2021 CVEs (page 61)
Page 61 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-44651 | High | 8.8 | 2022-01-12 | Zoho ManageEngine CloudSecurityPlus before Build 4117 allows remote code execution through the updatePersonalizeSettings component due to an improper security… |
CVE-2021-4080 | High | 8.8 | 2022-01-12 | crater is vulnerable to Unrestricted Upload of File with Dangerous Type |
CVE-2021-44650 | High | 7.2 | 2022-01-12 | Zoho ManageEngine M365 Manager Plus before Build 4419 allows remote command execution when updating proxy settings through the Admin ProxySettings and Tenant P… |
CVE-2021-44649 | Medium | 5.4 | 2022-01-12 | Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (X… |
CVE-2021-44648 | High | 8.8 | 2022-01-12 | GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minim… |
CVE-2021-3852 | High | 7.5 | 2022-01-12 | growi is vulnerable to Authorization Bypass Through User-Controlled Key |
CVE-2021-46283 | Medium | 5.5 | 2022-01-11 | nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel before 5.12.13 allows local users to cause a denial of service (NULL pointer dereference… |
CVE-2021-43999 | High | 8.8 | 2022-01-11 | Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malici… |
CVE-2021-41767 | Medium | 6.5 | 2022-01-11 | Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authe… |
CVE-2021-43974 | Medium | 5.3 | 2022-01-11 | An issue was discovered in SysAid ITIL 20.4.74 b10. The /enduserreg endpoint is used to register end users anonymously, but does not respect the server-side se… |
CVE-2021-43973 | High | 8.8 | 2022-01-11 | An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file vi… |
CVE-2021-43972 | Medium | 6.5 | 2022-01-11 | An unrestricted file copy vulnerability in /UserSelfServiceSettings.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to copy arbitrary fil… |
CVE-2021-43971 | High | 8.8 | 2022-01-11 | A SQL injection vulnerability in /mobile/SelectUsers.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to execute arbitrary SQL commands vi… |
CVE-2021-43055 | Medium | 5.9 | 2022-01-11 | The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains… |
CVE-2021-43054 | High | 7.1 | 2022-01-11 | The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains… |
CVE-2021-43053 | High | 8.5 | 2022-01-11 | The Realm Server component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a… |
CVE-2021-43052 | Critical | 9.3 | 2022-01-11 | The Realm Server component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a… |
CVE-2021-34704 | High | 8.6 | 2022-01-11 | A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2021-1573 | High | 8.6 | 2022-01-11 | A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2021-38991 | High | 7.8 | 2022-01-11 | IBM AIX 7.0, 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the lscore command which could lead to code execution… |
CVE-2021-29701 | Medium | 4.3 | 2022-01-11 | IBM Engineering Workflow Management 7.0, 7.0.1, and 7.0.2 as well as IBM Rational Team Concert 6.0.6 and 6.0.6.1 could allow an authneticated attacker to obtai… |
CVE-2021-43566 | Low | 2.5 | 2022-01-11 | All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the serv… |
CVE-2021-44647 | Medium | 5.5 | 2022-01-11 | Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service. |
CVE-2021-45460 | High | 8.1 | 2022-01-11 | A vulnerability has been identified in SICAM PQ Analyzer (All versions < V3.18). A service is started by an unquoted registry entry. As there are spaces in thi… |
CVE-2021-45034 | High | 7.5 | 2022-01-11 | A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions… |
CVE-2021-45033 | High | 8.8 | 2022-01-11 | A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions… |
CVE-2021-41769 | High | 7.5 | 2022-01-11 | A vulnerability has been identified in SIPROTEC 5 6MD85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MD86 devices (CPU variant CP300) (All v… |
CVE-2021-37198 | High | 8.8 | 2022-01-11 | A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components… |
CVE-2021-37197 | High | 8.8 | 2022-01-11 | A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components… |
CVE-2021-37196 | Medium | 6.5 | 2022-01-11 | A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components… |
CVE-2021-37195 | Medium | 6.1 | 2022-01-11 | A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components… |
CVE-2021-36414 | High | 7.8 | 2022-01-10 | A heab-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via media.c, which allows attackers to cause a denial of service or execute arbitrary… |
CVE-2021-36412 | High | 7.8 | 2022-01-10 | A heap-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via the gp_rtp_builder_do_mpeg12_video function, which allows attackers to possibly h… |
CVE-2021-36411 | Medium | 5.5 | 2022-01-10 | An issue has been found in libde265 v1.0.8 due to incorrect access control. A SEGV caused by a READ memory access in function derive_boundaryStrength of debloc… |
CVE-2021-36410 | Medium | 5.5 | 2022-01-10 | A stack-buffer-overflow exists in libde265 v1.0.8 via fallback-motion.cc in function put_epel_hv_fallback when running program dec265. |
