 | Medium | 4.3 | 2022-01-14 | In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a… |
CVE-2021-3965 | High | 7.5 | 2022-01-14 | Certain HP DesignJet products may be vulnerable to unauthenticated HTTP requests which allow viewing and downloading of print job previews. |
CVE-2021-39684 | High | 7.8 | 2022-01-14 | In target_init of gs101/abl/target/slider/target.c, there is a possible allocation of RWX memory due to a logic error in the code. This could lead to local esc… |
CVE-2021-39683 | Medium | 6.7 | 2022-01-14 | In copy_from_mbox of sss_ice_util.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege wi… |
CVE-2021-39682 | High | 7.8 | 2022-01-14 | In mgm_alloc_page of memory_group_manager.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of p… |
CVE-2021-39681 | High | 7.8 | 2022-01-14 | In delete_protocol of main.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege with no ad… |
CVE-2021-39680 | Medium | 4.4 | 2022-01-14 | In sec_SHA256_Transform of sha256_core.c, there is a possible way to read heap data due to uninitialized data. This could lead to local information disclosure… |
CVE-2021-39679 | High | 7.0 | 2022-01-14 | In init of vendor_graphicbuffer_meta.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no… |
CVE-2021-39678 | High | 7.8 | 2022-01-14 | In <TBD> of <TBD>, there is a possible bypass of Factory Reset Protection due to <TBD>. This could lead to local escalation of privilege with no additional exe… |
CVE-2021-39659 | Medium | 5.5 | 2022-01-14 | In sortSimPhoneAccountsForEmergency of CreateConnectionProcessor.java, there is a possible prevention of access to emergency calling due to an unhandled except… |
CVE-2021-39634 | High | 7.8 | 2022-01-14 | In fs/eventpoll.c, there is a possible use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User in… |
CVE-2021-39633 | Medium | 5.5 | 2022-01-14 | In gre_handle_offloads of ip_gre.c, there is a possible page fault due to an invalid memory access. This could lead to local information disclosure with no add… |
CVE-2021-39632 | High | 7.8 | 2022-01-14 | In inotify_cb of events.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no… |
CVE-2021-39630 | High | 7.8 | 2022-01-14 | In executeRequest of OverlayManagerService.java, there is a possible way to control fabricated overlays from adb shell due to a permissions bypass. This could… |
CVE-2021-39629 | High | 7.0 | 2022-01-14 | In phTmlNfc_Init and phTmlNfc_CleanUp of phTmlNfc.cc, there is a possible use after free due to a race condition. This could lead to local escalation of privil… |
CVE-2021-39628 | Low | 3.3 | 2022-01-14 | In StatusBar.java, there is a possible disclosure of notification content on the lockscreen due to a logic error in the code. This could lead to local informat… |
CVE-2021-39627 | High | 7.8 | 2022-01-14 | In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to loca… |
CVE-2021-39626 | High | 7.8 | 2022-01-14 | In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of pr… |
CVE-2021-39625 | High | 7.3 | 2022-01-14 | In showCarrierAppInstallationNotification of EuiccNotificationManager.java, there is a possible way to gain an access to MediaProvider content due to an unsafe… |
CVE-2021-39623 | Critical | 9.8 | 2022-01-14 | In doRead of SimpleDecodingSource.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privil… |
CVE-2021-39622 | High | 7.8 | 2022-01-14 | In GBoard, there is a possible way to bypass Factory Reset Protection due to a missing permission check. This could lead to local escalation of privilege with… |
CVE-2021-39621 | High | 7.8 | 2022-01-14 | In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to loca… |
CVE-2021-39620 | High | 7.8 | 2022-01-14 | In ipcSetDataReference of Parcel.cpp, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with… |
CVE-2021-39618 | High | 7.8 | 2022-01-14 | In multiple methods of EuiccNotificationManager.java, there is a possible way to install existing packages without user consent due to an unsafe PendingIntent… |
CVE-2021-38127 | Medium | 6.1 | 2022-01-14 | Potential vulnerabilities have been identified in Micro Focus ArcSight Enterprise Security Manager, affecting versions 7.4.x and 7.5.x. The vulnerabilities cou… |