2021 CVEs (page 65)
Page 65 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-23147 | Medium | 6.8 | 2021-12-30 | Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console. A malicious actor with physical access to the device is ab… |
CVE-2021-20175 | High | 7.5 | 2021-12-30 | Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface. By default, all communication to/from the device… |
CVE-2021-20174 | High | 7.5 | 2021-12-30 | Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface. By default, all communication to/from the device'… |
CVE-2021-20173 | High | 8.8 | 2021-12-30 | Netgear Nighthawk R6700 version 1.0.4.120 contains a command injection vulnerability in update functionality of the device. By triggering a system update check… |
CVE-2021-20172 | High | 7.8 | 2021-12-30 | All known versions of the Netgear Genie Installer for macOS contain a local privilege escalation vulnerability. The installer of the macOS version of Netgear G… |
CVE-2021-20171 | Medium | 5.5 | 2021-12-30 | Netgear RAX43 version 1.0.3.96 stores sensitive information in plaintext. All usernames and passwords for the device's associated services are stored in plaint… |
CVE-2021-20170 | High | 8.8 | 2021-12-30 | Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to be able to manipulate configuration bac… |
CVE-2021-20169 | Medium | 6.8 | 2021-12-30 | Netgear RAX43 version 1.0.3.96 does not utilize secure communications to the web interface. By default, all communication to/from the device is sent via HTTP… |
CVE-2021-20168 | Medium | 6.8 | 2021-12-30 | Netgear RAX43 version 1.0.3.96 does not have sufficient protections to the UART interface. A malicious actor with physical access to the device is able to conn… |
CVE-2021-20167 | High | 8.0 | 2021-12-30 | Netgear RAX43 version 1.0.3.96 contains a command injection vulnerability. The readycloud cgi application is vulnerable to command injection in the name parame… |
CVE-2021-20166 | High | 8.8 | 2021-12-30 | Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer… |
CVE-2021-20165 | High | 8.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 does not properly implement csrf protections. Most pages lack proper usage of CSRF protections or mitigations. Addit… |
CVE-2021-20164 | Medium | 4.9 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses credentials for the smb functionality of the device. Usernames and passwords for all smb users… |
CVE-2021-20163 | Medium | 4.9 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 leaks information via the ftp web page. Usernames and passwords for all ftp users are revealed in plaintext on the f… |
CVE-2021-20162 | Medium | 4.9 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 stores credentials in plaintext. Usernames and passwords are stored in plaintext in the config files on the device… |
CVE-2021-20161 | Medium | 6.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient protections for the UART functionality. A malicious actor with physical access to the devic… |
CVE-2021-20160 | High | 8.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains a command injection vulnerability in the smb functionality of the device. The username parameter used when… |
CVE-2021-20159 | High | 8.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 is vulnerable to command injection. The system log functionality of the firmware allows for command injection as roo… |
CVE-2021-20158 | Critical | 9.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability. It is possible for an unauthenticated, malicous actor to force the… |
CVE-2021-20157 | High | 7.5 | 2021-12-30 | It is possible for an unauthenticated, malicious user to force the device to reboot due to a hidden administrative command. |
CVE-2021-20156 | Medium | 6.5 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains an improper access control configuration that could allow for a malicious firmware update. It is possible t… |
CVE-2021-20155 | Critical | 9.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 makes use of hardcoded credentials. It is possible to backup and restore device configurations via the management we… |
CVE-2021-20154 | High | 7.5 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains an security flaw in the web interface. HTTPS is not enabled on the device by default. This results in clear… |
CVE-2021-20153 | Medium | 6.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains a symlink vulnerability in the bittorrent functionality. If enabled, the bittorrent functionality is vulner… |
CVE-2021-20152 | Medium | 6.5 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 lacks proper authentication to the bittorrent functionality. If enabled, anyone is able to visit and modify settings… |
CVE-2021-20151 | Critical | 10.0 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's management software manages web sessions base… |
CVE-2021-20150 | Medium | 5.3 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. Authentication can be bypassed and a user ma… |
CVE-2021-20149 | Critical | 9.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient access controls for the WAN interface. The default iptables ruleset for governing access to… |
CVE-2021-20134 | High | 8.4 | 2021-12-30 | Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authent… |
CVE-2021-20133 | Medium | 6.1 | 2021-12-30 | Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authent… |
