2021 CVEs (page 79)
Page 79 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-23862 | High | 7.2 | 2021-12-08 | A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affect… |
CVE-2021-23861 | Medium | 6.5 | 2021-12-08 | By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or… |
CVE-2021-23860 | Medium | 5.0 | 2021-12-08 | An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface. To exploit this vulnerability an attack mu… |
CVE-2021-23859 | Critical | 9.1 | 2021-12-08 | An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS with VRM installation t… |
CVE-2021-21957 | High | 7.3 | 2021-12-08 | A privilege escalation vulnerability exists in the Remote Server functionality of Dream Report ODS Remote Connector 20.2.16900.0. A specially-crafted command i… |
CVE-2021-21951 | Critical | 10.0 | 2021-12-08 | An out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6… |
CVE-2021-21950 | Critical | 10.0 | 2021-12-08 | An out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6… |
CVE-2021-36720 | Medium | 6.1 | 2021-12-08 | PineApp - Mail Secure - Attacker sending a request to :/blocking.php?url=<script>alert(1)</script> and stealing cookies . |
CVE-2021-36719 | High | 8.8 | 2021-12-08 | PineApp - Mail Secure - The attacker must be logged in as a user to the Pineapp system. The attacker exploits the vulnerable nicUpload.php file to upload a mal… |
CVE-2021-36718 | Medium | 6.1 | 2021-12-08 | SYNEL - eharmonynew / Synel Reports - The attacker can log in to the system with default credentials and export a report of eharmony system with sensetive data… |
CVE-2021-43978 | High | 7.1 | 2021-12-08 | Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary files, which allows users to access and modify data using the sa… |
CVE-2021-43809 | Medium | 6.7 | 2021-12-08 | `Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless… |
CVE-2021-43399 | High | 7.5 | 2021-12-08 | The Yubico YubiHSM YubiHSM2 library 2021.08, included in the yubihsm-shell project, does not properly validate the length of some operations including SSH sign… |
CVE-2021-41025 | High | 7.3 | 2021-12-08 | Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6… |
CVE-2021-41017 | High | 8.8 | 2021-12-08 | Multiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow a remote authentic… |
CVE-2021-36195 | Medium | 4.2 | 2021-12-08 | Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, and 6… |
CVE-2021-36173 | High | 8.0 | 2021-12-08 | A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, and 6… |
CVE-2021-41030 | Medium | 5.4 | 2021-12-08 | An authentication bypass by capture-replay vulnerability [CWE-294] in FortiClient EMS versions 7.0.1 and below and 6.4.4 and below may allow an unauthenticated… |
CVE-2021-41021 | High | 7.8 | 2021-12-08 | A privilege escalation vulnerability in FortiNAC versions 8.8.8 and below and 9.1.2 and below may allow an admin user to escalate the privileges to root via th… |
CVE-2021-41090 | Medium | 6.5 | 2021-12-08 | Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0… |
CVE-2021-41063 | Critical | 9.8 | 2021-12-08 | SQL injection vulnerability was discovered in Aanderaa GeoView Webservice prior to version 2.1.3 that could allow an unauthenticated attackers to execute arbit… |
CVE-2021-41013 | Medium | 5.3 | 2021-12-08 | An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log & Report may a… |
CVE-2021-3815 | Critical | 9.8 | 2021-12-08 | utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-36188 | Medium | 6.1 | 2021-12-08 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows at… |
CVE-2021-27860 | Critical | 9.8 | 2021-12-08 | A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unau… |
CVE-2021-42110 | High | 7.1 | 2021-12-08 | An issue was discovered in Allegro Windows (formerly Popsy Windows) before 3.3.4156.1. A standard user can escalate privileges to SYSTEM if the FTP module is i… |
CVE-2021-41450 | High | 7.5 | 2021-12-08 | An HTTP request smuggling attack in TP-Link AX10v1 before v1_211117 allows a remote unauthenticated attacker to DoS the web application via sending a specific… |
