2021 CVEs (page 75)
Page 75 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-43245 | High | 7.8 | 2021-12-15 | Windows Digital TV Tuner Elevation of Privilege Vulnerability |
CVE-2021-43244 | Medium | 6.5 | 2021-12-15 | Windows Kernel Information Disclosure Vulnerability |
CVE-2021-43243 | Medium | 5.5 | 2021-12-15 | VP9 Video Extensions Information Disclosure Vulnerability |
CVE-2021-43242 | High | 7.6 | 2021-12-15 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2021-43240 | High | 7.8 | 2021-12-15 | NTFS Set Short Name Elevation of Privilege Vulnerability |
CVE-2021-43239 | High | 7.1 | 2021-12-15 | Windows Recovery Environment Agent Elevation of Privilege Vulnerability |
CVE-2021-43238 | High | 7.8 | 2021-12-15 | Windows Remote Access Elevation of Privilege Vulnerability |
CVE-2021-43237 | High | 7.8 | 2021-12-15 | Windows Setup Elevation of Privilege Vulnerability |
CVE-2021-43236 | High | 7.5 | 2021-12-15 | Microsoft Message Queuing Information Disclosure Vulnerability |
CVE-2021-43235 | Medium | 5.5 | 2021-12-15 | Storage Spaces Controller Information Disclosure Vulnerability |
CVE-2021-43234 | High | 7.8 | 2021-12-15 | Windows Fax Service Remote Code Execution Vulnerability |
CVE-2021-43233 | High | 7.5 | 2021-12-15 | Remote Desktop Client Remote Code Execution Vulnerability |
CVE-2021-43232 | High | 7.8 | 2021-12-15 | Windows Event Tracing Remote Code Execution Vulnerability |
CVE-2021-43231 | High | 7.8 | 2021-12-15 | Windows NTFS Elevation of Privilege Vulnerability |
CVE-2021-43230 | High | 7.8 | 2021-12-15 | Windows NTFS Elevation of Privilege Vulnerability |
CVE-2021-43229 | High | 7.8 | 2021-12-15 | Windows NTFS Elevation of Privilege Vulnerability |
CVE-2021-43228 | High | 7.5 | 2021-12-15 | SymCrypt Denial of Service Vulnerability |
CVE-2021-43227 | Medium | 5.5 | 2021-12-15 | Storage Spaces Controller Information Disclosure Vulnerability |
CVE-2021-43226 | High | 7.8 | 2021-12-15 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2021-43225 | High | 7.5 | 2021-12-15 | Bot Framework SDK Remote Code Execution Vulnerability |
CVE-2021-43224 | Medium | 5.5 | 2021-12-15 | Windows Common Log File System Driver Information Disclosure Vulnerability |
CVE-2021-43223 | High | 7.8 | 2021-12-15 | Windows Remote Access Connection Manager Elevation of Privilege Vulnerability |
CVE-2021-43222 | High | 7.5 | 2021-12-15 | Microsoft Message Queuing Information Disclosure Vulnerability |
CVE-2021-43219 | High | 7.4 | 2021-12-15 | DirectX Graphics Kernel File Denial of Service Vulnerability |
CVE-2021-43217 | High | 8.1 | 2021-12-15 | Windows Encrypting File System (EFS) Remote Code Execution Vulnerability |
CVE-2021-43216 | Medium | 6.5 | 2021-12-15 | Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability |
CVE-2021-43215 | Critical | 9.8 | 2021-12-15 | iSNS Server Memory Corruption Vulnerability Can Lead to Remote Code Execution |
CVE-2021-43214 | High | 7.8 | 2021-12-15 | Web Media Extensions Remote Code Execution Vulnerability |
CVE-2021-43207 | High | 7.8 | 2021-12-15 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2021-42320 | High | 8.0 | 2021-12-15 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2021-42315 | High | 8.8 | 2021-12-15 | Microsoft Defender for IoT Remote Code Execution Vulnerability |
CVE-2021-42314 | High | 8.8 | 2021-12-15 | Microsoft Defender for IoT Remote Code Execution Vulnerability |
CVE-2021-42313 | Critical | 10.0 | 2021-12-15 | Microsoft Defender for IoT Remote Code Execution Vulnerability |
CVE-2021-42312 | High | 7.8 | 2021-12-15 | Microsoft Defender for IoT Elevation of Privilege Vulnerability |
CVE-2021-42311 | Critical | 10.0 | 2021-12-15 | Microsoft Defender for IoT Remote Code Execution Vulnerability |
CVE-2021-42310 | High | 8.1 | 2021-12-15 | Microsoft Defender for IoT Remote Code Execution Vulnerability |
CVE-2021-42309 | High | 8.8 | 2021-12-15 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2021-42295 | Medium | 5.5 | 2021-12-15 | Visual Basic for Applications Information Disclosure Vulnerability |
CVE-2021-42294 | High | 7.2 | 2021-12-15 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2021-42293 | Medium | 6.5 | 2021-12-15 | Microsoft Jet Red Database Engine and Access Connectivity Engine Elevation of Privilege Vulnerability |
