2021 CVEs (page 63)
Page 63 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-38918 | High | 7.5 | 2022-01-05 | IBM PowerVM Hypervisor FW860, FW940, FW950, and FW1010, through a specific sequence of VM management operations could lead to a violation of the isolation betw… |
CVE-2021-28713 | Medium | 6.5 | 2022-01-05 | Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnera… |
CVE-2021-28712 | Medium | 6.5 | 2022-01-05 | Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnera… |
CVE-2021-28711 | Medium | 6.5 | 2022-01-05 | Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnera… |
CVE-2021-41043 | Medium | 5.5 | 2022-01-05 | Use after free in tcpslice triggers AddressSanitizer, no other confirmed impact. |
CVE-2021-31589 | Medium | 6.1 | 2022-01-05 | A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Software version 6.0.1 and older, which al… |
CVE-2021-22567 | Medium | 4.6 | 2022-01-05 | Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a cod… |
CVE-2021-43946 | Medium | 6.5 | 2022-01-05 | Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscriptions via a Broke… |
CVE-2021-45452 | Medium | 5.3 | 2022-01-05 | Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it. |
CVE-2021-45116 | High | 7.5 | 2022-01-05 | An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolut… |
CVE-2021-45115 | High | 7.5 | 2022-01-05 | An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in… |
CVE-2021-41388 | High | 7.8 | 2022-01-04 | Netskope client prior to 89.x on macOS is impacted by a local privilege escalation vulnerability. The XPC implementation of nsAuxiliarySvc process does not per… |
CVE-2021-22045 | High | 7.8 | 2022-01-04 | VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-… |
CVE-2021-43852 | High | 8.8 | 2022-01-04 | OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into exist… |
CVE-2021-43850 | Medium | 6.8 | 2022-01-04 | Discourse is an open source platform for community discussion. In affected versions admins users can trigger a Denial of Service attack via the `/message-bus/_… |
CVE-2021-43832 | Critical | 10.0 | 2022-01-04 | Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. This lets an… |
CVE-2021-43677 | Medium | 6.1 | 2022-01-04 | Fluxbb v1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability. |
CVE-2021-41236 | Medium | 6.9 | 2022-01-04 | OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to email template conten… |
CVE-2021-41141 | Medium | 5.9 | 2022-01-04 | PJSIP is a free and open source multimedia communication library written in the C language implementing standard based protocols such as SIP, SDP, RTP, STUN, T… |
CVE-2021-24042 | Critical | 9.8 | 2022-01-04 | The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Bu… |
CVE-2021-39143 | Medium | 6.6 | 2022-01-04 | Spinnaker is an open source, multi-cloud continuous delivery platform. A path traversal vulnerability was discovered in uses of TAR files by AppEngine for depl… |
CVE-2021-3845 | High | 7.5 | 2022-01-04 | ws-scrcpy is vulnerable to External Control of File Name or Path |
CVE-2021-45912 | High | 7.8 | 2022-01-04 | An unauthenticated Named Pipe channel in Controlup Real-Time Agent (cuAgent.exe) before 8.5 potentially allows an attacker to run OS commands via the ProcessAc… |
CVE-2021-45389 | Critical | 9.8 | 2022-01-04 | A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escala… |
CVE-2021-41789 | Medium | 6.5 | 2022-01-04 | In wifi driver, there is a possible system crash due to a missing validation check. This could lead to remote denial of service from a proximal attacker with n… |
CVE-2021-40148 | High | 7.5 | 2022-01-04 | In Modem EMM, there is a possible information disclosure due to a missing data encryption. This could lead to remote information disclosure with no additional… |
CVE-2021-45980 | High | 7.8 | 2022-01-04 | Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via getURL in the JavaScript API. |
CVE-2021-45979 | High | 7.8 | 2022-01-04 | Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via app.launchURL in the JavaScript API. |
CVE-2021-45978 | High | 7.8 | 2022-01-04 | Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via xfa.host.gotoURL in the XFA API. |
CVE-2021-45913 | High | 7.2 | 2022-01-04 | A hardcoded key in ControlUp Real-Time Agent (cuAgent.exe) before 8.2.5 may allow a potential attacker to run OS commands via a WCF channel. |
CVE-2021-3842 | High | 7.5 | 2022-01-04 | nltk is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-43711 | Critical | 9.8 | 2022-01-04 | The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when receiving GET parameters. The parameter n… |
CVE-2021-44168 | Low | 3.3 | 2022-01-04 | A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attac… |
CVE-2021-31833 | High | 7.1 | 2022-01-04 | Potential product security bypass vulnerability in McAfee Application and Change Control (MACC) prior to version 8.3.4 allows a locally logged in attacker to c… |
CVE-2021-40525 | Critical | 9.1 | 2022-01-04 | Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any fi… |
CVE-2021-40111 | Medium | 6.5 | 2022-01-04 | In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite lo… |
CVE-2021-40110 | High | 7.5 | 2022-01-04 | In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regula… |
