2021 CVEs (page 77)
Page 77 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-39053 | High | 7.5 | 2021-12-13 | IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to obtain sensitive information, caused by the improper handling of requests… |
CVE-2021-39052 | Critical | 9.8 | 2021-12-13 | IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to access the Spring Boot console without authorization. IBM X-Force ID: 214… |
CVE-2021-38947 | High | 7.5 | 2021-12-13 | IBM Spectrum Copy Data Management 2.2.13 and earlier uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiv… |
CVE-2021-43983 | High | 7.8 | 2021-12-13 | WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to multiple stack-based buffer overflow instances while parsing project files, which may allow a… |
CVE-2021-40008 | High | 7.5 | 2021-12-13 | There is a memory leak vulnerability in CloudEngine 12800 V200R019C00SPC800, CloudEngine 5800 V200R019C00SPC800, CloudEngine 6800 V200R019C00SPC800 and CloudEn… |
CVE-2021-40007 | Medium | 6.5 | 2021-12-13 | There is an information leak vulnerability in eCNS280_TD V100R005C10SPC650. The vulnerability is caused by improper log output management. An attacker with the… |
CVE-2021-39945 | Low | 2.7 | 2021-12-13 | Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 before 14.4.4, all vers… |
CVE-2021-39944 | High | 7.1 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39941 | Low | 3.7 | 2021-12-13 | An information disclosure vulnerability in GitLab CE/EE versions 12.0 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed non-project members to see the defa… |
CVE-2021-39940 | Medium | 4.3 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39939 | Medium | 6.5 | 2021-12-13 | An uncontrolled resource consumption vulnerability in GitLab Runner affecting all versions starting from 13.7 before 14.3.6, all versions starting from 14.4 be… |
CVE-2021-39938 | Low | 3.1 | 2021-12-13 | A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting… |
CVE-2021-39937 | Medium | 5.9 | 2021-12-13 | A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting fro… |
CVE-2021-39936 | Low | 3.5 | 2021-12-13 | Improper access control in GitLab CE/EE affecting all versions starting from 10.7 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions st… |
CVE-2021-39935 | Medium | 6.8 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39934 | Medium | 4.3 | 2021-12-13 | Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all version… |
CVE-2021-39933 | Medium | 4.3 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versi… |
CVE-2021-39932 | Medium | 4.3 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39931 | Low | 3.1 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.11 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39930 | Medium | 4.3 | 2021-12-13 | Missing authorization in GitLab EE versions between 12.4 and 14.3.6, between 14.4.0 and 14.4.4, and between 14.5.0 and 14.5.2 allowed an attacker to access a u… |
CVE-2021-39919 | Medium | 4.4 | 2021-12-13 | In all versions of GitLab CE/EE starting version 14.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5… |
CVE-2021-39918 | Low | 3.1 | 2021-12-13 | Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions start… |
CVE-2021-39917 | Medium | 4.3 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39916 | Medium | 4.3 | 2021-12-13 | Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check… |
CVE-2021-39915 | Medium | 5.3 | 2021-12-13 | Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4… |
CVE-2021-39910 | Low | 2.6 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-22279 | Critical | 9.8 | 2021-12-13 | A Missing Authentication vulnerability in RobotWare for the OmniCore robot controller allows an attacker to read and modify files on the robot controller if th… |
CVE-2021-44966 | Critical | 9.8 | 2021-12-13 | SQL injection bypass authentication vulnerability in PHPGURUKUL Employee Record Management System 1.2 via index.php. An attacker can log in as an admin account… |
CVE-2021-44965 | High | 7.5 | 2021-12-13 | Directory traversal vulnerability in /admin/includes/* directory for PHPGURUKUL Employee Record Management System 1.2 The attacker can retrieve and download se… |
CVE-2021-36169 | Medium | 4.2 | 2021-12-13 | A Hidden Functionality in Fortinet FortiOS 7.x before 7.0.1, FortiOS 6.4.x before 6.4.7 allows attacker to Execute unauthorized code or commands via specific h… |
CVE-2021-43117 | Critical | 9.8 | 2021-12-13 | fastadmin v1.2.1 is affected by a file upload vulnerability which allows arbitrary code execution through shell access. |
CVE-2021-42549 | Medium | 4.7 | 2021-12-13 | Insufficient Input Validation in the search functionality of Wordpress plugin Lets-Box prior to 1.15.3 allows unauthenticated user to craft a reflected Cross-S… |