CVE-2021-41365 | High | 8.8 | 2021-12-15 | Microsoft Defender for IoT Remote Code Execution Vulnerability |
CVE-2021-41360 | High | 7.8 | 2021-12-15 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2021-41333 | High | 7.8 | 2021-12-15 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2021-40453 | High | 7.8 | 2021-12-15 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2021-40452 | High | 7.8 | 2021-12-15 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2021-40441 | High | 7.8 | 2021-12-15 | Windows Media Center Elevation of Privilege Vulnerability |
CVE-2021-4116 | Medium | 5.4 | 2021-12-15 | yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-20330 | Medium | 6.5 | 2021-12-15 | An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potentia… |
CVE-2021-4111 | Medium | 4.3 | 2021-12-15 | yetiforcecrm is vulnerable to Business Logic Errors |
CVE-2021-45043 | High | 7.5 | 2021-12-15 | HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter. |
CVE-2021-43326 | High | 7.8 | 2021-12-15 | Automox Agent before 32 on Windows incorrectly sets permissions on a temporary directory. |
CVE-2021-43325 | High | 7.8 | 2021-12-15 | Automox Agent 33 on Windows incorrectly sets permissions on a temporary directory. NOTE: this issue exists because of a CVE-2021-43326 regression. |
CVE-2021-43113 | Critical | 9.8 | 2021-12-15 | iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) co… |
CVE-2021-42945 | Critical | 9.8 | 2021-12-15 | A SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask.php. |
CVE-2021-42220 | Medium | 5.4 | 2021-12-15 | A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payloa… |
CVE-2021-41560 | Critical | 9.8 | 2021-12-15 | OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php. |
CVE-2021-41557 | Medium | 5.4 | 2021-12-15 | Sofico Miles RIA 2020.2 Build 127964T is affected by Stored Cross Site Scripting (XSS). An attacker with access to a user account of the RIA IT or the Fleet ro… |
CVE-2021-40827 | High | 7.8 | 2021-12-15 | Clementine Music Player through 1.3.1 (when a GLib 2.0.0 DLL is used) is vulnerable to a Read Access Violation on Block Data Move, affecting the MP3 file parsi… |
CVE-2021-40826 | High | 7.8 | 2021-12-15 | Clementine Music Player through 1.3.1 is vulnerable to a User Mode Write Access Violation, affecting the MP3 file parsing functionality at clementine+0x3aa207… |
CVE-2021-40171 | Medium | 5.3 | 2021-12-15 | The absence of notifications regarding an ongoing RF jamming attack in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-ITR-F1-BD_BL.A30.2018… |
CVE-2021-40170 | Medium | 6.8 | 2021-12-15 | An RF replay attack vulnerability in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-ITR-F1-BD_BL.A30.20181117, allows an attacker to trigge… |
CVE-2021-38701 | Medium | 4.8 | 2021-12-15 | Certain Motorola Solutions Avigilon devices allow XSS in the administrative UI. This affects T200/201 before 4.10.0.68; T290 before 4.4.0.80; T008 before 2.2.0… |
CVE-2021-36450 | Medium | 6.1 | 2021-12-15 | Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter. |
CVE-2021-26787 | Medium | 6.1 | 2021-12-15 | A cross site scripting (XSS) vulnerability in Genesys Workforce Management 8.5.214.20 can occur (during record deletion) via the Time-off parameter. |
CVE-2021-41871 | Medium | 5.4 | 2021-12-15 | An issue was discovered in Socomec REMOTE VIEW PRO 2.0.41.4. Improper validation of input into the username field makes it possible to place a stored XSS paylo… |
CVE-2021-41870 | High | 8.8 | 2021-12-15 | An issue was discovered in the firmware update form in Socomec REMOTE VIEW PRO 2.0.41.4. An authenticated attacker can bypass a client-side file-type check and… |
CVE-2021-41844 | Critical | 9.8 | 2021-12-15 | Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data. |
CVE-2021-4110 | High | 7.5 | 2021-12-15 | mruby is vulnerable to NULL Pointer Dereference |
CVE-2021-43827 | Medium | 4.3 | 2021-12-14 | discourse-footnote is a library providing footnotes for posts in Discourse. ### Impact When posting an inline footnote wrapped in `<a>` tags (e.g. `<a>^[footno… |
CVE-2021-44942 | Medium | 4.3 | 2021-12-14 | glFusion CMS 1.7.9 is affected by a Cross Site Request Forgery (CSRF) vulnerability in /public_html/admin/plugins/bad_behavior2/blacklist.php. Using the CSRF v… |
