2021 CVEs (page 66)
Page 66 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21750 | High | 7.8 | 2021-12-27 | ZTE BigVideo Analysis product has a privilege escalation vulnerability. Due to improper management of the timed task modification privilege, an attacker with o… |
CVE-2021-43856 | High | 8.2 | 2021-12-27 | Wiki.js is a wiki app built on Node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through non-image file uploads for file types… |
CVE-2021-43855 | High | 8.2 | 2021-12-27 | Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through a SVG file upload made via a custom re… |
CVE-2021-43845 | High | 8.2 | 2021-12-27 | PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not… |
CVE-2021-38961 | Medium | 6.1 | 2021-12-27 | IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the int… |
CVE-2021-45232 | Critical | 9.8 | 2021-12-27 | In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and… |
CVE-2021-45339 | High | 7.8 | 2021-12-27 | Privilege escalation vulnerability in Avast Antivirus prior to 20.4 allows a local user to gain elevated privileges by "hollowing" trusted process which could… |
CVE-2021-45338 | High | 7.8 | 2021-12-27 | Multiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user to gain elevated privileges by calling unnecessarily powerful… |
CVE-2021-45337 | High | 8.8 | 2021-12-27 | Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with SYSTEM privileges to gain elevated priv… |
CVE-2021-45336 | High | 8.8 | 2021-12-27 | Privilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to 20.4 allows a local sandboxed code to gain elevated privileges by using… |
CVE-2021-45335 | High | 8.8 | 2021-12-27 | Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to control the outcome of scans, and therefor… |
CVE-2021-4173 | High | 7.8 | 2021-12-27 | vim is vulnerable to Use After Free |
CVE-2021-24998 | High | 7.5 | 2021-12-27 | The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is genera… |
CVE-2021-24997 | Medium | 6.5 | 2021-12-27 | The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to se… |
CVE-2021-24992 | Medium | 4.8 | 2021-12-27 | The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attributes and page, wh… |
CVE-2021-24988 | Medium | 5.4 | 2021-12-27 | The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lea… |
CVE-2021-24984 | Medium | 6.1 | 2021-12-27 | The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admi… |
CVE-2021-24980 | Medium | 6.1 | 2021-12-27 | The Gwolle Guestbook WordPress plugin before 4.2.0 does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back in an attribute, l… |
CVE-2021-24979 | Medium | 6.1 | 2021-12-27 | The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a… |
CVE-2021-24969 | Medium | 5.4 | 2021-12-27 | The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin d… |
CVE-2021-24967 | Medium | 6.1 | 2021-12-27 | The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated u… |
CVE-2021-24902 | Medium | 4.8 | 2021-12-27 | The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which could allow high pr… |
CVE-2021-24797 | Medium | 6.1 | 2021-12-27 | The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin d… |
CVE-2021-24753 | High | 7.2 | 2021-12-27 | The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in… |
CVE-2021-45711 | High | 7.5 | 2021-12-27 | An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second cha… |
CVE-2021-45710 | High | 8.1 | 2021-12-27 | An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot… |
CVE-2021-45709 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the crypto2 crate through 2021-10-08 for Rust. During Chacha20 encryption and decryption, an unaligned read of a u32 may occur. |
CVE-2021-45708 | High | 7.5 | 2021-12-27 | An issue was discovered in the abomonation crate through 2021-10-17 for Rust. Because transmute operations are insufficiently constrained, there can be an info… |
CVE-2021-45707 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an o… |