CVE-2021-42548 | Medium | 4.7 | 2021-12-13 | Insufficient Input Validation in the search functionality of Wordpress plugin Share-one-Drive prior to 1.15.3 allows unauthenticated user to craft a reflected… |
CVE-2021-42547 | Medium | 4.7 | 2021-12-13 | Insufficient Input Validation in the search functionality of Wordpress plugin Out-of-the-Box prior to 1.20.3 allows unauthenticated user to craft a reflected C… |
CVE-2021-42546 | Medium | 4.7 | 2021-12-13 | Insufficient Input Validation in the search functionality of Wordpress plugin Use-Your-Drive prior to 1.18.3 allows unauthenticated user to craft a reflected C… |
CVE-2021-24972 | Medium | 4.8 | 2021-12-13 | The Pixel Cat WordPress plugin before 2.6.3 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attack… |
CVE-2021-24970 | High | 7.2 | 2021-12-13 | The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin… |
CVE-2021-24955 | Medium | 6.1 | 2021-12-13 | The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_ty… |
CVE-2021-24954 | Medium | 6.1 | 2021-12-13 | The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppress_cc_data parameter before out… |
CVE-2021-24951 | Critical | 9.8 | 2021-12-13 | The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating course/… |
CVE-2021-24946 | Critical | 9.8 | 2021-12-13 | The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_loa… |
CVE-2021-24945 | High | 8.0 | 2021-12-13 | The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which… |
CVE-2021-24932 | Medium | 6.1 | 2021-12-13 | The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.3 does not sanitise and escape the post_id parameter before outputting back in an adm… |
CVE-2021-24925 | Medium | 6.1 | 2021-12-13 | The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX c… |
CVE-2021-24922 | Critical | 9.0 | 2021-12-13 | The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some of them, which could… |
CVE-2021-24896 | Medium | 4.8 | 2021-12-13 | The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege… |
CVE-2021-24872 | Medium | 6.5 | 2021-12-13 | The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the pe… |
CVE-2021-24871 | Medium | 5.4 | 2021-12-13 | The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could allow users with a role… |
CVE-2021-24863 | Critical | 9.8 | 2021-12-13 | The WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots WordPress plugin before 6.67 does not sanitise and escape the U… |
CVE-2021-24861 | High | 7.2 | 2021-12-13 | The Quotes Collection WordPress plugin through 2.5.2 does not validate and escape the bulkcheck parameter before using it in a SQL statement, leading to a SQL… |
CVE-2021-24859 | Medium | 4.3 | 2021-12-13 | The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metada… |
CVE-2021-24857 | Critical | 9.8 | 2021-12-13 | The ToTop Link WordPress plugin through 1.7.1 passes base64 encoded user input to the unserialize() PHP function, which could lead to PHP Object injection if a… |
CVE-2021-24855 | Medium | 5.4 | 2021-12-13 | The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their content is not sanitised or escaped which co… |
CVE-2021-24848 | High | 8.8 | 2021-12-13 | The mediamaticAjaxRenameCategory AJAX action of the Mediamatic WordPress plugin before 2.8.1, available to any authenticated user, does not sanitise the catego… |
CVE-2021-24845 | Medium | 6.5 | 2021-12-13 | The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary… |
CVE-2021-24836 | Medium | 4.3 | 2021-12-13 | The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows a… |
CVE-2021-24819 | Medium | 4.3 | 2021-12-13 | The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users with a role as low as contributor to a… |
CVE-2021-24818 | Medium | 4.3 | 2021-12-13 | The WP Limits WordPress plugin through 1.0 does not have CSRF check when saving its settings, allowing attacker to make a logged in admin change them, which co… |
CVE-2021-24817 | Medium | 5.4 | 2021-12-13 | The Ultimate NoFollow WordPress plugin through 1.4.8 does not sanitise and escape the href attribute of its shortcodes, allowing users with a role as low as co… |
CVE-2021-24795 | Medium | 6.5 | 2021-12-13 | The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleting a Gallery, which could allow attacke… |
CVE-2021-24792 | Medium | 6.1 | 2021-12-13 | The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template (wpbtn_save_template function hooked… |
CVE-2021-24790 | Medium | 4.3 | 2021-12-13 | The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_… |
CVE-2021-24784 | Medium | 6.5 | 2021-12-13 | The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin… |
CVE-2021-24782 | Medium | 4.8 | 2021-12-13 | The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could allow hight privilege users to perform… |
CVE-2021-24780 | Medium | 4.3 | 2021-12-13 | The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in adm… |
