2021 CVEs (page 69)
Page 69 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-45472 | Medium | 6.1 | 2021-12-24 | In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution ma… |
CVE-2021-45471 | Medium | 5.3 | 2021-12-24 | In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items. |
CVE-2021-45470 | High | 7.5 | 2021-12-23 | lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection, which can lead to ReDoS (regular expression denial of service) or other im… |
CVE-2021-3622 | Medium | 4.3 | 2021-12-23 | A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry (hive) file, which would cause hivex to recur… |
CVE-2021-3621 | High | 8.8 | 2021-12-23 | A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows… |
CVE-2021-4024 | Medium | 6.5 | 2021-12-23 | A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` pro… |
CVE-2021-44543 | Medium | 6.1 | 2021-12-23 | An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the template name when Privoxy is configured to servce the user-… |
CVE-2021-44542 | High | 7.5 | 2021-12-23 | A memory leak vulnerability was found in Privoxy when handling errors. |
CVE-2021-44541 | High | 7.5 | 2021-12-23 | A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing header memory when failing to get the request destinatio… |
CVE-2021-44540 | High | 7.5 | 2021-12-23 | A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled pattern spec before bailing. |
CVE-2021-44453 | Critical | 10.0 | 2021-12-23 | mySCADA myPRO: Versions 8.20.0 and prior has a vulnerable debug interface which includes a ping utility, which may allow an attacker to inject arbitrary operat… |
CVE-2021-43989 | High | 7.5 | 2021-12-23 | mySCADA myPRO Versions 8.20.0 and prior stores passwords using MD5, which may allow an attacker to crack the previously retrieved password hashes. |
CVE-2021-43987 | Critical | 9.8 | 2021-12-23 | An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web interface, which cann… |
CVE-2021-43985 | Critical | 9.1 | 2021-12-23 | An unauthenticated remote attacker can access mySCADA myPRO Versions 8.20.0 and prior without any form of authentication or authorization. |
CVE-2021-43984 | Critical | 10.0 | 2021-12-23 | mySCADA myPRO: Versions 8.20.0 and prior has a feature where the firmware can be updated, which may allow an attacker to inject arbitrary operating system comm… |
CVE-2021-43981 | Critical | 10.0 | 2021-12-23 | mySCADA myPRO: Versions 8.20.0 and prior has a feature to send emails, which may allow an attacker to inject arbitrary operating system commands through a spec… |
CVE-2021-3584 | High | 7.2 | 2021-12-23 | A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite… |
CVE-2021-35243 | Medium | 5.3 | 2021-12-23 | The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to execute dangerous HTTP requests. The HTTP… |
CVE-2021-30767 | Medium | 5.5 | 2021-12-23 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.6.2, macOS Monterey 12.1, Security Update 2021-008 Catalina… |
CVE-2021-27007 | Critical | 9.8 | 2021-12-23 | NetApp Virtual Desktop Service (VDS) when used with an HTML5 gateway is susceptible to a vulnerability which when successfully exploited could allow an unauthe… |
CVE-2021-27006 | Medium | 4.4 | 2021-12-23 | StorageGRID (formerly StorageGRID Webscale) versions 11.5 prior to 11.5.0.5 are susceptible to a vulnerability which may allow an administrative user to escala… |
CVE-2021-23198 | Critical | 10.0 | 2021-12-23 | mySCADA myPRO: Versions 8.20.0 and prior has a feature where the password can be specified, which may allow an attacker to inject arbitrary operating system co… |
CVE-2021-22657 | Critical | 10.0 | 2021-12-23 | mySCADA myPRO: Versions 8.20.0 and prior has a feature where the API password can be specified, which may allow an attacker to inject arbitrary operating syste… |
CVE-2021-20318 | High | 7.2 | 2021-12-23 | The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with… |
CVE-2021-45469 | High | 7.8 | 2021-12-23 | In __f2fs_setxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there is an out-of-bounds memory access when an inode has an invalid last xattr entr… |
CVE-2021-40161 | High | 7.8 | 2021-12-23 | A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through PDFTron earlier than 9.0.7 version. |
CVE-2021-40160 | High | 7.8 | 2021-12-23 | PDFTron prior to 9.0.7 version may be forced to read beyond allocated boundaries when parsing a maliciously crafted PDF file. This vulnerability can be exploit… |
CVE-2021-4118 | High | 7.8 | 2021-12-23 | pytorch-lightning is vulnerable to Deserialization of Untrusted Data |
CVE-2021-43854 | High | 7.5 | 2021-12-23 | NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Proc… |
CVE-2021-43849 | Medium | 6.2 | 2021-12-23 | cordova-plugin-fingerprint-aio is a plugin provides a single and simple interface for accessing fingerprint APIs on both Android 6+ and iOS. In versions prior… |
CVE-2021-23175 | High | 8.2 | 2021-12-23 | NVIDIA GeForce Experience contains a vulnerability in user authorization, where GameStream does not correctly apply individual user access controls for users o… |
