2021 CVEs (page 76)
Page 76 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-42066 | Medium | 4.4 | 2021-12-14 | SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypted. For an attacker… |
CVE-2021-42064 | Critical | 9.8 | 2021-12-14 | If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions… |
CVE-2021-42063 | Medium | 6.1 | 2021-12-14 | A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web b… |
CVE-2021-42061 | Medium | 5.4 | 2021-12-14 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Si… |
CVE-2021-41836 | Medium | 4.8 | 2021-12-14 | The Fathom Analytics WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the $site_id parameter… |
CVE-2021-41067 | High | 7.5 | 2021-12-14 | An issue was discovered in Listary through 6. Improper implementation of the update process leads to the download of software updates with a /check-update HTTP… |
CVE-2021-41066 | High | 7.5 | 2021-12-14 | An issue was discovered in Listary through 6. When Listary is configured as admin, Listary will not ask for permissions again if a user tries to access files o… |
CVE-2021-41065 | High | 7.3 | 2021-12-14 | An issue was discovered in Listary through 6. An attacker can create a \\.\pipe\Listary.listaryService named pipe and wait for a privileged user to open a sess… |
CVE-2021-3836 | Medium | 5.5 | 2021-12-14 | dbeaver is vulnerable to Improper Restriction of XML External Entity Reference |
CVE-2021-39319 | Medium | 6.1 | 2021-12-14 | The duoFAQ - Responsive, Flat, Simple FAQ WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/duogeek/duogeek-… |
CVE-2021-39318 | Medium | 6.1 | 2021-12-14 | The H5P CSS Editor WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the h5p-css-file parameter found in the ~/h5p-css-editor.php file which… |
CVE-2021-39315 | Medium | 6.1 | 2021-12-14 | The Magic Post Voice WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the ids parameter found in the ~/inc/admin/main.php file which allows… |
CVE-2021-39314 | Medium | 6.1 | 2021-12-14 | The WooCommerce EnvioPack WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter found in the ~/includes/functions.php file… |
CVE-2021-39313 | Medium | 6.1 | 2021-12-14 | The Simple Image Gallery WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/simple-image-gallery.php file wh… |
CVE-2021-39312 | High | 7.5 | 2021-12-14 | The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src… |
CVE-2021-39311 | Medium | 6.1 | 2021-12-14 | The link-list-manager WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category parameter found in the ~/llm.php file which allows atta… |
CVE-2021-39310 | Medium | 6.1 | 2021-12-14 | The Real WYSIWYG WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of PHP_SELF in the ~/real-wysiwyg.php file which allows attack… |
CVE-2021-39309 | Medium | 6.1 | 2021-12-14 | The Parsian Bank Gateway for Woocommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via and parameter due to a var_dump() on $_POST varia… |
CVE-2021-39308 | Medium | 6.1 | 2021-12-14 | The WooCommerce myghpay Payment Gateway WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the clientref parameter found in the ~/processrespo… |
CVE-2021-38361 | Medium | 6.1 | 2021-12-14 | The .htaccess Redirect WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the link parameter found in the ~/htaccess-redirect.php file which… |
CVE-2021-38182 | High | 8.8 | 2021-12-14 | Due to insufficient input validation of Kyma, authenticated users can pass a Header of their choice and escalate privileges which can completely compromise the… |
CVE-2021-4107 | Medium | 6.1 | 2021-12-14 | yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-4007 | High | 7.8 | 2021-12-14 | Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight A… |
CVE-2021-44949 | Critical | 9.8 | 2021-12-14 | glFusion CMS 1.7.9 is affected by an access control vulnerability via /public_html/users.php. |
CVE-2021-42051 | Medium | 5.4 | 2021-12-14 | An issue was discovered in AbanteCart before 1.3.2. Any low-privileged user with file-upload permissions can upload a malicious SVG document that contains an X… |
CVE-2021-42050 | Medium | 6.1 | 2021-12-14 | An issue was discovered in AbanteCart before 1.3.2. It allows DOM Based XSS. |
CVE-2021-45015 | Critical | 9.1 | 2021-12-14 | taocms 3.0.2 is vulnerable to arbitrary file deletion via taocms\include\Model\file.php from line 60 to line 72. |
CVE-2021-45014 | Critical | 9.8 | 2021-12-14 | There is an upload sql injection vulnerability in the background of taocms 3.0.2 in parameter id:action=cms&ctrl=update&id=26 |