CVE-2021-20132 | High | 8.8 | 2021-12-30 | Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administ… |
CVE-2021-45379 | High | 8.8 | 2021-12-30 | Glewlwyd 2.0.0, fixed in 2.6.1 is affected by an incorrect access control vulnerability. One user can attempt to log in as another user without its password. |
CVE-2021-38876 | Medium | 6.1 | 2021-12-30 | IBM i 7.2, 7.3, and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering t… |
CVE-2021-43862 | Low | 3.7 | 2021-12-30 | jQuery Terminal Emulator is a plugin for creating command line interpreters in your applications. Versions prior to 2.31.1 contain a low impact and limited cro… |
CVE-2021-43861 | High | 7.2 | 2021-12-30 | Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams… |
CVE-2021-45818 | Medium | 6.1 | 2021-12-30 | SAFARI Montage 8.7.32 is affected by a CRLF injection vulnerability which can lead to HTTP response splitting. |
CVE-2021-45815 | Medium | 6.1 | 2021-12-30 | Quectel UC20 UMTS/HSPA+ UC20 6.3.14 is affected by a Cross Site Scripting (XSS) vulnerability. |
CVE-2021-45427 | Critical | 9.8 | 2021-12-30 | Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. An attacker can browse and delete files with… |
CVE-2021-4188 | High | 7.5 | 2021-12-30 | mruby is vulnerable to NULL Pointer Dereference |
CVE-2021-43876 | High | 8.8 | 2021-12-29 | Microsoft SharePoint Elevation of Privilege Vulnerability |
CVE-2021-36724 | Medium | 6.1 | 2021-12-29 | ForeScout - SecureConnector Local Service DoS - A low privilaged user which doesn't have permissions to shutdown the secure connector service writes a large am… |
CVE-2021-4187 | High | 7.8 | 2021-12-29 | vim is vulnerable to Use After Free |
CVE-2021-45885 | High | 7.5 | 2021-12-29 | An issue was discovered in Stormshield Network Security (SNS) 4.2.2 through 4.2.7 (fixed in 4.2.8). Under a specific update-migration scenario, the first SSH p… |
CVE-2021-25993 | Medium | 5.4 | 2021-12-29 | In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file th… |
CVE-2021-23727 | High | 7.5 | 2021-12-29 | This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata fro… |
CVE-2021-4176 | Medium | 6.1 | 2021-12-29 | livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-4175 | Medium | 5.4 | 2021-12-29 | livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-36723 | Medium | 6.1 | 2021-12-29 | Emuse - eServices / eNvoice Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs an attacker can scrape all th… |
CVE-2021-36722 | High | 7.1 | 2021-12-29 | Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on… |
CVE-2021-38688 | High | 7.1 | 2021-12-29 | An improper authentication vulnerability has been reported to affect Android App Qfile. If exploited, this vulnerability allows attackers to compromise app and… |
CVE-2021-38687 | High | 8.1 | 2021-12-29 | A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Surveillance Station. If exploited, this vulnerability allows attackers to e… |
CVE-2021-38680 | Medium | 5.3 | 2021-12-29 | A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Kazoo Server. If exploited, this vulnerability allows remote attacke… |
CVE-2021-35035 | Medium | 4.9 | 2021-12-29 | A cleartext storage of sensitive information vulnerability in the Zyxel NBG6604 firmware could allow a remote, authenticated attacker to obtain sensitive infor… |
CVE-2021-35034 | High | 7.4 | 2021-12-29 | An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access the device if the cor… |
CVE-2021-25991 | Medium | 5.7 | 2021-12-29 | In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deac… |
CVE-2021-25990 | Medium | 5.4 | 2021-12-29 | In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe. |
CVE-2021-25989 | Medium | 5.4 | 2021-12-29 | In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of… |
CVE-2021-25988 | Medium | 5.4 | 2021-12-29 | In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability (notifications section) which can be directly triggered by sending an ally… |
CVE-2021-44161 | High | 8.8 | 2021-12-29 | Changing MOTP (Mobile One Time Password) system’s specific function parameter has insufficient validation for user input. A attacker in local area network can… |
CVE-2021-44160 | High | 7.3 | 2021-12-29 | Carinal Tien Hospital Health Report System’s login page has improper authentication, a remote attacker can acquire another general user’s privilege by modifyin… |
CVE-2021-44832 | Medium | 6.6 | 2021-12-28 | Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when… |
CVE-2021-43556 | High | 7.8 | 2021-12-28 | FATEK WinProladder Versions 3.30_24518 and prior are vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to… |
CVE-2021-43554 | High | 7.8 | 2021-12-28 | FATEK WinProladder Versions 3.30_24518 and prior are vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to execut… |
CVE-2021-42583 | High | 7.5 | 2021-12-28 | A Broken or Risky Cryptographic Algorithm exists in Max Mazurov Maddy before 0.5.2, which is an unnecessary risk that may result in the exposure of sensitive i… |
CVE-2021-45814 | Critical | 9.8 | 2021-12-28 | Nettmp NNT 5.1 is affected by a SQL injection vulnerability. An attacker can bypass authentication and access the panel with an administrative account. |
CVE-2021-45813 | Medium | 6.1 | 2021-12-28 | SLICAN WebCTI 1.01 2015 is affected by a Cross Site Scripting (XSS) vulnerability. The attacker can steal the user's session by injecting malicious JavaScript… |