CVE-2021-44526 | Critical | 9.8 | 2021-12-23 | Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations. |
CVE-2021-44600 | High | 7.5 | 2021-12-23 | The password parameter on Simple Online Mens Salon Management System (MSMS) 1.0 appears to be vulnerable to SQL injection attacks through the password paramete… |
CVE-2021-44599 | High | 7.5 | 2021-12-23 | The id parameter from Online Enrollment Management System 1.0 system appears to be vulnerable to SQL injection attacks. A crafted payload injects a SQL sub-que… |
CVE-2021-44273 | High | 7.4 | 2021-12-23 | e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode (i.e., acting as a proxy or a transpa… |
CVE-2021-44548 | Critical | 9.8 | 2021-12-23 | An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network cal… |
CVE-2021-4144 | High | 8.8 | 2021-12-23 | TP-Link wifi router TL-WR802N V4(JP), with firmware version prior to 211202, is vulnerable to OS command injection. |
CVE-2021-45463 | High | 7.8 | 2021-12-23 | load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the… |
CVE-2021-45462 | High | 7.5 | 2021-12-23 | In Open5GS 2.4.0, a crafted packet from UE can crash SGW-U/UPF. |
CVE-2021-20050 | High | 7.5 | 2021-12-23 | An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially e… |
CVE-2021-20049 | High | 7.5 | 2021-12-23 | A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server res… |
CVE-2021-4079 | High | 8.8 | 2021-12-23 | Out of bounds write in WebRTC in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via crafted WebRTC packet… |
CVE-2021-4078 | High | 8.8 | 2021-12-23 | Type confusion in V8 in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-4068 | Medium | 6.5 | 2021-12-23 | Insufficient data validation in new tab page in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2021-4067 | High | 8.8 | 2021-12-23 | Use after free in window manager in Google Chrome on ChromeOS prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a craf… |
CVE-2021-4066 | High | 8.8 | 2021-12-23 | Integer underflow in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-4065 | High | 8.8 | 2021-12-23 | Use after free in autofill in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-4064 | High | 8.8 | 2021-12-23 | Use after free in screen capture in Google Chrome on ChromeOS prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a craf… |
CVE-2021-4063 | High | 8.8 | 2021-12-23 | Use after free in developer tools in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2021-4062 | High | 8.8 | 2021-12-23 | Heap buffer overflow in BFCache in Google Chrome prior to 96.0.4664.93 allowed a remote attacker who had compromised the renderer process to potentially exploi… |
CVE-2021-4061 | High | 8.8 | 2021-12-23 | Type confusion in V8 in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-4059 | Medium | 6.5 | 2021-12-23 | Insufficient data validation in loader in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2021-4058 | High | 8.8 | 2021-12-23 | Heap buffer overflow in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-4057 | High | 8.8 | 2021-12-23 | Use after free in file API in Google Chrome prior to 96.0.4664.93 allowed a remote attacker who had compromised the renderer process to potentially exploit hea… |
CVE-2021-4056 | High | 8.8 | 2021-12-23 | Type confusion in loader in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-4055 | High | 8.8 | 2021-12-23 | Heap buffer overflow in extensions in Google Chrome prior to 96.0.4664.93 allowed an attacker who convinced a user to install a malicious extension to potentia… |
CVE-2021-4054 | Medium | 6.5 | 2021-12-23 | Incorrect security UI in autofill in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2021-4053 | High | 8.8 | 2021-12-23 | Use after free in UI in Google Chrome on Linux prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-4052 | High | 8.8 | 2021-12-23 | Use after free in web apps in Google Chrome prior to 96.0.4664.93 allowed an attacker who convinced a user to install a malicious extension to potentially expl… |
CVE-2021-38022 | Medium | 6.5 | 2021-12-23 | Inappropriate implementation in WebAuthentication in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2021-38021 | Medium | 6.5 | 2021-12-23 | Inappropriate implementation in referrer in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2021-38020 | Medium | 4.3 | 2021-12-23 | Insufficient policy enforcement in contacts picker in Google Chrome on Android prior to 96.0.4664.45 allowed a remote attacker to spoof the contents of the Omn… |
CVE-2021-38019 | Medium | 6.5 | 2021-12-23 | Insufficient policy enforcement in CORS in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2021-38018 | Medium | 6.5 | 2021-12-23 | Inappropriate implementation in navigation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2021-38017 | High | 8.8 | 2021-12-23 | Insufficient policy enforcement in iframe sandbox in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions via a craf… |
