2021 CVEs (page 62)
Page 62 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-40026 | High | 7.5 | 2022-01-10 | There is a Heap-based buffer overflow vulnerability in the AOD module in smartphones. Successful exploitation of this vulnerability may affect service integrit… |
CVE-2021-40025 | High | 7.5 | 2022-01-10 | The eID module has a vulnerability that causes the memory to be used without being initialized,Successful exploitation of this vulnerability may affect data co… |
CVE-2021-40022 | High | 7.5 | 2022-01-10 | The weaver module has a vulnerability in parameter type verification,Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2021-40021 | High | 7.5 | 2022-01-10 | The eID module has an out-of-bounds memory write vulnerability,Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2021-40020 | High | 7.5 | 2022-01-10 | There is an Out-of-bounds array read vulnerability in the security storage module in smartphones. Successful exploitation of this vulnerability may affect serv… |
CVE-2021-40018 | High | 7.5 | 2022-01-10 | The eID module has a null pointer reference vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2021-40014 | High | 7.5 | 2022-01-10 | The bone voice ID trusted application (TA) has a heap overflow vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2021-40011 | High | 7.5 | 2022-01-10 | There is an uncontrolled resource consumption vulnerability in the display module. Successful exploitation of this vulnerability may affect integrity. |
CVE-2021-40010 | Critical | 9.8 | 2022-01-10 | The bone voice ID TA has a heap overflow vulnerability.Successful exploitation of this vulnerability may result in malicious code execution. |
CVE-2021-40009 | Medium | 5.3 | 2022-01-10 | There is an Out-of-bounds write vulnerability in the AOD module in smartphones. Successful exploitation of this vulnerability may affect service integrity. |
CVE-2021-40006 | Medium | 4.6 | 2022-01-10 | Vulnerability of design defects in the security algorithm component. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2021-40005 | High | 7.5 | 2022-01-10 | The distributed data service component has a vulnerability in data access control. Successful exploitation of this vulnerability may affect data confidentialit… |
CVE-2021-40004 | High | 7.5 | 2022-01-10 | The cellular module has a vulnerability in permission management. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2021-40003 | Medium | 5.3 | 2022-01-10 | HwPCAssistant has a path traversal vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2021-40002 | High | 8.8 | 2022-01-10 | The Bluetooth module has an out-of-bounds write vulnerability. Successful exploitation of this vulnerability may result in malicious command execution at the r… |
CVE-2021-40001 | Medium | 5.3 | 2022-01-10 | The CaasKit module has a path traversal vulnerability. Successful exploitation of this vulnerability may cause the MeeTime application to be unavailable. |
CVE-2021-40000 | High | 8.8 | 2022-01-10 | The Bluetooth module has an out-of-bounds write vulnerability. Successful exploitation of this vulnerability may result in malicious command execution at the r… |
CVE-2021-39998 | High | 7.5 | 2022-01-10 | There is Vulnerability of APIs being concurrently called for multiple times in HwConnectivityExService a in smartphones. Successful exploitation of this vulner… |
CVE-2021-39996 | Critical | 9.8 | 2022-01-10 | There is a Heap-based buffer overflow vulnerability with the NFC module in smartphones. Successful exploitation of this vulnerability may cause memory overflow. |
CVE-2021-39993 | Critical | 9.8 | 2022-01-10 | There is an Integer overflow vulnerability with ACPU in smartphones. Successful exploitation of this vulnerability may cause out-of-bounds access. |
CVE-2021-38990 | High | 7.8 | 2022-01-10 | IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the mount command which could lead to code execution. IBM… |
CVE-2021-38957 | High | 7.5 | 2022-01-10 | IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could disclose sensitive information due to hazardous input validation during QR code generation. IBM X-Forc… |
CVE-2021-38956 | Medium | 5.3 | 2022-01-10 | IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could disclose sensitive version information in HTTP response headers that could aid in further attacks agai… |
CVE-2021-38921 | High | 7.5 | 2022-01-10 | IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive… |
CVE-2021-38895 | Medium | 5.4 | 2022-01-10 | IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2021-38894 | Low | 2.7 | 2022-01-10 | IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is ret… |
CVE-2021-35247 | Medium | 4.3 | 2022-01-10 | Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perf… |
CVE-2021-34087 | High | 7.1 | 2022-01-10 | In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local webserver can be used… |
CVE-2021-34086 | High | 8.8 | 2022-01-10 | In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local webserver hosts APIs v… |
CVE-2021-32998 | High | 7.4 | 2022-01-10 | The FANUC R-30iA and R-30iB series controllers are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbitrary code. INIT S… |