CVE-2021-42835 | High | 7.0 | 2021-12-08 | An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can a… |
CVE-2021-40861 | High | 7.2 | 2021-12-08 | A SQL Injection in the custom filter query component in Genesys intelligent Workload Distribution (IWD) 9.0.017.07 allows an attacker to execute arbitrary SQL… |
CVE-2021-40860 | High | 7.2 | 2021-12-08 | A SQL Injection in the custom filter query component in Genesys intelligent Workload Distribution (IWD) before 9.0.013.11 allows an attacker to execute arbitra… |
CVE-2021-37097 | High | 7.5 | 2021-12-08 | There is a Code Injection vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to system restart. |
CVE-2021-37093 | Medium | 5.3 | 2021-12-08 | There is a Improper Access Control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers steal short messages. |
CVE-2021-37092 | High | 7.5 | 2021-12-08 | There is a Incomplete Cleanup vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to availability affected. |
CVE-2021-37075 | High | 7.5 | 2021-12-08 | There is a Credentials Management Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to confidentiality affected. |
CVE-2021-37074 | High | 8.1 | 2021-12-08 | There is a Race Condition vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to the user root privilege escalation. |
CVE-2021-37069 | High | 7.4 | 2021-12-08 | There is a Race Condition vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to availability affected. |
CVE-2021-37054 | High | 7.5 | 2021-12-08 | There is an Identity spoofing and authentication bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service con… |
CVE-2021-37053 | High | 7.5 | 2021-12-08 | There is a Service logic vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause WLAN DoS. |
CVE-2021-37052 | High | 7.5 | 2021-12-08 | There is an Exception log vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause address information leakage. |
CVE-2021-37051 | Critical | 9.1 | 2021-12-08 | There is an Out-of-bounds read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause out-of-bounds memory access. |
CVE-2021-37050 | High | 7.5 | 2021-12-08 | There is a Missing sensitive data encryption vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentialit… |
CVE-2021-37049 | Critical | 9.8 | 2021-12-08 | There is a Heap-based buffer overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may rewrite the memory of adjacent objec… |
CVE-2021-37045 | Critical | 9.8 | 2021-12-08 | There is an UAF vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the device to restart unexpectedly and the kernel-mo… |
CVE-2021-37044 | High | 7.5 | 2021-12-08 | There is a Permission control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability. |
CVE-2021-37040 | Critical | 9.8 | 2021-12-08 | There is a Parameter injection vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause privilege escalation of files after C… |
CVE-2021-37039 | Medium | 6.5 | 2021-12-08 | There is an Input verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause Bluetooth DoS. |
CVE-2021-37037 | High | 7.5 | 2021-12-08 | There is an Invalid address access vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the device to restart. |
CVE-2021-25527 | Low | 3.8 | 2021-12-08 | Improper export of Android application components vulnerability in Samsung Pay (India only) prior to version 4.1.77 allows attacker to access Bill Pay and Rech… |
CVE-2021-25526 | Medium | 4.0 | 2021-12-08 | Intent redirection vulnerability in Samsung Blockchain Wallet prior to version 1.3.02.8 allows attacker to execute privileged action. |
CVE-2021-25525 | Low | 2.0 | 2021-12-08 | Improper check or handling of exception conditions vulnerability in Samsung Pay (US only) prior to version 4.0.65 allows attacker to use NFC without user recog… |
CVE-2021-25524 | Medium | 4.0 | 2021-12-08 | Insecure storage of device information in Contacts prior to version 12.7.05.24 allows attacker to get Samsung Account ID. |