CVE-2021-38016 | High | 8.8 | 2021-12-23 | Insufficient policy enforcement in background fetch in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass same origin policy via a crafted… |
CVE-2021-38015 | High | 8.8 | 2021-12-23 | Inappropriate implementation in input in Google Chrome prior to 96.0.4664.45 allowed an attacker who convinced a user to install a malicious extension to bypas… |
CVE-2021-38014 | High | 8.8 | 2021-12-23 | Out of bounds write in Swiftshader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2021-38013 | Critical | 9.6 | 2021-12-23 | Heap buffer overflow in fingerprint recognition in Google Chrome on ChromeOS prior to 96.0.4664.45 allowed a remote attacker who had compromised a WebUI render… |
CVE-2021-38012 | High | 8.8 | 2021-12-23 | Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-38011 | High | 8.8 | 2021-12-23 | Use after free in storage foundation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2021-38010 | Medium | 6.5 | 2021-12-23 | Inappropriate implementation in service workers in Google Chrome prior to 96.0.4664.45 allowed a remote attacker who had compromised the renderer process to by… |
CVE-2021-38009 | Medium | 6.5 | 2021-12-23 | Inappropriate implementation in cache in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2021-38008 | High | 8.8 | 2021-12-23 | Use after free in media in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-38007 | High | 8.8 | 2021-12-23 | Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-38006 | High | 8.8 | 2021-12-23 | Use after free in storage foundation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2021-38005 | High | 8.8 | 2021-12-23 | Use after free in loader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-43853 | High | 8.7 | 2021-12-22 | Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object inj… |
CVE-2021-45461 | Critical | 9.8 | 2021-12-22 | FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code… |
CVE-2021-44544 | High | 7.5 | 2021-12-22 | DIAEnergie Version 1.7.5 and prior is vulnerable to multiple cross-site scripting vulnerabilities when arbitrary code is injected into the parameter “name” of… |
CVE-2021-44471 | High | 7.5 | 2021-12-22 | DIAEnergie Version 1.7.5 and prior is vulnerable to stored cross-site scripting when an unauthenticated user injects arbitrary code into the parameter “name” o… |
CVE-2021-40418 | Critical | 9.8 | 2021-12-22 | When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property containing an objec… |
CVE-2021-40417 | Critical | 9.8 | 2021-12-22 | When parsing a file that is submitted to the DPDecoder service as a job, the service will use the combination of decoding parameters that were submitted with t… |
CVE-2021-40394 | Critical | 9.8 | 2021-12-22 | An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and the for… |
CVE-2021-40393 | Critical | 9.8 | 2021-12-22 | An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and the for… |
CVE-2021-39306 | Critical | 9.8 | 2021-12-22 | A stack buffer overflow was discovered on Realtek RTL8195AM device before 2.0.10, it exists in the client code when an attacker sends a big size Authentication… |
CVE-2021-36886 | Medium | 6.5 | 2021-12-22 | Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9). |
CVE-2021-36885 | Medium | 6.1 | 2021-12-22 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1). |
CVE-2021-31558 | Medium | 6.5 | 2021-12-22 | DIAEnergie Version 1.7.5 and prior is vulnerable to stored cross-site scripting when an unauthenticated user injects arbitrary code into the parameter “descr”… |
CVE-2021-23228 | High | 7.5 | 2021-12-22 | DIAEnergie Version 1.7.5 and prior is vulnerable to a reflected cross-site scripting attack through error pages that are returned by “.NET Request.QueryString”. |
CVE-2021-21953 | High | 8.1 | 2021-12-22 | An authentication bypass vulnerability exists in the process_msg() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted… |
CVE-2021-21952 | Critical | 9.8 | 2021-12-22 | An authentication bypass vulnerability exists in the CMD_DEVICE_GET_RSA_KEY_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h… |
CVE-2021-21937 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘host_alt_filter’… |
CVE-2021-21936 | High | 8.8 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘health_alt_filte… |
CVE-2021-21935 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘host_alt_filter2… |
CVE-2021-21934 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘imei_filter’ parameter. This c… |
CVE-2021-21933 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘esn_filter’ parameter. This ca… |
CVE-2021-21932 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘name_filter’ parameter. This c… |
CVE-2021-21931 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at‘ stat_filter’ parameter to trigger this vulnera… |
CVE-2021-21930 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at ‘sn_filter’ parameter to trigger this vulnerabi… |