2021 CVEs (page 70)
Page 70 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21929 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at ‘prod_filter’ parameter to trigger this vulnera… |
CVE-2021-21928 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at ‘mac_filter’ parameter to trigger this vulnerab… |
CVE-2021-21927 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done… |
CVE-2021-21926 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done… |
CVE-2021-21925 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done… |
CVE-2021-21924 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done… |
CVE-2021-21923 | Medium | 4.9 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘company_filter’… |
CVE-2021-21922 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘username_filter’… |
CVE-2021-21921 | Medium | 4.9 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘name_filter’ par… |
CVE-2021-21920 | Medium | 4.9 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘surname_filter’… |
CVE-2021-21919 | Medium | 4.9 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ord’ parameter. H… |
CVE-2021-21918 | Medium | 4.9 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘name_filter’ par… |
CVE-2021-21917 | High | 8.8 | 2021-12-22 | An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted HTTP request at '‘… |
CVE-2021-21916 | High | 8.8 | 2021-12-22 | An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted HTTP request at 'd… |
CVE-2021-21915 | High | 8.8 | 2021-12-22 | An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted HTTP request at ‘c… |
CVE-2021-21912 | High | 7.8 | 2021-12-22 | A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-c… |
CVE-2021-21911 | High | 7.8 | 2021-12-22 | A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-c… |
CVE-2021-21910 | High | 7.8 | 2021-12-22 | A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-c… |
CVE-2021-21909 | High | 8.1 | 2021-12-22 | Specially-crafted command line arguments can lead to arbitrary file deletion in the del .cnt|.log file delete command. An attacker can provide malicious inputs… |
CVE-2021-21908 | Medium | 6.5 | 2021-12-22 | Specially-crafted command line arguments can lead to arbitrary file deletion. The handle_delete function does not attempt to sanitize or otherwise validate the… |
CVE-2021-21907 | Medium | 4.9 | 2021-12-22 | A directory traversal vulnerability exists in the CMA CLI getenv command functionality of Garrett Metal Detectors’ iC Module CMA Version 5.0. A specially-craft… |
CVE-2021-21906 | High | 7.2 | 2021-12-22 | Stack-based buffer overflow vulnerability exists in how the CMA readfile function of Garrett Metal Detectors iC Module CMA Version 5.0 is used at various locat… |
CVE-2021-21905 | High | 7.2 | 2021-12-22 | Stack-based buffer overflow vulnerability exists in how the CMA readfile function of Garrett Metal Detectors iC Module CMA Version 5.0 is used at various locat… |
CVE-2021-21904 | High | 7.2 | 2021-12-22 | A directory traversal vulnerability exists in the CMA CLI setenv command of Garrett Metal Detectors’ iC Module CMA Version 5.0. An attacker can provide malicio… |
CVE-2021-21903 | Critical | 9.8 | 2021-12-22 | A stack-based buffer overflow vulnerability exists in the CMA check_udp_crc function of Garrett Metal Detectors’ iC Module CMA Version 5.0. A specially-crafted… |
CVE-2021-21902 | High | 8.1 | 2021-12-22 | An authentication bypass vulnerability exists in the CMA run_server_6877 functionality of Garrett Metal Detectors iC Module CMA Version 5.0. A properly-timed n… |
CVE-2021-21901 | High | 8.8 | 2021-12-22 | A stack-based buffer overflow vulnerability exists in the CMA check_udp_crc function of Garrett Metal Detectors’ iC Module CMA Version 5.0. A specially-crafted… |
CVE-2021-21896 | Medium | 6.5 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafte… |
CVE-2021-21895 | High | 7.2 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP… |
CVE-2021-21894 | Critical | 9.1 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP… |
CVE-2021-21892 | Critical | 9.9 | 2021-12-22 | A stack-based buffer overflow vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially cr… |
CVE-2021-21891 | Critical | 9.1 | 2021-12-22 | A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A speciall… |
CVE-2021-21890 | Critical | 9.1 | 2021-12-22 | A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A speciall… |
CVE-2021-21889 | Critical | 9.9 | 2021-12-22 | A stack-based buffer overflow vulnerability exists in the Web Manager Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted… |
CVE-2021-21888 | Critical | 9.1 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager SslGenerateCertificate functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A speci… |
CVE-2021-21887 | Critical | 9.1 | 2021-12-22 | A stack-based buffer overflow vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A special… |
CVE-2021-21886 | Medium | 4.3 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager FSBrowsePage functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially crafted HTTP requ… |
CVE-2021-21885 | High | 7.2 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager FsMove functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially crafted HTTP request ca… |