CVE-2021-25523 | Medium | 4.0 | 2021-12-08 | Insecure storage of device information in Samsung Dialer prior to version 12.7.05.24 allows attacker to get Samsung Account ID. |
CVE-2021-25522 | Medium | 5.3 | 2021-12-08 | Insecure storage of sensitive information vulnerability in Smart Capture prior to version 4.8.02.10 allows attacker to access victim's captured images without… |
CVE-2021-25521 | Medium | 4.0 | 2021-12-08 | Insecure caller check in sharevia deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to get current tab URL in Samsung Internet. |
CVE-2021-25520 | Medium | 5.9 | 2021-12-08 | Insecure caller check and input validation vulnerabilities in SearchKeyword deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to e… |
CVE-2021-25519 | Medium | 4.0 | 2021-12-08 | An improper access control vulnerability in CPLC prior to SMR Dec-2021 Release 1 allows local attackers to access CPLC information without permission. |
CVE-2021-25518 | Medium | 6.4 | 2021-12-08 | An improper boundary check in secure_log of LDFW and BL31 prior to SMR Dec-2021 Release 1 allows arbitrary memory write and code execution. |
CVE-2021-25517 | High | 7.7 | 2021-12-08 | An improper input validation vulnerability in LDFW prior to SMR Dec-2021 Release 1 allows attackers to perform arbitrary code execution. |
CVE-2021-25516 | Medium | 6.4 | 2021-12-08 | An improper check or handling of exceptional conditions in Exynos baseband prior to SMR Dec-2021 Release 1 allows attackers to track locations. |
CVE-2021-25515 | Medium | 4.0 | 2021-12-08 | An improper usage of implicit intent in SemRewardManager prior to SMR Dec-2021 Release 1 allows attackers to access BSSID. |
CVE-2021-25514 | Low | 3.3 | 2021-12-08 | An improper intent redirection handling in Tags prior to SMR Dec-2021 Release 1 allows attackers to access sensitive information. |
CVE-2021-25513 | Low | 2.4 | 2021-12-08 | An improper privilege management vulnerability in Apps Edge application prior to SMR Dec-2021 Release 1 allows unauthorized access to some device data on the l… |
CVE-2021-25512 | Medium | 6.1 | 2021-12-08 | An improper validation vulnerability in telephony prior to SMR Dec-2021 Release 1 allows attackers to launch certain activities. |
CVE-2021-25511 | Medium | 6.3 | 2021-12-08 | An improper validation vulnerability in FilterProvider prior to SMR Dec-2021 Release 1 allows attackers to write arbitrary files via a path traversal vulnerabi… |
CVE-2021-25510 | Medium | 5.3 | 2021-12-08 | An improper validation vulnerability in FilterProvider prior to SMR Dec-2021 Release 1 allows local arbitrary code execution. |
CVE-2021-43063 | Medium | 6.1 | 2021-12-08 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below… |
CVE-2021-36190 | Medium | 5.5 | 2021-12-08 | A unintended proxy or intermediary ('confused deputy') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to acc… |
CVE-2021-43064 | Medium | 4.3 | 2021-12-08 | A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows at… |
CVE-2021-41027 | High | 7.3 | 2021-12-08 | A stack-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, allows an authenticated attacker to execute unauthorized code or commands via craft… |
CVE-2021-41024 | High | 7.5 | 2021-12-08 | A relative path traversal [CWE-23] vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy verison 7.0.0 may allow an unauthenticated, unauthorized at… |
CVE-2021-41015 | Medium | 6.1 | 2021-12-08 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows at… |
CVE-2021-41014 | High | 7.5 | 2021-12-08 | A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to make the httpsd daemon… |
CVE-2021-36191 | Medium | 4.1 | 2021-12-08 | A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to use the device as proxy… |
CVE-2021-26109 | High | 8.1 | 2021-12-08 | An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt cont… |