CVE-2021-45706 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum. |
CVE-2021-45705 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the nanorand crate before 0.6.1 for Rust. There can be multiple mutable references to the same object because the TlsWyRand Deref im… |
CVE-2021-45704 | High | 8.1 | 2021-12-27 | An issue was discovered in the metrics-util crate before 0.7.0 for Rust. There is a data race and memory corruption because AtomicBucket<T> unconditionally imp… |
CVE-2021-45703 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the tectonic_xdv crate before 0.1.12 for Rust. XdvParser::<T>::process may read from uninitialized memory locations. |
CVE-2021-45702 | High | 7.5 | 2021-12-27 | An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A merge operation may result in a use-after-free. |
CVE-2021-45701 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A patch operation may result in a use-after-free. |
CVE-2021-45700 | High | 7.5 | 2021-12-27 | An issue was discovered in the ckb crate before 0.40.0 for Rust. Attackers can cause a denial of service (Nervos CKB blockchain node crash) via a dead call tha… |
CVE-2021-45699 | High | 7.5 | 2021-12-27 | An issue was discovered in the ckb crate before 0.40.0 for Rust. Remote attackers may be able to conduct a 51% attack against the Nervos CKB blockchain by trig… |
CVE-2021-45698 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the ckb crate before 0.40.0 for Rust. A get_block_template RPC call may fail in situations where it is supposed to select a Nervos C… |
CVE-2021-45697 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the molecule crate before 0.7.2 for Rust. A FixVec partial read has an incorrect result. |
CVE-2021-45696 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the sha2 crate 0.9.7 before 0.9.8 for Rust. Hashes of long messages may be incorrect when the AVX2-accelerated backend is used. |
CVE-2021-45695 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the mopa crate through 2021-06-01 for Rust. It incorrectly relies on Trait memory layout, possibly leading to future occurrences of… |
CVE-2021-45694 | High | 7.5 | 2021-12-27 | An issue was discovered in the rdiff crate through 2021-02-03 for Rust. Window may read from uninitialized memory locations. |
CVE-2021-45693 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string_primitive may read from uninitialized memory locations. |
CVE-2021-45692 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_extension_others may read from uninitialized memory locations. |
CVE-2021-45691 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string may read from uninitialized memory locations. |
CVE-2021-45690 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_binary may read from uninitialized memory locations. |
CVE-2021-45689 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the gfx-auxil crate through 2021-01-07 for Rust. gfx_auxil::read_spirv may read from uninitialized memory locations. |
CVE-2021-45688 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the ash crate before 0.33.1 for Rust. util::read_spv may read from uninitialized memory locations. |
CVE-2021-45687 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation… |
CVE-2021-45686 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the csv-sniffer crate through 2021-01-05 for Rust. preamble_skipcount may read from uninitialized memory locations. |
CVE-2021-45685 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the columnar crate through 2021-01-07 for Rust. ColumnarReadExt::read_typed_vec may read from uninitialized memory locations. |
CVE-2021-45684 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the flumedb crate through 2021-01-07 for Rust. read_entry may read from uninitialized memory locations. |
CVE-2021-45683 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the binjs_io crate through 2021-01-03 for Rust. The Read method may read from uninitialized memory locations. |