CVE-2021-32996 | High | 7.5 | 2022-01-10 | The FANUC R-30iA and R-30iB series controllers are vulnerable to integer coercion errors, which cause the device to crash. A restart is required. |
CVE-2021-30360 | High | 7.8 | 2022-01-10 | Users have access to the directory where the installation repair occurs. Since the MS Installer allows regular users to run the repair, an attacker can initiat… |
CVE-2021-23594 | Critical | 9.8 | 2022-01-10 | All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector. |
CVE-2021-23568 | High | 7.3 | 2022-01-10 | The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge. |
CVE-2021-23543 | Critical | 9.8 | 2022-01-10 | All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector. |
CVE-2021-23173 | Low | 2.6 | 2022-01-10 | The affected product is vulnerable to an improper access control, which may allow an authenticated user to gain unauthorized access to sensitive data. |
CVE-2021-22569 | High | 7.5 | 2022-01-10 | An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small ma… |
CVE-2021-22060 | Medium | 4.3 | 2022-01-10 | In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the… |
CVE-2021-20048 | High | 8.8 | 2022-01-10 | A Stack-based buffer overflow in the SonicOS SessionID HTTP response header allows a remote authenticated attacker to cause Denial of Service (DoS) and potenti… |
CVE-2021-20046 | High | 8.8 | 2022-01-10 | A Stack-based buffer overflow in the SonicOS HTTP Content-Length response header allows a remote authenticated attacker to cause Denial of Service (DoS) and po… |
CVE-2021-38674 | Medium | 4.2 | 2022-01-07 | A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers t… |
CVE-2021-25743 | Low | 3.0 | 2022-01-07 | kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstr… |
CVE-2021-46044 | Medium | 5.5 | 2022-01-06 | A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1via ShiftMetaOffset.isra, which causes a Denial of Service (context-dependent). |
CVE-2021-46043 | Medium | 5.5 | 2022-01-06 | A Pointer Dereference Vulnerability exits in GPAC 1.0.1 in the gf_list_count function, which causes a Denial of Service. |
CVE-2021-42841 | Medium | 6.1 | 2022-01-06 | Insta HMS before 12.4.10 is vulnerable to XSS because of improper validation of user-supplied input by multiple scripts. A remote attacker could exploit this v… |
CVE-2021-46042 | Medium | 5.5 | 2022-01-06 | A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the _fseeko function, which causes a Denial of Service. |
CVE-2021-46041 | Medium | 5.5 | 2022-01-06 | A Segmentation Fault Vulnerability exists in GPAC 1.0.1 via the co64_box_new function, which causes a Denial of Service. |
CVE-2021-46040 | Medium | 5.5 | 2022-01-06 | A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1 via the finplace_shift_moov_meta_offsets function, which causes a Denial of Servie (context-dependent). |
CVE-2021-46039 | Medium | 5.5 | 2022-01-06 | A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1 via the shift_chunk_offsets.part function, which causes a Denial of Service (context-dependent). |
CVE-2021-4194 | Medium | 6.5 | 2022-01-06 | bookstack is vulnerable to Improper Access Control |
CVE-2021-43045 | High | 7.5 | 2022-01-06 | A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue a… |
CVE-2021-28715 | Medium | 6.5 | 2022-01-06 | Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspec… |
CVE-2021-28714 | Medium | 6.5 | 2022-01-06 | Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspec… |
CVE-2021-46079 | High | 7.2 | 2022-01-06 | An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading… |
CVE-2021-46078 | Medium | 4.8 | 2022-01-06 | An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading… |
CVE-2021-46075 | High | 7.2 | 2022-01-06 | A Privilege Escalation vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. Staff account users can access the admin resources and per… |
CVE-2021-46074 | Medium | 4.8 | 2022-01-06 | A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the Settings Section in login panel. |
CVE-2021-46073 | Medium | 4.8 | 2022-01-06 | A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the User List Section in login panel. |
CVE-2021-46072 | Medium | 4.8 | 2022-01-06 | A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service List Section in login panel. |
CVE-2021-46071 | Medium | 4.8 | 2022-01-06 | A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Category List Section in login panel. |
CVE-2021-46070 | Medium | 4.8 | 2022-01-06 | A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service Requests Section in login panel. |
CVE-2021-46069 | Medium | 4.8 | 2022-01-06 | A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Mechanic List Section in login panel. |
CVE-2021-46068 | Medium | 4.8 | 2022-01-06 | A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the My Account Section in login panel. |
CVE-2021-46067 | Critical | 9.8 | 2022-01-06 | In Vehicle Service Management System 1.0 an attacker can steal the cookies leading to Full Account Takeover. |
CVE-2021-45745 | Medium | 5.4 | 2022-01-06 | A Stored Cross Site Scripting (XSS) vulnerability exists in Bludit 3.13.1 via the About Plugin in login panel. |