CVE-2021-21884 | Critical | 9.1 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP… |
CVE-2021-21883 | Critical | 9.9 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager Diagnostics: Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HT… |
CVE-2021-21882 | High | 8.8 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP reque… |
CVE-2021-21881 | Critical | 9.9 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-cra… |
CVE-2021-21880 | High | 7.2 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager FsCopyFile functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP reques… |
CVE-2021-21879 | High | 8.8 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager File Upload functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP reque… |
CVE-2021-21878 | Medium | 4.9 | 2021-12-22 | A local file inclusion vulnerability exists in the Web Manager Applications and FsBrowse functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-cra… |
CVE-2021-21877 | Critical | 9.1 | 2021-12-22 | Specially-crafted HTTP requests can lead to arbitrary command execution in “GET” requests. An attacker can make authenticated HTTP requests to trigger this vul… |
CVE-2021-21876 | Critical | 9.1 | 2021-12-22 | Specially-crafted HTTP requests can lead to arbitrary command execution in PUT requests. An attacker can make authenticated HTTP requests to trigger this vulne… |
CVE-2021-21875 | Critical | 9.1 | 2021-12-22 | A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter. An attacker can make an authenticated HTTP request to trigg… |
CVE-2021-21874 | Critical | 9.1 | 2021-12-22 | A specially-crafted HTTP request can lead to arbitrary command execution in DSA keypasswd parameter. An attacker can make an authenticated HTTP request to trig… |
CVE-2021-21873 | Critical | 9.1 | 2021-12-22 | A specially-crafted HTTP request can lead to arbitrary command execution in RSA keypasswd parameter. An attacker can make an authenticated HTTP request to trig… |
CVE-2021-21872 | Critical | 9.9 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager Diagnostics: Traceroute functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-craf… |
CVE-2021-45267 | Medium | 5.5 | 2021-12-22 | An invalid memory address dereference vulnerability exists in gpac 1.1.0 via the svg_node_start function, which causes a segmentation fault and application cra… |
CVE-2021-45266 | High | 7.5 | 2021-12-22 | A null pointer dereference vulnerability exists in gpac 1.1.0 via the lsr_read_anim_values_ex function, which causes a segmentation fault and application crash. |
CVE-2021-45263 | Medium | 5.5 | 2021-12-22 | An invalid free vulnerability exists in gpac 1.1.0 via the gf_svg_delete_attribute_value function, which causes a segmentation fault and application crash. |
CVE-2021-45262 | Medium | 5.5 | 2021-12-22 | An invalid free vulnerability exists in gpac 1.1.0 via the gf_sg_command_del function, which causes a segmentation fault and application crash. |
CVE-2021-45261 | Medium | 5.5 | 2021-12-22 | An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service. |
CVE-2021-45260 | Medium | 5.5 | 2021-12-22 | A null pointer dereference vulnerability exists in gpac 1.1.0 in the lsr_read_id.part function, which causes a segmentation fault and application crash. |
CVE-2021-44659 | Critical | 9.8 | 2021-12-22 | Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side Requ… |
CVE-2021-43804 | High | 7.3 | 2021-12-22 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN… |
CVE-2021-43631 | Critical | 9.8 | 2021-12-22 | Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the appointment_no parameter in payment.php. |
CVE-2021-43630 | High | 8.8 | 2021-12-22 | Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in add_patient.php. As a result, an authenticated maliciou… |
CVE-2021-43629 | Critical | 9.8 | 2021-12-22 | Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in admin_home.php. |
CVE-2021-43628 | Critical | 9.8 | 2021-12-22 | Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the email parameter in hms-staff.php. |
CVE-2021-43158 | Medium | 4.3 | 2021-12-22 | In ProjectWorlds Online Shopping System PHP 1.0, a CSRF vulnerability in cart_remove.php allows a remote attacker to remove any product in the customer's cart. |
CVE-2021-43157 | Critical | 9.8 | 2021-12-22 | Projectsworlds Online Shopping System PHP 1.0 is vulnerable to SQL injection via the id parameter in cart_remove.php. |
CVE-2021-43156 | Medium | 6.5 | 2021-12-22 | In ProjectWorlds Online Book Store PHP 1.0 a CSRF vulnerability in admin_delete.php allows a remote attacker to delete any book. |
CVE-2021-43155 | Critical | 9.8 | 2021-12-22 | Projectsworlds Online Book Store PHP v1.0 is vulnerable to SQL injection via the "bookisbn" parameter in cart.php. |
CVE-2021-37706 | High | 7.3 | 2021-12-22 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN… |
CVE-2021-45419 | High | 8.8 | 2021-12-22 | Certain Starcharge products are affected by Improper Input Validation. The affected products include: Nova 360 Cabinet <= 1.3.0.0.7b102 - Fixed: Beta1.3.0.1.0… |
CVE-2021-45259 | Medium | 5.5 | 2021-12-22 | An Invalid pointer reference vulnerability exists in gpac 1.1.0 via the gf_svg_node_del function, which causes a segmentation fault and application crash. |