CVE-2021-45682 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the bronzedb-protocol crate through 2021-01-03 for Rust. ReadKVExt may read from uninitialized memory locations. |
CVE-2021-45681 | High | 7.5 | 2021-12-27 | An issue was discovered in the derive-com-impl crate before 0.1.2 for Rust. An invalid reference (and memory corruption) can occur because AddRef might not be… |
CVE-2021-45680 | High | 7.5 | 2021-12-27 | An issue was discovered in the vec-const crate before 2.0.0 for Rust. It tries to construct a Vec from a pointer to a const slice, leading to memory corruption. |
CVE-2021-45720 | High | 7.5 | 2021-12-26 | An issue was discovered in the lru crate before 0.7.1 for Rust. The iterators have a use-after-free, as demonstrated by an access after a pop operation. |
CVE-2021-45719 | High | 7.5 | 2021-12-26 | An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. update_hook has a use-after-free. |
CVE-2021-45718 | High | 7.5 | 2021-12-26 | An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. rollback_hook has a use-after-free. |
CVE-2021-45717 | High | 7.5 | 2021-12-26 | An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. commit_hook has a use-after-free. |
CVE-2021-45716 | High | 7.5 | 2021-12-26 | An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_collation has a use-after-free. |
CVE-2021-45715 | High | 7.5 | 2021-12-26 | An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_window_function has a use-after-free. |
CVE-2021-45714 | High | 7.5 | 2021-12-26 | An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_aggregate_function has a use-after-free. |
CVE-2021-45713 | High | 7.5 | 2021-12-26 | An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_scalar_function has a use-after-free. |
CVE-2021-45712 | High | 7.5 | 2021-12-26 | An issue was discovered in the rust-embed crate before 6.3.0 for Rust. A ../ directory traversal can sometimes occur in debug mode. |
CVE-2021-44598 | Medium | 6.1 | 2021-12-26 | Attendance Management System 1.0 is affected by a Cross Site Scripting (XSS) vulnerability. The value of the FirstRecord request parameter is copied into the v… |
CVE-2021-4168 | High | 8.8 | 2021-12-26 | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-4169 | Medium | 6.1 | 2021-12-26 | livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-44078 | High | 8.1 | 2021-12-26 | An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5. It allows local attackers to escape the sandbox. An attacker must first obt… |
CVE-2021-45679 | High | 8.4 | 2021-12-26 | Certain NETGEAR devices are affected by privilege escalation. This affects R6900P before 1.3.3.140, R7000 before 1.0.11.126, R7000P before 1.3.3.140, and RS400… |
CVE-2021-45678 | Critical | 9.8 | 2021-12-26 | NETGEAR RAX200 devices before 1.0.5.132 are affected by insecure code. |
CVE-2021-45677 | Medium | 5.2 | 2021-12-26 | Certain NETGEAR devices are affected by stored XSS. This affects GS108Tv2 before 5.4.2.36 and GS110TPv2 before 5.4.2.36. |
CVE-2021-45676 | Medium | 4.3 | 2021-12-26 | Certain NETGEAR devices are affected by stored XSS. This affects RAX200 before 1.0.5.126, RAX20 before 1.0.2.82, RAX80 before 1.0.5.126, RAX15 before 1.0.2.82… |
CVE-2021-45675 | Medium | 5.8 | 2021-12-26 | Certain NETGEAR devices are affected by stored XSS. This affects R6120 before 1.0.0.76, R6260 before 1.1.0.78, R6850 before 1.1.0.78, R6350 before 1.1.0.78, R6… |
CVE-2021-45674 | Low | 3.2 | 2021-12-26 | Certain NETGEAR devices are affected by stored XSS. This affects R7000 before 1.0.11.110, R7900 before 1.0.4.30, R8000 before 1.0.4.62, RAX15 before 1.0.2.82… |
CVE-2021-45673 | Medium | 4.8 | 2021-12-26 | Certain NETGEAR devices are affected by stored XSS. This affects R7000 before 1.0.11.110, R7900 before 1.0.4.30, R8000 before 1.0.4.62, RAX200 before 1.0.3.106… |
CVE-2021-45672 | Medium | 4.2 | 2021-12-26 | Certain NETGEAR devices are affected by Stored XSS. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before 1.0.0.48, R… |