CVE-2021-45744 | Medium | 5.4 | 2022-01-06 | A Stored Cross Site Scripting (XSS) vulnerability exists in bludit 3.13.1 via the TAGS section in login panel. |
CVE-2021-46080 | Medium | 4.8 | 2022-01-06 | A Cross Site Request Forgery (CSRF) vulnerability exists in Vehicle Service Management System 1.0. An successful CSRF attacks leads to Stored Cross Site Script… |
CVE-2021-46076 | High | 8.8 | 2022-01-06 | Sourcecodester Vehicle Service Management System 1.0 is vulnerable to File upload. An attacker can upload a malicious php file in multiple endpoints it leading… |
CVE-2021-44591 | Medium | 6.5 | 2022-01-06 | In libming 0.4.8, the parseSWF_DEFINELOSSLESS2 function in util/parser.c lacks a boundary check that would lead to denial-of-service attacks via a crafted SWF… |
CVE-2021-44590 | Medium | 6.5 | 2022-01-06 | In libming 0.4.8, a memory exhaustion vulnerability exist in the function cws2fws in util/main.c. Remote attackers could launch denial of service attacks by su… |
CVE-2021-45458 | High | 7.5 | 2022-01-06 | Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encrypti… |
CVE-2021-45457 | High | 7.5 | 2022-01-06 | In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versi… |
CVE-2021-45456 | Critical | 9.8 | 2022-01-06 | Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what… |
CVE-2021-44878 | High | 7.5 | 2022-01-06 | If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an explicit c… |
CVE-2021-44584 | Medium | 6.1 | 2022-01-06 | Cross-site scripting (XSS) vulnerability in index.php in emlog version <= pro-1.0.7 allows remote attackers to inject arbitrary web script or HTML via the s pa… |
CVE-2021-36774 | Medium | 6.5 | 2022-01-06 | Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if left unmitigated, c… |
CVE-2021-31522 | Critical | 9.8 | 2022-01-06 | Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3… |
CVE-2021-27738 | High | 7.5 | 2022-01-06 | All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security che… |
CVE-2021-44564 | High | 8.1 | 2022-01-06 | A security vulnerability originally reported in the SYNC2101 product, and applicable to specific sub-families of SYNC devices, allows an attacker to download t… |
CVE-2021-44351 | High | 7.5 | 2022-01-06 | An arbitrary file read vulnerability exists in NavigateCMS 2.9 via /navigate/navigate_download.php id parameter. |
CVE-2021-36739 | Medium | 6.1 | 2022-01-06 | The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks. |
CVE-2021-36738 | Medium | 6.1 | 2022-01-06 | The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrat… |
CVE-2021-36737 | Medium | 6.1 | 2022-01-06 | The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-… |
CVE-2021-46145 | Medium | 5.3 | 2022-01-06 | The keyfob subsystem in Honda Civic 2012 vehicles allows a replay attack for unlocking. This is related to a non-expiring rolling code and counter resynchroniz… |
CVE-2021-46144 | Medium | 6.1 | 2022-01-06 | Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences. |
CVE-2021-46143 | High | 8.1 | 2022-01-06 | In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. |
CVE-2021-46142 | Medium | 5.5 | 2022-01-06 | An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax. |
CVE-2021-46141 | Medium | 5.5 | 2022-01-06 | An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner. |
CVE-2021-43947 | High | 7.2 | 2022-01-06 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Exe… |
CVE-2021-45971 | High | 8.2 | 2022-01-06 | An issue was discovered in SdHostDriver in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and… |
CVE-2021-41842 | Critical | 9.8 | 2022-01-06 | An issue was discovered in AtaLegacySmm in the kernel 5.0 before 05.08.46, 5.1 before 05.16.46, 5.2 before 05.26.46, 5.3 before 05.35.46, 5.4 before 05.43.46… |
CVE-2021-46038 | Medium | 5.5 | 2022-01-05 | A Pointer Dereference vulnerability exists in GPAC 1.0.1 in unlink_chunk.isra, which causes a Denial of Service (context-dependent). |
CVE-2021-45970 | High | 8.2 | 2022-01-05 | An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5… |
CVE-2021-45969 | High | 8.2 | 2022-01-05 | An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5… |
CVE-2021-45833 | Medium | 5.5 | 2022-01-05 | A Stack-based Buffer Overflow Vulnerability exists in HDF5 1.13.1-1 via the H5D__create_chunk_file_map_hyper function in /hdf5/src/H5Dchunk.c, which causes a D… |
CVE-2021-45832 | Medium | 5.5 | 2022-01-05 | A Stack-based Buffer Overflow Vulnerability exists in HDF5 1.13.1-1 at at hdf5/src/H5Eint.c, which causes a Denial of Service (context-dependent). |
CVE-2021-45831 | Medium | 5.5 | 2022-01-05 | A Null Pointer Dereference vulnerability exitgs in GPAC 1.0.1 in MP4Box via __strlen_avx2, which causes a Denial of Service. |
CVE-2021-45830 | Medium | 5.5 | 2022-01-05 | A heap-based buffer overflow vulnerability exists in HDF5 1.13.1-1 via H5F_addr_decode_len in /hdf5/src/H5Fint.c, which could cause a Denial of Service. |
CVE-2021-43816 | High | 8.0 | 2022-01-05 | containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5… |
CVE-2021-43779 | Critical | 9.9 | 2022-01-05 | GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenti… |