CVE-2021-24771 | Medium | 4.8 | 2021-12-13 | The Inspirational Quote Rotator WordPress plugin through 1.0.0 does not sanitize and escape some of its quote fields when adding/editing a quote as admin, lead… |
CVE-2021-24756 | Medium | 6.1 | 2021-12-13 | The WP System Log WordPress plugin before 1.0.21 does not sanitise, validate and escape the IP address retrieved from login requests before outputting them in… |
CVE-2021-24747 | High | 7.2 | 2021-12-13 | The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX request as the $_REQUEST['ord… |
CVE-2021-24705 | Medium | 4.8 | 2021-12-13 | The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape some of its settings as well as form fi… |
CVE-2021-20867 | Medium | 6.5 | 2021-12-13 | Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the… |
CVE-2021-20866 | Medium | 6.5 | 2021-12-13 | Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining… |
CVE-2021-20865 | High | 7.5 | 2021-12-13 | Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing d… |
CVE-2021-44155 | Medium | 5.3 | 2021-12-13 | An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Fa… |
CVE-2021-44154 | High | 7.2 | 2021-12-13 | An issue was discovered in Reprise RLM 14.2. By using an admin account, an attacker can write a payload to /goform/edit_opt, which will then be triggered when… |
CVE-2021-44153 | High | 7.2 | 2021-12-13 | An issue was discovered in Reprise RLM 14.2. When editing the license file, it is possible for an admin user to enable an option to run arbitrary executables… |
CVE-2021-44152 | Critical | 9.8 | 2021-12-13 | An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user c… |
CVE-2021-44151 | High | 7.5 | 2021-12-13 | An issue was discovered in Reprise RLM 14.2. As the session cookies are small, an attacker can hijack any existing sessions by bruteforcing the 4 hex-character… |
CVE-2021-40858 | Medium | 4.9 | 2021-12-13 | Auerswald COMpact 5500R devices before 8.2B allow Arbitrary File Disclosure. A sub-admin can read the cleartext Admin password via the fileName=../../etc/passw… |
CVE-2021-40857 | High | 8.8 | 2021-12-13 | Auerswald COMpact 5500R devices before 8.2B allow Privilege Escalation via the passwd=1 substring. |
CVE-2021-40856 | High | 7.5 | 2021-12-13 | Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring. |
CVE-2021-44848 | Medium | 5.3 | 2021-12-13 | In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username ex… |
CVE-2021-44847 | Critical | 9.8 | 2021-12-13 | A stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through 0.2.12 (caused by an improper length calcul… |
CVE-2021-44833 | Critical | 9.8 | 2021-12-12 | The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file. |
CVE-2021-44515 | Critical | 9.8 | 2021-12-12 | Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December… |
CVE-2021-41805 | High | 8.8 | 2021-12-12 | HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token (with the default operator… |
CVE-2021-4097 | Medium | 5.4 | 2021-12-12 | phpservermon is vulnerable to Improper Neutralization of CRLF Sequences |
CVE-2021-4092 | Medium | 4.3 | 2021-12-11 | yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-41242 | High | 8.1 | 2021-12-10 | OpenOlat is a web-basedlearning management system. A path traversal vulnerability exists in OpenOlat prior to versions 15.5.12 and 16.0.5. By providing a filen… |
CVE-2021-26340 | High | 8.4 | 2021-12-10 | A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation Lookaside Buffer (T… |
CVE-2021-43815 | Medium | 4.3 | 2021-12-10 | Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv fi… |
CVE-2021-4089 | Medium | 4.3 | 2021-12-10 | snipe-it is vulnerable to Improper Access Control |
CVE-2021-23700 | Medium | 6.5 | 2021-12-10 | All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function. |
CVE-2021-23663 | Medium | 6.5 | 2021-12-10 | All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function. |
CVE-2021-23639 | Critical | 9.8 | 2021-12-10 | The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, withou… |
CVE-2021-23561 | Medium | 6.5 | 2021-12-10 | All versions of package comb are vulnerable to Prototype Pollution via the deepMerge() function. |
CVE-2021-23463 | High | 8.1 | 2021-12-10 | The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object… |
CVE-2021-31747 | Medium | 4.8 | 2021-12-10 | Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in update_applet.php, which could lead to man-in-the-middle attacks. |
CVE-2021-27984 | High | 8.1 | 2021-12-10 | In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files. |
CVE-2021-27983 | Critical | 9.8 | 2021-12-10 | Remote Code Execution (RCE) vulnerability exists in MaxSite CMS v107.5 via the Documents page. |
CVE-2021-43813 | Medium | 4.3 | 2021-12-10 | Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability fo… |