CVE-2021-45671 | Medium | 6.5 | 2021-12-26 | Certain NETGEAR devices are affected by stored XSS. This affects CBR40 before 2.5.0.10, EAX80 before 1.0.1.62, EX7500 before 1.0.0.72, R7900 before 1.0.4.38, R… |
CVE-2021-45670 | Medium | 6.5 | 2021-12-26 | Certain NETGEAR devices are affected by stored XSS. This affects CBR40 before 2.5.0.10, EAX20 before 1.0.0.48, EAX80 before 1.0.1.64, EX6120 before 1.0.0.64, E… |
CVE-2021-45669 | Low | 3.7 | 2021-12-26 | Certain NETGEAR devices are affected by stored XSS. This affects RAX200 before 1.0.3.106, MR60 before 1.0.6.110, RAX20 before 1.0.2.82, RAX45 before 1.0.2.72… |
CVE-2021-45668 | Medium | 6.5 | 2021-12-26 | Certain NETGEAR devices are affected by stored XSS. This affects EAX20 before 1.0.0.48, EAX80 before 1.0.1.64, EX3700 before 1.0.0.90, EX3800 before 1.0.0.90… |
CVE-2021-45667 | Medium | 6.5 | 2021-12-26 | Certain NETGEAR devices are affected by stored XSS. This affects CBR40 before 2.5.0.10, EAX20 before 1.0.0.48, EAX80 before 1.0.1.64, EX6120 before 1.0.0.64, E… |
CVE-2021-45666 | Medium | 6.5 | 2021-12-26 | Certain NETGEAR devices are affected by stored XSS. This affects CBR40 before 2.5.0.10, EAX80 before 1.0.1.64, EX3700 before 1.0.0.90, EX3800 before 1.0.0.90… |
CVE-2021-45665 | Medium | 6.5 | 2021-12-26 | Certain NETGEAR devices are affected by stored XSS. This affects EAX20 before 1.0.0.36, EAX80 before 1.0.1.62, EX3700 before 1.0.0.90, EX3800 before 1.0.0.90… |
CVE-2021-45664 | Medium | 5.6 | 2021-12-26 | NETGEAR R7000 devices before 1.0.11.126 are affected by stored XSS. |
CVE-2021-45663 | Medium | 6.1 | 2021-12-26 | NETGEAR R7000 devices before 1.0.11.126 are affected by stored XSS. |
CVE-2021-45662 | Medium | 6.1 | 2021-12-26 | NETGEAR R7000 devices before 1.0.9.88 are affected by stored XSS. |
CVE-2021-45661 | High | 7.1 | 2021-12-26 | Certain NETGEAR devices are affected by server-side injection. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16, RBS40 before 2.5.1.16, RBK20 before 2… |
CVE-2021-45660 | High | 7.1 | 2021-12-26 | Certain NETGEAR devices are affected by server-side injection. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16, RBS40 before 2.5.1.16, RBK20 before 2… |
CVE-2021-45659 | High | 7.1 | 2021-12-26 | Certain NETGEAR devices are affected by server-side injection. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16, RBS40 before 2.5.1.16, RBK20 before 2… |
CVE-2021-45658 | High | 7.1 | 2021-12-26 | Certain NETGEAR devices are affected by server-side injection. This affects D7800 before 1.0.1.58, DM200 before 1.0.0.66, EX2700 before 1.0.1.56, EX6150v2 befo… |
CVE-2021-45657 | High | 7.1 | 2021-12-26 | Certain NETGEAR devices are affected by server-side injection. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before… |
CVE-2021-45656 | High | 7.1 | 2021-12-26 | Certain NETGEAR devices are affected by server-side injection. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before… |
CVE-2021-45655 | Medium | 6.9 | 2021-12-26 | NETGEAR R6400 devices before 1.0.1.70 are affected by server-side injection. |
CVE-2021-45654 | Critical | 9.6 | 2021-12-26 | NETGEAR XR1000 devices before 1.0.0.58 are affected by disclosure of sensitive information. |
CVE-2021-45653 | Low | 3.9 | 2021-12-26 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects RBK352 before 4.4.0.10, RBR350 before 4.4.0.10, and RBS350 before 4.4… |
CVE-2021-45652 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects RBK352 before 4.4.0.10, RBR350 before 4.4.0.10, and RBS350 before 4.4… |
CVE-2021-45651 | High | 7.4 | 2021-12-26 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects RBK50 before 2.7.3.22, RBR50 before 2.7.3.22, and RBS50 before 2.7.3… |
CVE-2021-45650 | Critical | 9.1 | 2021-12-26 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects R7000 before 1.0.11.110, R7900 before 1.0.4.30, R8000 before 1.0.4.62… |
CVE-2021-45649 | High | 7.9 | 2021-12-26 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects R6400v2 before 1.0.4.84, R6700v3 before 1.0.4.84, R7000 before 1.0.11… |