CVE-2021-36409 | High | 7.8 | 2022-01-10 | There is an Assertion `scaling_list_pred_matrix_id_delta==1' failed at sps.cc:925 in libde265 v1.0.8 when decoding file, which allows attackers to cause a Deni… |
CVE-2021-36408 | Medium | 5.5 | 2022-01-10 | An issue was discovered in libde265 v1.0.8.There is a Heap-use-after-free in intrapred.h when decoding file using dec265. |
CVE-2021-35452 | Medium | 6.5 | 2022-01-10 | An Incorrect Access Control vulnerability exists in libde265 v1.0.8 due to a SEGV in slice.cc. |
CVE-2021-29454 | High | 8.1 | 2022-01-10 | Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, templat… |
CVE-2021-21408 | High | 8.8 | 2022-01-10 | Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.43 and 4.0.3, templat… |
CVE-2021-44458 | High | 8.3 | 2022-01-10 | Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website. The malicious website could make websocket connections from th… |
CVE-2021-43951 | Medium | 4.3 | 2022-01-10 | Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import configuration details… |
CVE-2021-43949 | Medium | 4.3 | 2022-01-10 | Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects via a Broken Access… |
CVE-2021-43297 | Critical | 9.8 | 2022-01-10 | A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users u… |
CVE-2021-25054 | High | 8.8 | 2022-01-10 | The WPcalc WordPress plugin through 2.1 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL I… |
CVE-2021-25053 | High | 8.8 | 2022-01-10 | The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:/… |
CVE-2021-25052 | High | 8.8 | 2022-01-10 | The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as wit… |
CVE-2021-25051 | High | 8.8 | 2022-01-10 | The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with da… |
CVE-2021-25047 | Medium | 6.1 | 2022-01-10 | The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin… |
CVE-2021-25043 | Medium | 6.1 | 2022-01-10 | The WOOCS WordPress plugin before 1.3.7.3 does not sanitise and escape the custom_prices parameter before outputting it back in the response, leading to a Refl… |
CVE-2021-25032 | Critical | 9.8 | 2022-01-10 | The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF c… |
CVE-2021-24949 | Critical | 9.8 | 2022-01-10 | The "WP Search Filters" widget of The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not sanitise and escape the option parameter before us… |
CVE-2021-24948 | High | 7.5 | 2022-01-10 | The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX action, which co… |
CVE-2021-24862 | High | 7.2 | 2022-01-10 | The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when dup… |
CVE-2021-23218 | Medium | 5.3 | 2022-01-10 | When running with FIPS mode enabled, Mirantis Container Runtime 20.10.8 leaks memory during TLS Handshakes which could be abused to cause a denial of service. |
CVE-2021-23154 | Medium | 6.3 | 2022-01-10 | In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the us… |
CVE-2021-44586 | High | 7.5 | 2022-01-10 | An issue was discovered in dst-admin v1.3.0. The product has an unauthorized arbitrary file download vulnerability that can expose sensitive information. |
CVE-2021-46166 | Medium | 6.5 | 2022-01-10 | Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page. |
CVE-2021-46165 | High | 7.8 | 2022-01-10 | Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be properly… |
CVE-2021-46164 | High | 8.8 | 2022-01-10 | Zoho ManageEngine Desktop Central before 10.0.662 allows remote code execution by an authenticated user who has complete access to the Reports module. |
CVE-2021-46163 | Medium | 6.1 | 2022-01-10 | Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem. |
CVE-2021-46150 | Medium | 4.8 | 2022-01-10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Special:CheckUserLog allows CheckUser XSS because of date m… |
CVE-2021-46149 | High | 7.5 | 2022-01-10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A denial of service (resource consumption) can be accomplis… |
CVE-2021-46148 | Medium | 6.5 | 2022-01-10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Some unprivileged users can view confidential information (… |
CVE-2021-46147 | High | 8.8 | 2022-01-10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. MassEditRegex allows CSRF. |
CVE-2021-46146 | Medium | 5.4 | 2022-01-10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The WikibaseMediaInfo component is vulnerable to XSS via th… |
CVE-2021-46055 | Medium | 5.5 | 2022-01-10 | A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*). |
CVE-2021-46054 | Medium | 5.5 | 2022-01-10 | A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*). |
CVE-2021-46053 | Medium | 5.5 | 2022-01-10 | A Denial of Service vulnerability exists in Binaryen 103. The program terminates with signal SIGKILL. |
CVE-2021-46052 | Medium | 5.5 | 2022-01-10 | A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::Tuple::validate. |
CVE-2021-46051 | Medium | 5.5 | 2022-01-10 | A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the Media_IsSelfContained function, which could cause a Denial of Service. . |
CVE-2021-46050 | Medium | 5.5 | 2022-01-10 | A Stack Overflow vulnerability exists in Binaryen 103 via the printf_common function. |
