2021 CVEs (page 72)
Page 72 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-44525 | Critical | 9.8 | 2021-12-20 | Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which authentication is… |
CVE-2021-44676 | Critical | 9.8 | 2021-12-20 | Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements (e.g., access control details) and modify a few aspects of the appl… |
CVE-2021-44675 | Critical | 9.8 | 2021-12-20 | Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authentic… |
CVE-2021-44916 | Medium | 6.1 | 2021-12-20 | Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. If a bad value is passed to the routine via a U… |
CVE-2021-44790 | Critical | 9.8 | 2021-12-20 | A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is… |
CVE-2021-44224 | High | 8.2 | 2021-12-20 | A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward… |
CVE-2021-41561 | High | 7.5 | 2021-12-20 | Improper Input Validation vulnerability in Parquet-MR of Apache Parquet allows an attacker to DoS by malicious Parquet files. This issue affects Apache Parquet… |
CVE-2021-44858 | High | 7.5 | 2021-12-20 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=… |
CVE-2021-44554 | Medium | 5.3 | 2021-12-20 | Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI. By accessing the ve… |
CVE-2021-44263 | Medium | 5.4 | 2021-12-20 | Gurock TestRail before 7.2.4 mishandles HTML escaping. |
CVE-2021-42913 | High | 7.5 | 2021-12-20 | The SyncThru Web Service on Samsung SCX-6x55X printers allows an attacker to gain access to a list of SMB users and cleartext passwords by reading the HTML sou… |
CVE-2021-44732 | Critical | 9.8 | 2021-12-20 | Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure. |
CVE-2021-44164 | Critical | 9.8 | 2021-12-20 | Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker to by-pass file ty… |
CVE-2021-44163 | Medium | 6.1 | 2021-12-20 | Chain Sea ai chatbot backend has improper filtering of special characters in URL parameters, which allows a remote attacker to perform JavaScript injection for… |
CVE-2021-44162 | High | 7.5 | 2021-12-20 | Chain Sea ai chatbot system’s specific file download function has path traversal vulnerability. The function has improper filtering of special characters in UR… |
CVE-2021-44159 | Critical | 9.8 | 2021-12-20 | 4MOSAn GCB Doctor’s file upload function has improper user privilege control. A remote attacker can upload arbitrary files including webshell files without aut… |
CVE-2021-4136 | High | 7.8 | 2021-12-19 | vim is vulnerable to Heap-based Buffer Overflow |
CVE-2021-45041 | High | 8.8 | 2021-12-19 | SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project module, involving resource_id and start_d… |
CVE-2021-43083 | High | 8.8 | 2021-12-19 | Apache PLC4X - PLC4C (Only the C language implementation was effected) was vulnerable to an unsigned integer underflow flaw inside the tcp transport. Users sho… |
CVE-2021-45105 | Medium | 5.9 | 2021-12-18 | Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This a… |
CVE-2021-4131 | High | 8.8 | 2021-12-18 | livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-4130 | High | 8.8 | 2021-12-18 | snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-41500 | High | 7.5 | 2021-12-17 | Incomplete string comparison vulnerability exits in cvxopt.org cvxop <= 1.2.6 in APIs (cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxopt.cholmod.solve, cvx… |
CVE-2021-41499 | High | 7.5 | 2021-12-17 | Buffer Overflow Vulnerability exists in ajaxsoundstudio.com n Pyo < 1.03 in the Server_debug function, which allows remote attackers to conduct DoS attacks by… |
CVE-2021-41498 | High | 7.5 | 2021-12-17 | Buffer overflow in ajaxsoundstudio.com Pyo < and 1.03 in the Server_jack_init function. which allows attackers to conduct Denial of Service attacks by arbitr… |
CVE-2021-41497 | High | 7.5 | 2021-12-17 | Null pointer reference in CMS_Conservative_increment_obj in RaRe-Technologies bounter version 1.01 and 1.10, allows attackers to conduct Denial of Service atta… |
CVE-2021-41496 | Medium | 5.5 | 2021-12-17 | Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully… |
CVE-2021-41495 | Medium | 5.3 | 2021-12-17 | Null Pointer Dereference vulnerability exists in numpy.sort in NumPy < and 1.19 in the PyArray_DescrNew function due to missing return-value validation, whic… |
CVE-2021-23814 | Medium | 6.7 | 2021-12-17 | This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the file type when uploadi… |
CVE-2021-23803 | Critical | 9.8 | 2021-12-17 | This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template… |
CVE-2021-23797 | High | 7.5 | 2021-12-17 | All versions of package http-server-node are vulnerable to Directory Traversal via use of --path-as-is. |