CVE-2021-44538 | Critical | 9.8 | 2021-12-14 | The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel b… |
CVE-2021-3376 | High | 8.8 | 2021-12-14 | An issue was discovered in Cuppa CMS Versions Before 31 Jan 2021 allows authenticated attackers to gain escalated privileges via a crafted POST request using t… |
CVE-2021-36721 | Medium | 4.4 | 2021-12-14 | Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version could get users names from the LD… |
CVE-2021-44937 | Medium | 5.3 | 2021-12-14 | glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /public_html/users.php. An attacker can register with the mailbox of any use… |
CVE-2021-44935 | Critical | 9.1 | 2021-12-14 | glFusion CMS v1.7.9 is affected by an arbitrary user impersonation vulnerability in /public_html/comment.php. The attacker can complete the attack remotely wit… |
CVE-2021-4104 | High | 7.5 | 2021-12-14 | JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can pro… |
CVE-2021-44524 | Critical | 9.8 | 2021-12-14 | A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions)… |
CVE-2021-44523 | Critical | 9.1 | 2021-12-14 | A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions)… |
CVE-2021-44522 | High | 7.5 | 2021-12-14 | A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions)… |
CVE-2021-44450 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V12.8.1.1), JTTK (All versions < V10.8.1.1). JTTK library in affected products is vulnerabl… |
CVE-2021-44449 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V12.8.1.1), JTTK (All versions < V10.8.1.1). JTTK library in affected products contains an… |
CVE-2021-44448 | Low | 3.3 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0). JTTK library in affected products is vulnerabl… |
CVE-2021-44447 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0). JTTK library in affected products contains a u… |
CVE-2021-44446 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0). JTTK library in affected products contains an… |
CVE-2021-44445 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products contains an… |
CVE-2021-44444 | Low | 3.3 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerabl… |
CVE-2021-44443 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products contains an… |
CVE-2021-44442 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products contains an… |
CVE-2021-44441 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products contains an… |
CVE-2021-44440 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerabl… |
CVE-2021-44439 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerabl… |
CVE-2021-44438 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerabl… |
CVE-2021-44437 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerabl… |
CVE-2021-44436 | Low | 3.3 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerabl… |
CVE-2021-44435 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerabl… |
CVE-2021-44434 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerabl… |
CVE-2021-44433 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products contains a u… |
CVE-2021-44432 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerabl… |
CVE-2021-44431 | Low | 3.3 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerabl… |
CVE-2021-44430 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerabl… |
CVE-2021-44165 | High | 7.2 | 2021-12-14 | A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (Al… |
CVE-2021-44017 | Medium | 5.5 | 2021-12-14 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Image.dll is vulnerable to an… |
CVE-2021-44015 | Medium | 5.5 | 2021-12-14 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The VCRUNTIME140.dll is vulnerabl… |
CVE-2021-44014 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions < V2023). The Jt10… |
CVE-2021-44013 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The DL180pdfl.dll contains an out… |
CVE-2021-44012 | Medium | 5.5 | 2021-12-14 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Jt1001.dll is vulnerable to a… |
CVE-2021-44011 | Medium | 5.5 | 2021-12-14 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Jt1001.dll is vulnerable to a… |
CVE-2021-44010 | Medium | 5.5 | 2021-12-14 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable… |
CVE-2021-44009 | Medium | 5.5 | 2021-12-14 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable… |
CVE-2021-44008 | Medium | 5.5 | 2021-12-14 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable… |
CVE-2021-44007 | Medium | 5.5 | 2021-12-14 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll contains an o… |