CVE-2021-38542 | Medium | 5.9 | 2022-01-04 | Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle comma… |
CVE-2021-34797 | High | 7.5 | 2022-01-04 | Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters… |
CVE-2021-20872 | Medium | 6.8 | 2022-01-04 | Protection mechanism failure vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6 and earlier, bizhu… |
CVE-2021-20871 | Medium | 6.5 | 2022-01-04 | Exposure of sensitive information to an unauthorized actor vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C… |
CVE-2021-20870 | Medium | 4.6 | 2022-01-04 | Improper handling of exceptional conditions vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6 and… |
CVE-2021-20869 | Medium | 6.5 | 2022-01-04 | Exposure of sensitive information to an unauthorized actor vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C… |
CVE-2021-20868 | Medium | 4.5 | 2022-01-04 | Incorrect authorization vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6 and earlier, bizhub C36… |
CVE-2021-43942 | Medium | 6.1 | 2022-01-04 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (… |
CVE-2021-45829 | Medium | 5.5 | 2022-01-03 | HDF5 1.13.1-1 is affected by: segmentation fault, which causes a Denial of Service. |
CVE-2021-39990 | Critical | 9.8 | 2022-01-03 | The screen lock module has a Stack-based Buffer Overflow vulnerability.Successful exploitation of this vulnerability may affect user experience. |
CVE-2021-39989 | High | 7.5 | 2022-01-03 | The HwNearbyMain module has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability.Successful exploitation of this vulnerability may cause… |
CVE-2021-39988 | High | 7.5 | 2022-01-03 | The HwNearbyMain module has a NULL Pointer Dereference vulnerability.Successful exploitation of this vulnerability may cause a process to restart. |
CVE-2021-39987 | High | 7.5 | 2022-01-03 | The HwNearbyMain module has a Data Processing Errors vulnerability.Successful exploitation of this vulnerability may cause a process to restart. |
CVE-2021-39985 | High | 7.5 | 2022-01-03 | The HwNearbyMain module has a Improper Validation of Array Index vulnerability.Successful exploitation of this vulnerability may cause a process to restart. |
CVE-2021-39984 | High | 7.5 | 2022-01-03 | Huawei idap module has a Out-of-bounds Read vulnerability.Successful exploitation of this vulnerability may cause Denial of Service. |
CVE-2021-39983 | High | 7.5 | 2022-01-03 | The HwNearbyMain module has a Data Processing Errors vulnerability.Successful exploitation of this vulnerability may cause a process to restart. |
CVE-2021-39982 | Critical | 9.1 | 2022-01-03 | Phone Manager application has a Improper Privilege Management vulnerability.Successful exploitation of this vulnerability may read and write arbitrary files by… |
CVE-2021-39981 | Medium | 5.3 | 2022-01-03 | Chang Lian application has a vulnerability which can be maliciously exploited to hide the calling number.Successful exploitation of this vulnerability allows y… |
CVE-2021-39980 | Medium | 5.3 | 2022-01-03 | Telephony application has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability.Successful exploitation of this vulnerability could lead t… |
CVE-2021-39979 | Critical | 9.8 | 2022-01-03 | HHEE system has a Code Injection vulnerability.Successful exploitation of this vulnerability may affect HHEE system integrity. |
CVE-2021-39978 | High | 7.5 | 2022-01-03 | Telephony application has a SQL Injection vulnerability.Successful exploitation of this vulnerability may cause privacy and security issues. |
CVE-2021-39977 | High | 7.5 | 2022-01-03 | The HwNearbyMain module has a NULL Pointer Dereference vulnerability.Successful exploitation of this vulnerability may cause a process to restart. |
CVE-2021-39975 | High | 7.5 | 2022-01-03 | Hilinksvc has a Data Processing Errors vulnerability.Successful exploitation of this vulnerability may cause denial of service attacks. |
CVE-2021-39974 | High | 7.5 | 2022-01-03 | There is an Out-of-bounds read in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-39973 | High | 7.5 | 2022-01-03 | There is a Null pointer dereference in Smartphones.Successful exploitation of this vulnerability may cause the kernel to break down. |
CVE-2021-39972 | High | 7.5 | 2022-01-03 | MyHuawei-App has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability.Successful exploitation of this vulnerability could compromise conf… |
CVE-2021-39971 | High | 7.5 | 2022-01-03 | Password vault has a External Control of System or Configuration Setting vulnerability.Successful exploitation of this vulnerability could compromise confident… |
CVE-2021-39970 | High | 7.5 | 2022-01-03 | HwPCAssistant has a Improper Input Validation vulnerability.Successful exploitation of this vulnerability may create any file with the system app permission. |
CVE-2021-39969 | High | 7.5 | 2022-01-03 | There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-39968 | High | 7.5 | 2022-01-03 | Changlian Blocklist has a Business Logic Errors vulnerability .Successful exploitation of this vulnerability may expand the attack surface of the message class. |
CVE-2021-39967 | High | 7.5 | 2022-01-03 | There is a Vulnerability of obtaining broadcast information improperly due to improper broadcast permission settings in Smartphones.Successful exploitation of… |