CVE-2021-23450 | High | 7.5 | 2021-12-17 | All versions of package dojo are vulnerable to Prototype Pollution via the setObject function. |
CVE-2021-43840 | Medium | 4.4 | 2021-12-17 | message_bus is a messaging bus for Ruby processes and web clients. In versions prior to 3.3.7 users who deployed message bus with diagnostics features enabled… |
CVE-2021-43838 | Medium | 5.3 | 2021-12-17 | jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1 users are vulnerable to a regular expression… |
CVE-2021-34141 | Medium | 5.3 | 2021-12-17 | An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing speci… |
CVE-2021-33430 | Medium | 5.3 | 2021-12-17 | A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32)… |
CVE-2021-4011 | High | 7.8 | 2021-12-17 | A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SwapCreateRegister function. The hig… |
CVE-2021-4010 | High | 7.8 | 2021-12-17 | A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcScreenSaverSuspend function. Th… |
CVE-2021-4009 | High | 7.8 | 2021-12-17 | A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcXFixesCreatePointerBarrier func… |
CVE-2021-4008 | High | 7.8 | 2021-12-17 | A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcRenderCompositeGlyphs function… |
CVE-2021-40853 | High | 7.2 | 2021-12-17 | TCMAN GIM does not perform an authorization check when trying to access determined resources. A remote attacker could exploit this vulnerability to access URL… |
CVE-2021-40852 | Medium | 6.1 | 2021-12-17 | TCMAN GIM is affected by an open redirect vulnerability. This vulnerability allows the redirection of user navigation to pages controlled by the attacker. The… |
CVE-2021-40851 | High | 7.5 | 2021-12-17 | TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. The exploitation of this vulnerability mi… |
CVE-2021-40850 | Critical | 10.0 | 2021-12-17 | TCMAN GIM is vulnerable to a SQL injection vulnerability inside several available webservice methods in /PC/WebService.asmx. |
CVE-2021-38883 | Medium | 5.4 | 2021-12-17 | IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerabil… |
CVE-2021-37863 | Low | 3.5 | 2021-12-17 | Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of… |
CVE-2021-37862 | Low | 3.7 | 2021-12-17 | Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using at… |
CVE-2021-32499 | High | 7.5 | 2021-12-17 | SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the command line arguments to pass in any value to the Emulator executable. |
CVE-2021-32498 | High | 8.6 | 2021-12-17 | SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the pathname of the emulator and use path traversal to run an arbitrary executable located on… |
CVE-2021-32497 | High | 8.6 | 2021-12-17 | SICK SOPAS ET before version 4.8.0 allows attackers to wrap any executable file into an SDD and provide this to a SOPAS ET user. When a user starts the emulato… |
CVE-2021-22054 | High | 7.5 | 2021-12-17 | VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SS… |
CVE-2021-20608 | High | 7.5 | 2021-12-17 | Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior allows a remote unauthenticated at… |
CVE-2021-20607 | Medium | 5.5 | 2021-12-17 | Integer Underflow vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior, Mitsubishi Electric MELSOFT Navigator versions 2.84N and prior and… |
CVE-2021-20606 | Medium | 5.5 | 2021-12-17 | Out-of-bounds Read vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior, Mitsubishi Electric MELSOFT Navigator versions 2.84N and prior and… |
CVE-2021-0903 | Medium | 6.7 | 2021-12-17 | In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2021-0902 | Medium | 4.4 | 2021-12-17 | In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privi… |
CVE-2021-0901 | Medium | 6.7 | 2021-12-17 | In apusys, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2021-0900 | Medium | 4.4 | 2021-12-17 | In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privi… |
CVE-2021-0899 | Medium | 6.7 | 2021-12-17 | In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges nee… |
CVE-2021-0898 | Medium | 6.7 | 2021-12-17 | In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges nee… |
CVE-2021-0897 | Medium | 6.7 | 2021-12-17 | In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2021-0896 | Medium | 6.7 | 2021-12-17 | In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2021-0895 | Medium | 6.7 | 2021-12-17 | In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2021-0894 | Medium | 6.7 | 2021-12-17 | In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2021-0893 | Medium | 6.7 | 2021-12-17 | In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges nee… |
CVE-2021-0679 | Medium | 6.7 | 2021-12-17 | In apusys, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2021-0678 | Medium | 6.7 | 2021-12-17 | In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2021-0677 | Medium | 4.4 | 2021-12-17 | In ccu driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privile… |