CVE-2021-26108 | High | 7.5 | 2021-12-08 | A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may allow an attacker to retrieve the key by reverse engineering. |
CVE-2021-44557 | Critical | 9.1 | 2021-12-08 | National Library of the Netherlands multiNER <= c0440948057afc6e3d6b4903a7c05e666b94a3bc is affected by an XML External Entity (XXE) vulnerability in multiNER/… |
CVE-2021-44556 | Critical | 9.1 | 2021-12-08 | National Library of the Netherlands digger < 6697d1269d981e35e11f240725b16401b5ce3db5 is affected by a XML External Entity (XXE) vulnerability. Since XML parsi… |
CVE-2021-43067 | High | 8.3 | 2021-12-08 | A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, ve… |
CVE-2021-42760 | High | 8.8 | 2021-12-08 | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose… |
CVE-2021-42752 | Medium | 5.4 | 2021-12-08 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute… |
CVE-2021-41029 | Medium | 6.4 | 2021-12-08 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWLM version 8.6.1 and below allows attacker to store ma… |
CVE-2021-32591 | Medium | 5.3 | 2021-12-08 | A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3… |
CVE-2021-26103 | Medium | 6.3 | 2021-12-08 | An insufficient verification of data authenticity vulnerability (CWE-345) in the user interface of FortiProxy verison 2.0.3 and below, 1.2.11 and below and For… |
CVE-2021-4050 | Medium | 6.1 | 2021-12-08 | livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-42758 | High | 8.8 | 2021-12-08 | An improper access control vulnerability [CWE-284] in FortiWLC 8.6.1 and below may allow an authenticated and remote attacker with low privileges to execute an… |
CVE-2021-42757 | Medium | 6.7 | 2021-12-08 | A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to ac… |
CVE-2021-36180 | High | 8.1 | 2021-12-08 | Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and be… |
CVE-2021-31850 | Medium | 6.1 | 2021-12-08 | A denial-of-service vulnerability in Database Security (DBS) prior to 4.8.4 allows a remote authenticated administrator to trigger a denial-of-service attack a… |
CVE-2021-26110 | High | 7.8 | 2021-12-08 | An improper access control vulnerability [CWE-284] in FortiOS autod daemon 7.0.0, 6.4.6 and below, 6.2.9 and below, 6.0.12 and below and FortiProxy 2.0.1 and b… |
CVE-2021-20047 | High | 7.8 | 2021-12-08 | SonicWall Global VPN client version 4.10.6 (32-bit and 64-bit) and earlier have a DLL Search Order Hijacking vulnerability. Successful exploitation via a local… |
CVE-2021-20045 | Critical | 9.8 | 2021-12-08 | A buffer overflow vulnerability in SMA100 sonicfiles RAC_COPY_TO (RacNumber 36) method allows a remote unauthenticated attacker to potentially execute code as… |
CVE-2021-20044 | High | 8.8 | 2021-12-08 | A post-authentication remote command injection vulnerability in SonicWall SMA100 allows a remote authenticated attacker to execute OS system commands in the ap… |
CVE-2021-20043 | High | 8.8 | 2021-12-08 | A Heap-based buffer overflow vulnerability in SonicWall SMA100 getBookmarks method allows a remote authenticated attacker to potentially execute code as the no… |
CVE-2021-20042 | Critical | 9.8 | 2021-12-08 | An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules. This vulnerability affec… |
CVE-2021-20041 | High | 7.5 | 2021-12-08 | An unauthenticated and remote adversary can consume all of the device's CPU due to crafted HTTP requests sent to SMA100 /fileshare/sonicfiles/sonicfiles result… |
CVE-2021-20040 | High | 7.5 | 2021-12-08 | A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages or files as a 'nobody… |
CVE-2021-20039 | High | 8.8 | 2021-12-08 | Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to i… |
CVE-2021-20038 | Critical | 9.8 | 2021-12-08 | A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to po… |
CVE-2021-44726 | High | 8.8 | 2021-12-08 | KNIME Server before 4.13.4 allows XSS via the old WebPortal login page. |
CVE-2021-44725 | High | 7.5 | 2021-12-08 | KNIME Server before 4.13.4 allows directory traversal in a request for a client profile. |