2021 CVEs (page 71)
Page 71 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-44422 | High | 7.8 | 2021-12-21 | An Improper Input Validation Vulnerability exists when reading a BMP file using Open Design Alliance Drawings SDK before 2022.12. Crafted data in a BMP file ca… |
CVE-2021-38966 | Medium | 5.4 | 2021-12-21 | IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu… |
CVE-2021-38900 | Medium | 6.5 | 2021-12-21 | IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitiv… |
CVE-2021-38893 | Medium | 5.4 | 2021-12-21 | IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vul… |
CVE-2021-45293 | Medium | 5.5 | 2021-12-21 | A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet. |
CVE-2021-45292 | Medium | 5.5 | 2021-12-21 | The gf_isom_hint_rtp_read function in GPAC 1.0.1 allows attackers to cause a denial of service (Invalid memory address dereference) via a crafted file in the M… |
CVE-2021-45291 | Medium | 5.5 | 2021-12-21 | The gf_dump_setup function in GPAC 1.0.1 allows malicoius users to cause a denial of service (Invalid memory address dereference) via a crafted file in the MP4… |
CVE-2021-45290 | High | 7.5 | 2021-12-21 | A Denial of Service vulnerability exits in Binaryen 103 due to an assertion abort in wasm::handle_unreachable. |
CVE-2021-45289 | Medium | 5.5 | 2021-12-21 | A vulnerability exists in GPAC 1.0.1 due to an omission of security-relevant Information, which could cause a Denial of Service. The program terminates with si… |
CVE-2021-44207 | High | 8.1 | 2021-12-21 | Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials. |
CVE-2021-27453 | High | 7.3 | 2021-12-21 | Mesa Labs AmegaView Versions 3.0 uses default cookies that could be set to bypass authentication to the web application, which may allow an attacker to gain ac… |
CVE-2021-27451 | High | 7.3 | 2021-12-21 | Mesa Labs AmegaView Versions 3.0 and prior’s passcode is generated by an easily reversible algorithm, which may allow an attacker to gain access to the device. |
CVE-2021-27449 | Critical | 9.9 | 2021-12-21 | Mesa Labs AmegaView Versions 3.0 and prior has a command injection vulnerability that can be exploited to execute commands in the web server. |
CVE-2021-27447 | Critical | 10.0 | 2021-12-21 | Mesa Labs AmegaView version 3.0 is vulnerable to a command injection, which may allow an attacker to remotely execute arbitrary code. |
CVE-2021-27445 | High | 7.8 | 2021-12-21 | Mesa Labs AmegaView Versions 3.0 and prior has insecure file permissions that could be exploited to escalate privileges on the device. |
CVE-2021-45288 | Medium | 5.5 | 2021-12-21 | A Double Free vulnerability exists in filedump.c in GPAC 1.0.1, which could cause a Denail of Service via a crafted file in the MP4Box command. |
CVE-2021-44877 | High | 7.5 | 2021-12-21 | Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Incorrect Access Control. The Systeam application is an ERP system that uses a mixed architecture ba… |
CVE-2021-44876 | Medium | 5.3 | 2021-12-21 | Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration. The Systeam application is an ERP system that uses a mixed architecture based on S… |
CVE-2021-44875 | Medium | 5.3 | 2021-12-21 | Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration. The Systeam application is an ERP system that uses a mixed architecture based on S… |
CVE-2021-44874 | High | 8.8 | 2021-12-21 | Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Insecure design on report build via SQL query. The Systeam application is an ERP system that uses a… |
CVE-2021-43839 | High | 7.5 | 2021-12-21 | Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK'… |
CVE-2021-43587 | High | 8.2 | 2021-12-21 | Dell PowerPath Management Appliance, versions 3.2, 3.1, 3.0 P01, 3.0, and 2.6, use hard-coded cryptographic key. A local high-privileged malicious user may pot… |
CVE-2021-36350 | Medium | 5.9 | 2021-12-21 | Dell PowerScale OneFS, versions 8.2.2-9.3.0.x, contain an authentication bypass by primary weakness in one of the authentication factors. A remote unauthentica… |
CVE-2021-36341 | Medium | 5.5 | 2021-12-21 | Dell Wyse Device Agent version 14.5.4.1 and below contain a sensitive data exposure vulnerability. A local authenticated user with low privileges could potenti… |
CVE-2021-36337 | Medium | 6.5 | 2021-12-21 | Dell Wyse Management Suite version 3.3.1 and prior support insecure Transport Security Protocols TLS 1.0 and TLS 1.1 which are susceptible to Man-In-The-Middle… |
CVE-2021-36336 | Critical | 9.8 | 2021-12-21 | Wyse Management Suite 3.3.1 and below versions contain a deserialization vulnerability that could allow an unauthenticated attacker to execute code on the affe… |
CVE-2021-36318 | Medium | 6.7 | 2021-12-21 | Dell EMC Avamar versions 18.2,19.1,19.2,19.3,19.4 contain a plain-text password storage vulnerability. A high privileged user could potentially exploit this vu… |
CVE-2021-36317 | Medium | 6.7 | 2021-12-21 | Dell EMC Avamar Server version 19.4 contains a plain-text password storage vulnerability in AvInstaller. A local attacker could potentially exploit this vulner… |