CVE-2021-46049 | Medium | 5.5 | 2022-01-10 | A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the gf_fileio_check function, which could cause a Denial of Service. |
CVE-2021-46048 | Medium | 5.5 | 2022-01-10 | A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::readFunctions. |
CVE-2021-46047 | Medium | 5.5 | 2022-01-10 | A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the gf_hinter_finalize function. |
CVE-2021-46046 | Medium | 5.5 | 2022-01-10 | A Pointer Derefernce Vulnerbility exists GPAC 1.0.1 the gf_isom_box_size function, which could cause a Denial of Service (context-dependent). |
CVE-2021-46045 | Medium | 5.5 | 2022-01-10 | GPAC 1.0.1 is affected by: Abort failed. The impact is: cause a denial of service (context-dependent). |
CVE-2021-45856 | High | 7.5 | 2022-01-10 | Accu-Time Systems MAXIMUS 1.0 telnet service suffers from a remote buffer overflow which causes the telnet service to crash |
CVE-2021-45442 | High | 7.1 | 2022-01-10 | A link following denial-of-service vulnerability in Trend Micro Worry-Free Business Security (on prem only) could allow a local attacker to overwrite arbitrary… |
CVE-2021-45441 | High | 7.8 | 2022-01-10 | A origin validation error vulnerability in Trend Micro Apex One (on-prem and SaaS) could allow a local attacker drop and manipulate a specially crafted file to… |
CVE-2021-45440 | High | 7.8 | 2022-01-10 | A unnecessary privilege vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security 10.0 SP1 (on-prem versions only) could allow a local… |
CVE-2021-45334 | Critical | 9.8 | 2022-01-10 | Sourcecodester Online Thesis Archiving System 1.0 is vulnerable to SQL Injection. An attacker can bypass admin authentication and gain access to admin panel us… |
CVE-2021-45231 | High | 7.8 | 2022-01-10 | A link following privilege escalation vulnerability in Trend Micro Apex One (on-prem and SaaS) and Trend Micro Worry-Free Business Security (10.0 SP1 and Servi… |
CVE-2021-45003 | Critical | 9.8 | 2022-01-10 | Laundry Booking Management System 1.0 (Latest) and previous versions are affected by a remote code execution (RCE) vulnerability in profile.php through the "im… |
CVE-2021-44528 | Medium | 6.1 | 2022-01-10 | A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "al… |
CVE-2021-44024 | High | 7.1 | 2022-01-10 | A link following denial-of-service vulnerability in Trend Micro Apex One (on-prem and SaaS) and Trend Micro Worry-Free Business Security (10.0 SP1 and Services… |
CVE-2021-43579 | High | 7.8 | 2022-01-10 | A stack-based buffer overflow in image_load_bmp() in HTMLDOC <= 1.9.13 results in remote code execution if the victim converts an HTML document linking to a cr… |
CVE-2021-42749 | Medium | 5.3 | 2022-01-10 | In Beaver Themer, attackers can bypass conditional logic controls (for hiding content) when viewing the post archives. Exploitation requires that a Themer layo… |
CVE-2021-42748 | Medium | 5.3 | 2022-01-10 | In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API. |
CVE-2021-42392 | Critical | 9.8 | 2022-01-10 | The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pas… |
CVE-2021-40041 | Medium | 4.2 | 2022-01-10 | There is a Cross-Site Scripting(XSS) vulnerability in HUAWEI WS318n product when processing network settings. Due to insufficient validation of user input, a l… |
CVE-2021-40039 | High | 7.5 | 2022-01-10 | There is a Null pointer dereference vulnerability in the camera module in smartphones. Successful exploitation of this vulnerability may affect service integri… |
CVE-2021-40038 | High | 7.5 | 2022-01-10 | There is a Double free vulnerability in the AOD module in smartphones. Successful exploitation of this vulnerability may affect service integrity. |
CVE-2021-40037 | Medium | 5.5 | 2022-01-10 | There is a Vulnerability of accessing resources using an incompatible type (type confusion) in the MPTCP subsystem in smartphones. Successful exploitation of t… |
CVE-2021-40035 | High | 7.5 | 2022-01-10 | There is a Buffer overflow vulnerability due to a boundary error with the Samba server in the file management module in smartphones. Successful exploitation of… |
CVE-2021-40032 | High | 7.5 | 2022-01-10 | The bone voice ID TA has a vulnerability in information management,Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2021-40031 | High | 7.5 | 2022-01-10 | There is a Null pointer dereference vulnerability in the camera module in smartphones. Successful exploitation of this vulnerability may affect service integri… |
CVE-2021-40029 | High | 7.5 | 2022-01-10 | There is a Buffer overflow vulnerability due to a boundary error with the Samba server in the file management module in smartphones. Successful exploitation of… |
CVE-2021-40028 | High | 7.5 | 2022-01-10 | The eID module has an out-of-bounds memory write vulnerability,Successful exploitation of this vulnerability may affect data integrity. |
CVE-2021-40027 | High | 7.5 | 2022-01-10 | The bone voice ID TA has a vulnerability in calculating the buffer length,Successful exploitation of this vulnerability may affect data confidentiality. |