CVE-2021-45812 | Medium | 6.1 | 2021-12-28 | NUUO Network Video Recorder NVRsolo 3.9.1 is affected by a Cross Site Scripting (XSS) vulnerability. An attacker can steal the user's session by injecting mali… |
CVE-2021-45903 | Medium | 6.1 | 2021-12-28 | A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to… |
CVE-2021-45425 | Medium | 6.1 | 2021-12-28 | Reflected Cross Site Scripting (XSS) in SAFARI Montage versions 8.3 and 8.5 allows remote attackers to execute JavaScript codes. |
CVE-2021-37401 | Critical | 9.8 | 2021-12-28 | An attacker may obtain the user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As a result, the PLC user program may be up… |
CVE-2021-37400 | Critical | 9.8 | 2021-12-28 | An attacker may obtain the user credentials from the communication between the PLC and the software. As a result, the PLC user program may be uploaded, altered… |
CVE-2021-40579 | Medium | 6.5 | 2021-12-28 | https://www.sourcecodester.com/ Online Enrollment Management System in PHP and PayPal Free Source Code 1.0 is affected by: Incorrect Access Control. The impact… |
CVE-2021-35032 | Medium | 6.4 | 2021-12-28 | A vulnerability in the 'libsal.so' of the Zyxel GS1900 series firmware version 2.60 could allow an authenticated local user to execute arbitrary OS commands vi… |
CVE-2021-35031 | Medium | 6.8 | 2021-12-28 | A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware, which could allow an authenticated LA… |
CVE-2021-4179 | Medium | 5.4 | 2021-12-28 | livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-4177 | Medium | 5.3 | 2021-12-28 | livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information |
CVE-2021-20873 | High | 8.1 | 2021-12-28 | Yappli is an application development platform which provides the function to access a requested URL using Custom URL Scheme. When Android apps are developed wi… |
CVE-2021-45911 | High | 7.8 | 2021-12-28 | An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow in the main function. It allows an attacker to write 2 bytes outside the boundar… |
CVE-2021-45910 | High | 7.8 | 2021-12-28 | An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow within the main function. It allows an attacker to write data outside of the all… |
CVE-2021-45909 | High | 7.8 | 2021-12-28 | An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow vulnerability in the DecodeLZW function. It allows an attacker to write a large… |
CVE-2021-45908 | High | 7.8 | 2021-12-28 | An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a while loop. An attacker has little influence over the data written… |
CVE-2021-45907 | High | 7.8 | 2021-12-28 | An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a for loop. An attacker has little influence over the data written to… |
CVE-2021-45906 | Medium | 5.4 | 2021-12-27 | OpenWrt 21.02.1 allows XSS via the NAT Rules Name screen. |
CVE-2021-45905 | Medium | 5.4 | 2021-12-27 | OpenWrt 21.02.1 allows XSS via the Traffic Rules Name screen. |
CVE-2021-45904 | Medium | 5.4 | 2021-12-27 | OpenWrt 21.02.1 allows XSS via the Port Forwards Add Name screen. |
CVE-2021-45896 | High | 8.8 | 2021-12-27 | Nokia FastMile 3TG00118ABAD52 devices allow privilege escalation by an authenticated user via is_ctc_admin=1 to login_web_app.cgi and use of Import Config File. |
CVE-2021-45884 | High | 7.5 | 2021-12-27 | In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requ… |
CVE-2021-43858 | High | 8.8 | 2021-12-27 | MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call… |
CVE-2021-45895 | Medium | 6.1 | 2021-12-27 | Netgen Tags Bundle 3.4.x before 3.4.11 and 4.0.x before 4.0.15 allows XSS in the Tags Admin interface. |
CVE-2021-45890 | Critical | 9.8 | 2021-12-27 | basic/BasicAuthProvider.java in AuthGuard before 0.9.0 allows authentication via an inactive identifier. |
CVE-2021-4161 | Critical | 9.8 | 2021-12-27 | The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. This could give an… |
CVE-2021-43857 | Critical | 9.8 | 2021-12-27 | Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in versio… |
CVE-2021-43552 | Medium | 6.1 | 2021-12-27 | The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from the Patient Information Center iX (PIC i… |
CVE-2021-43550 | Medium | 5.9 | 2021-12-27 | The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information, which affects the communi… |
CVE-2021-43548 | Medium | 6.5 | 2021-12-27 | Patient Information Center iX (PIC iX) Versions C.02 and C.03 receives input or data, but does not validate or incorrectly validates that the input has the pro… |
CVE-2021-35232 | Medium | 6.8 | 2021-12-27 | Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host mach… |
CVE-2021-33017 | High | 8.1 | 2021-12-27 | The standard access path of the IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) requires authentication, but the product has an alternate path or channel th… |
CVE-2021-32993 | High | 8.1 | 2021-12-27 | IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inboun… |
CVE-2021-23244 | High | 7.8 | 2021-12-27 | ColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default-grant-permissions.But some apps in whitelist is not installed… |
CVE-2021-21751 | High | 8.1 | 2021-12-27 | ZTE BigVideo analysis product has an input verification vulnerability. Due to the inconsistency between the front and back verifications when configuring the l… |