CVE-2021-4108 | Medium | 6.1 | 2021-12-14 | snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-43830 | High | 7.4 | 2021-12-14 | OpenProject is a web-based project management software. OpenProject versions >= 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticat… |
CVE-2021-43829 | High | 7.4 | 2021-12-14 | PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.7.7 PatrowlManager unrestrictly handle upload files in… |
CVE-2021-43828 | High | 7.5 | 2021-12-14 | PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.77 an improper privilege management (IDOR) has been fo… |
CVE-2021-43821 | Critical | 9.9 | 2021-12-14 | Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6 allows references to local file URLs in inges… |
CVE-2021-43051 | High | 7.1 | 2021-12-14 | The Spotfire Server component of TIBCO Software Inc.'s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit… |
CVE-2021-39183 | High | 8.2 | 2021-12-14 | Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a p… |
CVE-2021-34426 | Medium | 5.3 | 2021-12-14 | A vulnerability was discovered in the Keybase Client for Windows before version 5.6.0 when a user executed the "keybase git lfs-config" command on the command-… |
CVE-2021-34425 | Medium | 4.7 | 2021-12-14 | The Zoom Client for Meetings before version 5.7.3 (for Android, iOS, Linux, macOS, and Windows) contain a server side request forgery vulnerability in the chat… |
CVE-2021-4044 | High | 7.5 | 2021-12-14 | Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative retu… |
CVE-2021-45046 | Critical | 9.0 | 2021-12-14 | It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers wi… |
CVE-2021-43820 | High | 7.4 | 2021-12-14 | Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performan… |
CVE-2021-40883 | Critical | 9.8 | 2021-12-14 | A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins. |
CVE-2021-44043 | Medium | 5.4 | 2021-12-14 | An issue was discovered in UiPath App Studio 21.4.4. There is a persistent XSS vulnerability in the file-upload functionality for uploading icons when attempti… |
CVE-2021-44042 | Critical | 9.8 | 2021-12-14 | An issue was discovered in UiPath Assistant 21.4.4. User-controlled data supplied to the --process-start argument of the URI handler for uipath-assistant:// is… |
CVE-2021-44041 | Critical | 9.8 | 2021-12-14 | UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-a… |
CVE-2021-43807 | High | 7.5 | 2021-12-14 | Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast versions prior to 9.10 allow HTTP method spoofing, allowing to change the… |
CVE-2021-43388 | High | 7.5 | 2021-12-14 | Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup. The issue is addressed by ens… |
CVE-2021-40882 | Medium | 6.1 | 2021-12-14 | A Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and description of the location. |
CVE-2021-38950 | High | 7.8 | 2021-12-14 | IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when SharedBindingsUserId is set to effective. IBM X-ForceID: 211404. |
CVE-2021-4073 | Critical | 9.8 | 2021-12-14 | The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid us… |
CVE-2021-44549 | High | 7.4 | 2021-12-14 | Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the… |
CVE-2021-44235 | Medium | 6.7 | 2021-12-14 | Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker… |
CVE-2021-44233 | High | 8.8 | 2021-12-14 | SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated user, which could lead… |
CVE-2021-44232 | High | 7.7 | 2021-12-14 | SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server d… |
CVE-2021-44231 | Critical | 9.8 | 2021-12-14 | Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavio… |
CVE-2021-42367 | Medium | 6.4 | 2021-12-14 | The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the ~/includes/class-menu-… |
CVE-2021-42070 | Low | 3.3 | 2021-12-14 | When a user opens manipulated Jupiter Tessellation (.jt) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application… |
CVE-2021-42069 | Low | 3.3 | 2021-12-14 | When a user opens manipulated Tagged Image File Format (.tif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applic… |
CVE-2021-42068 | Low | 3.3 | 2021-12-14 | When a user opens a manipulated GIF (.gif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and b… |