CVE-2021-0676 | Medium | 4.4 | 2021-12-17 | In geniezone driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execu… |
CVE-2021-0674 | Medium | 5.5 | 2021-12-17 | In alac decoder, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional ex… |
CVE-2021-0673 | High | 7.8 | 2021-12-17 | In Audio Aurisys HAL, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additio… |
CVE-2021-44035 | Medium | 4.4 | 2021-12-17 | Wolters Kluwer TeamMate AM 12.4 Update 1 mishandles attachment uploads, such that an authenticated user may download and execute malicious files. |
CVE-2021-41451 | High | 7.5 | 2021-12-17 | A misconfiguration in HTTP/1.0 and HTTP/1.1 of the web interface in TP-Link AX10v1 before V1_211117 allows a remote unauthenticated attacker to send a speciall… |
CVE-2021-45042 | Medium | 4.9 | 2021-12-17 | In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an auth… |
CVE-2021-42584 | Medium | 5.4 | 2021-12-17 | A Stored Cross Site Scripting (XSS) issue exists in Convos-Chat before 6.32. |
CVE-2021-4132 | Medium | 5.4 | 2021-12-17 | livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-43678 | Medium | 6.1 | 2021-12-17 | Wechat-php-sdk v1.10.2 is affected by a Cross Site Scripting (XSS) vulnerability in Wechat.php. |
CVE-2021-44145 | Medium | 6.5 | 2021-12-17 | In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity c… |
CVE-2021-36780 | High | 8.1 | 2021-12-17 | A Missing Authentication for Critical Function vulnerability in longhorn of SUSE Longhorn allows attackers to connect to a longhorn-engine replica instance gra… |
CVE-2021-36779 | Critical | 9.6 | 2021-12-17 | A Missing Authentication for Critical Function vulnerability in SUSE Longhorn allows any workload in the cluster to execute any binary present in the image on… |
CVE-2021-45038 | Medium | 5.3 | 2021-12-17 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. By using an action=rollback query, attackers can view priva… |
CVE-2021-44857 | Medium | 6.5 | 2021-12-17 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcr… |
CVE-2021-41843 | Medium | 6.5 | 2021-12-17 | An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the dat… |
CVE-2021-3179 | Medium | 5.5 | 2021-12-16 | GGLocker iOS application, contains an insecure data storage of the password hash value which results in an authentication bypass. |
CVE-2021-26800 | Medium | 6.5 | 2021-12-16 | Cross Site Request Forgery (CSRF) vulnerability in Change-password.php in phpgurukul user management system in php using stored procedure V1.0, allows attacker… |
CVE-2021-44317 | Medium | 5.4 | 2021-12-16 | In Bus Pass Management System v1.0, parameters 'pagedes' and `About Us` are affected with a Stored Cross-site scripting vulnerability. |
CVE-2021-44315 | High | 7.5 | 2021-12-16 | In Bus Pass Management System v1.0, Directory Listing/Browsing is enabled on the web server which allows an attacker to view the sensitive files of the applica… |
CVE-2021-43837 | High | 8.4 | 2021-12-16 | vault-cli is a configurable command-line interface tool (and python library) to interact with Hashicorp Vault. In versions before 3.0.0 vault-cli features the… |
CVE-2021-43812 | Medium | 6.4 | 2021-12-16 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo param… |
CVE-2021-42550 | Medium | 6.6 | 2021-12-16 | In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowi… |
CVE-2021-41262 | High | 8.8 | 2021-12-16 | Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to SQL inje… |
CVE-2021-41261 | High | 8.1 | 2021-12-16 | Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to stored c… |
CVE-2021-41028 | High | 8.2 | 2021-12-16 | A combination of a use of hard-coded cryptographic key vulnerability [CWE-321] in FortiClientEMS 7.0.1 and below, 6.4.6 and below and an improper certificate v… |
CVE-2021-38244 | High | 7.5 | 2021-12-16 | A regular expression denial of service (ReDoS) vulnerability exits in cbioportal 3.6.21 and older via a POST request to /ProteinArraySignificanceTest.json. |
CVE-2021-37262 | High | 7.5 | 2021-12-16 | JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service. |
CVE-2021-41962 | Medium | 4.8 | 2021-12-16 | Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the Owner fullname parameter in a Send Service Requ… |
CVE-2021-41260 | High | 8.2 | 2021-12-16 | Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do not check for Cross… |
CVE-2021-42912 | High | 8.8 | 2021-12-16 | FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send com… |
CVE-2021-3960 | High | 7.1 | 2021-12-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an… |
CVE-2021-3959 | Medium | 6.8 | 2021-12-16 | A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy request… |