CVE-2021-36316 | Medium | 6.7 | 2021-12-21 | Dell EMC Avamar Server versions 18.2, 19.1, 19.2, 19.3, and 19.4 contain an improper privilege management vulnerability in AUI. A malicious user with high priv… |
CVE-2021-45091 | Medium | 4.3 | 2021-12-21 | Stormshield Endpoint Security from 2.1.0 to 2.1.1 has Incorrect Access Control. |
CVE-2021-45090 | Critical | 9.8 | 2021-12-21 | Stormshield Endpoint Security before 2.1.2 allows remote code execution. |
CVE-2021-45089 | Medium | 5.2 | 2021-12-21 | Stormshield Endpoint Security 2.x before 2.1.2 has Incorrect Access Control. |
CVE-2021-4139 | Critical | 9.0 | 2021-12-21 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-45255 | Critical | 9.8 | 2021-12-21 | The email parameter from ajax.php of Video Sharing Website 1.0 appears to be vulnerable to SQL injection attacks. A payload injects a SQL sub-query that calls… |
CVE-2021-45253 | Critical | 9.8 | 2021-12-21 | The id parameter in view_storage.php from Simple Cold Storage Management System 1.0 appears to be vulnerable to SQL injection attacks. A payload injects a SQL… |
CVE-2021-45252 | Critical | 9.8 | 2021-12-21 | Multiple SQL injection vulnerabilities are found on Simple Forum-Discussion System 1.0 For example on three applications which are manage_topic.php, manage_use… |
CVE-2021-24981 | High | 7.5 | 2021-12-21 | The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in th… |
CVE-2021-24956 | Medium | 6.1 | 2021-12-21 | The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter before outputting it… |
CVE-2021-24941 | Medium | 6.1 | 2021-12-21 | The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.0.5 does not sanitise and escape the message_id parameter of the get_messa… |
CVE-2021-24907 | Medium | 6.1 | 2021-12-21 | The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute… |
CVE-2021-24849 | Critical | 9.8 | 2021-12-21 | The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not prop… |
CVE-2021-24846 | High | 8.8 | 2021-12-21 | The get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, available to all authe… |
CVE-2021-24750 | High | 8.8 | 2021-12-21 | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, avail… |
CVE-2021-24739 | High | 8.1 | 2021-12-21 | The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other user… |
CVE-2021-24738 | Medium | 5.4 | 2021-12-21 | The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the "Logo Margin" carousel option, which could allow users with a role as low as C… |
CVE-2021-24578 | Medium | 6.1 | 2021-12-21 | The SportsPress WordPress plugin before 2.7.9 does not sanitise and escape its match_day parameter before outputting back in the Events backend page, leading t… |
CVE-2021-45451 | High | 7.5 | 2021-12-21 | In Mbed TLS before 3.1.0, psa_aead_generate_nonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to a… |
CVE-2021-45450 | High | 7.5 | 2021-12-21 | In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt allow policy bypass or oracle-based decryption when the output bu… |
CVE-2021-43842 | Medium | 5.4 | 2021-12-20 | Wiki.js is a wiki app built on Node.js. Wiki.js versions 2.5.257 and earlier are vulnerable to stored cross-site scripting through a SVG file upload. By creati… |
CVE-2021-43847 | Medium | 6.5 | 2021-12-20 | HumHub is an open-source social network kit written in PHP. Prior to HumHub version 1.10.3 or 1.9.3, it could be possible for registered users to become unauth… |
CVE-2021-43846 | Medium | 5.3 | 2021-12-20 | `solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and 2.11.14 contain a c… |
CVE-2021-43844 | High | 8.8 | 2021-12-20 | MSEdgeRedirect is a tool to redirect news, search, widgets, weather, and more to a user's default browser. MSEdgeRedirect versions before 0.5.0.1 are vulnerabl… |
CVE-2021-43843 | Medium | 5.3 | 2021-12-20 | jsx-slack is a package for building JSON objects for Slack block kit surfaces from JSX. The maintainers found the patch for CVE-2021-43838 in jsx-slack v4.5.1… |
CVE-2021-3860 | High | 8.8 | 2021-12-20 | JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete v… |
CVE-2021-44699 | Low | 3.3 | 2021-12-20 | Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitiv… |
CVE-2021-44698 | Low | 3.3 | 2021-12-20 | Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitiv… |
CVE-2021-44697 | Low | 3.3 | 2021-12-20 | Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitiv… |
CVE-2021-44183 | Low | 3.3 | 2021-12-20 | Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2021-44182 | Low | 3.3 | 2021-12-20 | Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2021-44181 | High | 7.8 | 2021-12-20 | Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context… |
CVE-2021-44180 | High | 7.8 | 2021-12-20 | Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context… |
CVE-2021-44179 | High | 7.8 | 2021-12-20 | Adobe Dimension versions 3.4.3 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious GIF file, potentially res… |
CVE-2021-43763 | Low | 3.3 | 2021-12-20 | Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2021-43750 | Medium | 5.5 | 2021-12-20 | Adobe Premiere Rush versions 1.5.16 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vul… |