CVE-2021-44006 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll contains an o… |
CVE-2021-44005 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll contains an o… |
CVE-2021-44004 | Medium | 5.5 | 2021-12-14 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable… |
CVE-2021-44003 | Medium | 5.5 | 2021-12-14 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable… |
CVE-2021-44002 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions < V2023). The Jt10… |
CVE-2021-44001 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The DL180pdfl.dll contains an out… |
CVE-2021-42027 | High | 7.4 | 2021-12-14 | A vulnerability has been identified in SINUMERIK Edge (All versions < V3.2). The affected software does not properly validate the server certificate when initi… |
CVE-2021-42024 | High | 7.8 | 2021-12-14 | A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < 2021.3.1). The starview+.exe application lacks proper validation of user-supp… |
CVE-2021-42023 | Medium | 6.5 | 2021-12-14 | A vulnerability has been identified in ModelSim Simulation (All versions), Questa Simulation (All versions). The RSA white-box implementation in affected appli… |
CVE-2021-42022 | Medium | 6.5 | 2021-12-14 | A vulnerability has been identified in SIMATIC eaSie PCS 7 Skill Package (All versions < V21.00 SP3). When downloading files, the affected systems do not prope… |
CVE-2021-41547 | High | 7.2 | 2021-12-14 | A vulnerability has been identified in Teamcenter Active Workspace V4.3 (All versions < V4.3.11), Teamcenter Active Workspace V5.0 (All versions < V5.0.10), Te… |
CVE-2021-3831 | Medium | 6.1 | 2021-12-14 | gnuboard5 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-41272 | High | 7.5 | 2021-12-13 | Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations resulted in the intr… |
CVE-2021-24045 | Critical | 9.8 | 2021-12-13 | A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only exploi… |
CVE-2021-43823 | Medium | 6.5 | 2021-12-13 | Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.33.2 is vulnerable to a side-channel attack where strings in private source… |
CVE-2021-43822 | High | 8.5 | 2021-12-13 | Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users… |
CVE-2021-43817 | High | 8.2 | 2021-12-13 | Collabora Online is a collaborative online office suite based on LibreOffice technology. In affected versions a reflected XSS vulnerability was found in Collab… |
CVE-2021-43814 | High | 7.7 | 2021-12-13 | Rizin is a UNIX-like reverse engineering framework and command-line toolset. In versions up to and including 0.3.1 there is a heap-based out of bounds write in… |
CVE-2021-43801 | High | 7.5 | 2021-12-13 | Mercurius is a GraphQL adapter for Fastify. Any users from Mercurius@8.10.0 to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON t… |
CVE-2021-39063 | Critical | 9.1 | 2021-12-13 | IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and… |
CVE-2021-39057 | High | 8.1 | 2021-12-13 | IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unaut… |
CVE-2021-39050 | High | 7.8 | 2021-12-13 | IBM i2 Analyst's Notebook 9.2.0, 9.2.1, and 9.2.2 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local attacker could ov… |
CVE-2021-39049 | High | 7.8 | 2021-12-13 | IBM i2 Analyst's Notebook 9.2.0, 9.2.1, and 9.2.2 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local attacker could ov… |
CVE-2021-39048 | Medium | 5.5 | 2021-12-13 | IBM Spectrum Protect Client 7.1 and 8.1 is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A local attacker could exploit this… |
CVE-2021-38901 | Medium | 5.5 | 2021-12-13 | IBM Spectrum Protect Operations Center 7.1, under special configurations, could allow a local user to obtain highly sensitive information. IBM X-Force ID: 2096… |
CVE-2021-32024 | Critical | 9.8 | 2021-12-13 | A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an attacker to potentially execute code in… |
CVE-2021-43818 | High | 8.2 | 2021-12-13 | lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content… |
CVE-2021-39065 | Critical | 9.8 | 2021-12-13 | IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation o… |
CVE-2021-39064 | High | 7.5 | 2021-12-13 | IBM Spectrum Copy Data Management 2.2.13 and earlier has weak authentication and password rules and incorrectly handles default credentials for the Spectrum Co… |
CVE-2021-39058 | High | 7.5 | 2021-12-13 | IBM Spectrum Copy Data Management 2.2.13 and earlier uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiv… |
CVE-2021-39054 | Medium | 5.4 | 2021-12-13 | IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit… |