CVE-2021-39966 | High | 7.5 | 2022-01-03 | There is an Uninitialized AOD driver structure in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-38576 | High | 7.5 | 2022-01-03 | A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways… |
CVE-2021-37134 | High | 8.1 | 2022-01-03 | Location-related APIs exists a Race Condition vulnerability.Successful exploitation of this vulnerability may use Higher Permissions for invoking the interface… |
CVE-2021-37133 | High | 7.5 | 2022-01-03 | There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-37132 | Medium | 5.3 | 2022-01-03 | PackageManagerService has a Permissions, Privileges, and Access Controls vulnerability .Successful exploitation of this vulnerability may cause that Third-part… |
CVE-2021-37128 | Critical | 9.8 | 2022-01-03 | HwPCAssistant has a Path Traversal vulnerability .Successful exploitation of this vulnerability may write any file. |
CVE-2021-37126 | High | 7.5 | 2022-01-03 | Arbitrary file has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability .Successful exploitation of this vulnerability may cause the dire… |
CVE-2021-37125 | High | 7.5 | 2022-01-03 | Arbitrary file has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability .Successful exploitation of this vulnerability may cause confiden… |
CVE-2021-37121 | Critical | 9.8 | 2022-01-03 | There is a Configuration defects in Smartphone.Successful exploitation of this vulnerability may elevate the MEID (IMEI) permission. |
CVE-2021-37120 | Critical | 9.8 | 2022-01-03 | There is a Double free vulnerability in Smartphone.Successful exploitation of this vulnerability may cause a kernel crash or privilege escalation. |
CVE-2021-37119 | High | 7.5 | 2022-01-03 | There is a Service logic vulnerability in Smartphone.Successful exploitation of this vulnerability may cause WLAN DoS. |
CVE-2021-37118 | Medium | 5.3 | 2022-01-03 | The HwNearbyMain module has a Improper Handling of Exceptional Conditions vulnerability.Successful exploitation of this vulnerability may lead to message leak. |
CVE-2021-37117 | High | 7.5 | 2022-01-03 | There is a Service logic vulnerability in Smartphone.Successful exploitation of this vulnerability may cause WLAN DoS. |
CVE-2021-37116 | Critical | 9.1 | 2022-01-03 | PCManager has a Weaknesses Introduced During Design vulnerability .Successful exploitation of this vulnerability may cause that the PIN of the subscriber is ch… |
CVE-2021-37114 | Medium | 5.3 | 2022-01-03 | There is an Out-of-bounds read vulnerability in Smartphone.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-37113 | High | 7.5 | 2022-01-03 | There is a Privilege escalation vulnerability with the file system component in Smartphone.Successful exploitation of this vulnerability may affect service con… |
CVE-2021-37112 | Medium | 5.3 | 2022-01-03 | Hisuite module has a External Control of System or Configuration Setting vulnerability.Successful exploitation of this vulnerability may lead to Firmware leak. |
CVE-2021-37111 | High | 7.5 | 2022-01-03 | There is a Memory leakage vulnerability in Smartphone.Successful exploitation of this vulnerability may cause memory exhaustion. |
CVE-2021-37110 | High | 7.5 | 2022-01-03 | There is a Timing design defects in Smartphone.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-37098 | High | 7.5 | 2022-01-03 | Hilinksvc service exists a Data Processing Errors vulnerability .Successful exploitation of this vulnerability may cause application crash. |
CVE-2021-20148 | Medium | 4.3 | 2022-01-03 | ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on… |
CVE-2021-20147 | Medium | 5.3 | 2022-01-03 | ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an una… |
CVE-2021-46109 | Medium | 6.1 | 2022-01-03 | Invalid input sanitizing leads to reflected Cross Site Scripting (XSS) in ASUS RT-AC52U_B1 3.0.0.4.380.10931 can lead to a user session hijack. |
CVE-2021-3837 | Medium | 6.1 | 2022-01-03 | openwhyd is vulnerable to Improper Authorization |
CVE-2021-45428 | Critical | 9.8 | 2022-01-03 | TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CG… |
CVE-2021-44674 | Medium | 6.5 | 2022-01-03 | An information exposure issue has been discovered in Opmantek Open-AudIT 4.2.0. The vulnerability allows an authenticated attacker to read file outside of the… |
CVE-2021-25040 | Medium | 6.1 | 2022-01-03 | The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading… |
CVE-2021-25030 | High | 8.8 | 2022-01-03 | The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searc… |
CVE-2021-25027 | Medium | 6.1 | 2022-01-03 | The PowerPack Addons for Elementor WordPress plugin before 2.6.2 does not escape the tab parameter before outputting it back in an attribute in the admin dashb… |
CVE-2021-25023 | High | 7.2 | 2022-01-03 | The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.3.3.1 does not escape the sbp_convert_table_name parameter before using it in a… |
CVE-2021-25022 | Medium | 6.1 | 2022-01-03 | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputtin… |
CVE-2021-25021 | Medium | 4.9 | 2022-01-03 | The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting, allowing high privilege users to use a path… |