CVE-2021-45258 | Medium | 5.5 | 2021-12-22 | A stack overflow vulnerability exists in gpac 1.1.0 via the gf_bifs_dec_proto_list function, which causes a segmentation fault and application crash. |
CVE-2021-45257 | Medium | 5.5 | 2021-12-22 | An infinite loop vulnerability exists in nasm 2.16rc0 via the gpaste_tokens function. |
CVE-2021-45256 | Medium | 5.5 | 2021-12-22 | A Null Pointer Dereference vulnerability existfs in nasm 2.16rc0 via asm/preproc.c. |
CVE-2021-44733 | High | 7.0 | 2021-12-22 | A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_g… |
CVE-2021-39013 | Medium | 6.5 | 2021-12-22 | IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP responses that could… |
CVE-2021-45418 | High | 8.8 | 2021-12-22 | Certain Starcharge products are vulnerable to Directory Traversal via main.cgi. The affected products include: Nova 360 Cabinet <=1.3.0.0.6 - Fixed: 1.3.0.0.9… |
CVE-2021-36750 | High | 8.1 | 2021-12-22 | ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across US… |
CVE-2021-40612 | Critical | 9.8 | 2021-12-22 | An issue was discovered in Opmantek Open-AudIT after 3.5.0. Without authentication, a vulnerability in code_igniter/application/controllers/util.php allows an… |
CVE-2021-40836 | Medium | 4.6 | 2021-12-22 | A vulnerability affecting F-Secure antivirus engine was discovered whereby scanning MS outlook .pst files can lead to denial-of-service. The vulnerability can… |
CVE-2021-45459 | Critical | 9.8 | 2021-12-22 | lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter. |
CVE-2021-44031 | Critical | 9.8 | 2021-12-22 | An issue was discovered in Quest KACE Desktop Authority before 11.2. /dacomponentui/profiles/profileitems/outlooksettings/Insertimage.aspx contains a vulnerabi… |
CVE-2021-44030 | Medium | 6.1 | 2021-12-22 | Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method of jQuery. |
CVE-2021-44029 | Critical | 9.8 | 2021-12-22 | An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute remote code through a deserialization explo… |
CVE-2021-44028 | Medium | 5.5 | 2021-12-22 | XXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file might be controlled by an attacker, a related issue to CVE-201… |
CVE-2021-43851 | High | 8.1 | 2021-12-22 | Anuko Time Tracker is an open source, web-based time tracking application written in PHP. SQL injection vulnerability exist in multiple files in Time Tracker v… |
CVE-2021-44927 | Medium | 5.5 | 2021-12-21 | A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_sg_vrml_mf_append function, which causes a segmentation fault and application crash. |
CVE-2021-44926 | Medium | 5.5 | 2021-12-21 | A null pointer dereference vulnerability exists in gpac 1.1.0-DEV in the gf_node_get_tag function, which causes a segmentation fault and application crash. |
CVE-2021-44925 | Medium | 5.5 | 2021-12-21 | A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_svg_get_attribute_name function, which causes a segmentation fault and application cras… |
CVE-2021-44924 | Medium | 5.5 | 2021-12-21 | An infinite loop vulnerability exists in gpac 1.1.0 in the gf_log function, which causes a Denial of Service. |
CVE-2021-44923 | Medium | 5.5 | 2021-12-21 | A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_dump_vrml_dyn_field.isra function, which causes a segmentation fault and application cr… |
CVE-2021-44922 | Medium | 5.5 | 2021-12-21 | A null pointer dereference vulnerability exists in gpac 1.1.0 in the BD_CheckSFTimeOffset function, which causes a segmentation fault and application crash. |
CVE-2021-44921 | Medium | 5.5 | 2021-12-21 | A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_isom_parse_movie_boxes_internal function, which causes a segmentation fault and applica… |
CVE-2021-44920 | Medium | 5.5 | 2021-12-21 | An invalid memory address dereference vulnerability exists in gpac 1.1.0 in the dump_od_to_saf.isra function, which causes a segmentation fault and application… |
CVE-2021-44919 | Medium | 5.5 | 2021-12-21 | A Null Pointer Dereference vulnerability exists in the gf_sg_vrml_mf_alloc function in gpac 1.1.0-DEV, which causes a segmentation fault and application crash. |
CVE-2021-44918 | Medium | 5.5 | 2021-12-21 | A Null Pointer Dereference vulnerability exists in gpac 1.1.0 in the gf_node_get_field function, which can cause a segmentation fault and application crash. |
CVE-2021-44917 | Medium | 5.5 | 2021-12-21 | A Divide by Zero vulnerability exists in gnuplot 5.4 in the boundary3d function in graph3d.c, which could cause a Arithmetic exception and application crash. |
CVE-2021-45297 | Medium | 5.5 | 2021-12-21 | An infinite loop vulnerability exists in Gpac 1.0.1 in gf_get_bit_size. |
CVE-2021-44860 | High | 7.8 | 2021-12-21 | An out-of-bounds read vulnerability exists when reading a TIF file using Open Design Alliance Drawings SDK before 2022.12. The specific issue exists after load… |
CVE-2021-44859 | High | 7.8 | 2021-12-21 | An out-of-bounds read vulnerability exists when reading a TGA file using Open Design Alliance Drawings SDK before 2022.12. The specific issue exists after load… |
CVE-2021-44423 | High | 7.8 | 2021-12-21 | An out-of-bounds read vulnerability exists when reading a BMP file using Open Design Alliance (ODA) Drawings Explorer before 2022.12. The specific issue exists… |