CVE-2021-43749 | Medium | 5.5 | 2021-12-20 | Adobe Premiere Rush versions 1.5.16 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vul… |
CVE-2021-43748 | Medium | 5.5 | 2021-12-20 | Adobe Premiere Rush versions 1.5.16 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vul… |
CVE-2021-43747 | High | 7.8 | 2021-12-20 | Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially… |
CVE-2021-43746 | Medium | 5.5 | 2021-12-20 | Adobe Premiere Rush versions 1.5.16 (and earlier) allows access to an uninitialized pointer vulnerability that allows remote attackers to disclose sensitive in… |
CVE-2021-43030 | Low | 3.3 | 2021-12-20 | Adobe Premiere Rush versions 1.5.16 (and earlier) allows access to an uninitialized pointer vulnerability that allows remote attackers to disclose arbitrary da… |
CVE-2021-43029 | High | 7.8 | 2021-12-20 | Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially… |
CVE-2021-43028 | High | 7.8 | 2021-12-20 | Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially… |
CVE-2021-43026 | High | 7.8 | 2021-12-20 | Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious MXF file, potentially… |
CVE-2021-43025 | High | 7.8 | 2021-12-20 | Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious SVG file, potentially… |
CVE-2021-43024 | High | 7.8 | 2021-12-20 | Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially… |
CVE-2021-43023 | High | 7.8 | 2021-12-20 | Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious EPS/TIFF file, potent… |
CVE-2021-43022 | High | 7.8 | 2021-12-20 | Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious PNG file, potentially… |
CVE-2021-43021 | High | 7.8 | 2021-12-20 | Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious EXR file, potentially… |
CVE-2021-42809 | Medium | 6.5 | 2021-12-20 | Improper Access Control of Dynamically-Managed Code Resources (DLL) in Thales Sentinel Protection Installer could allow the execution of arbitrary code. |
CVE-2021-42808 | Medium | 6.5 | 2021-12-20 | Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges. |
CVE-2021-42138 | High | 7.2 | 2021-12-20 | A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all the users on that… |
CVE-2021-40784 | High | 7.8 | 2021-12-20 | Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially… |
CVE-2021-40783 | High | 7.8 | 2021-12-20 | Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially… |
CVE-2021-38421 | High | 7.8 | 2021-12-20 | Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds read, which may allow an attacker to read sensitiv… |
CVE-2021-38419 | High | 7.8 | 2021-12-20 | Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds write, which can result in data corruption, a syst… |
CVE-2021-38415 | High | 7.8 | 2021-12-20 | Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable a heap-based buffer overflow when parsing a specially crafted project… |
CVE-2021-38413 | High | 7.8 | 2021-12-20 | Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to a stack-based buffer overflow, which may allow an attacker to achie… |
CVE-2021-38409 | High | 7.8 | 2021-12-20 | Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an access of uninitialized pointer, which may allow an attacker rea… |
CVE-2021-38401 | High | 7.8 | 2021-12-20 | Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an untrusted pointer dereference, which may allow an attacker to ex… |
CVE-2021-36889 | Low | 3.4 | 2021-12-20 | Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (ver… |
CVE-2021-36887 | Medium | 6.1 | 2021-12-20 | Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plu… |
CVE-2021-35248 | Medium | 6.8 | 2021-12-20 | It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings. |
CVE-2021-35244 | Medium | 6.8 | 2021-12-20 | The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker… |
CVE-2021-35234 | High | 8.0 | 2021-12-20 | Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation. An attacker with low-user privi… |
CVE-2021-22057 | High | 8.8 | 2021-12-20 | VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 contain an authentication bypass vulnerability. A malicious actor, who has successfully provided first-… |
CVE-2021-22056 | High | 7.5 | 2021-12-20 | VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vulnerability. A malicious actor with netw… |
CVE-2021-43441 | Medium | 5.3 | 2021-12-20 | An HTML Injection Vulnerability in iOrder 1.0 allows the remote attacker to execute Malicious HTML codes via the signup form |
CVE-2021-43440 | Medium | 6.1 | 2021-12-20 | Multiple Stored XSS Vulnerabilities in the Source Code of iOrder 1.0 allow remote attackers to execute arbitrary code via signup form in the Name and Phone num… |
CVE-2021-43439 | Critical | 9.8 | 2021-12-20 | RCE in Add Review Function in iResturant 1.0 Allows remote attacker to execute commands remotely |
CVE-2021-43438 | Medium | 5.4 | 2021-12-20 | Stored XSS in Signup Form in iResturant 1.0 Allows Remote Attacker to Inject Arbitrary code via NAME and ADDRESS field |
CVE-2021-43437 | High | 8.8 | 2021-12-20 | In sourcecodetester Engineers Online Portal as of 10-21-21, an attacker can manipulate the Host header as seen by the web application and cause the application… |