2021 CVEs (page 81)
Page 81 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-37047 | High | 7.5 | 2021-12-07 | There is an Input verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause some services to restart. |
CVE-2021-37046 | High | 7.5 | 2021-12-07 | There is a Memory leak vulnerability with the codec detection module in Huawei Smartphone.Successful exploitation of this vulnerability may cause the device to… |
CVE-2021-37042 | Critical | 9.1 | 2021-12-07 | There is an Improper verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause out-of-bounds read. |
CVE-2021-37041 | Critical | 9.1 | 2021-12-07 | There is an Improper verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause out-of-bounds read. |
CVE-2021-37038 | High | 7.5 | 2021-12-07 | There is an Improper access control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-44527 | Medium | 6.5 | 2021-12-07 | A vulnerability found in UniFi Switch firmware Version 5.43.35 and earlier allows a malicious actor who has already gained access to the network to perform a D… |
CVE-2021-44187 | Low | 3.3 | 2021-12-07 | Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2021-44186 | Low | 3.3 | 2021-12-07 | Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2021-44185 | Low | 3.3 | 2021-12-07 | Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2021-42133 | High | 8.1 | 2021-12-07 | An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform an arbitr… |
CVE-2021-42132 | High | 8.8 | 2021-12-07 | A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command e… |
CVE-2021-42131 | High | 8.8 | 2021-12-07 | A SQL Injection vulnerability exists in Ivanti Avalance before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation. |
CVE-2021-42130 | High | 8.8 | 2021-12-07 | A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arb… |
CVE-2021-42129 | High | 8.8 | 2021-12-07 | A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command e… |
CVE-2021-42128 | Critical | 9.8 | 2021-12-07 | An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using inforail Service allows Privilege Escalation via Enterprise Server Se… |
CVE-2021-42127 | Critical | 9.8 | 2021-12-07 | A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execution via Data Repos… |
CVE-2021-42126 | High | 8.8 | 2021-12-07 | An improper authorization control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform privi… |
CVE-2021-42125 | High | 8.8 | 2021-12-07 | An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous fil… |
CVE-2021-42124 | High | 8.8 | 2021-12-07 | An improper access control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform a session ta… |
CVE-2021-22956 | High | 7.5 | 2021-12-07 | An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that could allow an attacker with access to NSI… |
CVE-2021-22955 | High | 7.5 | 2021-12-07 | A unauthenticated denial of service vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 when configured as a VPN (Gateway) or AAA virtua… |
CVE-2021-40096 | Medium | 5.4 | 2021-12-07 | A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script… |
CVE-2021-40095 | Medium | 4.9 | 2021-12-07 | An issue was discovered in SquaredUp for SCOM 5.2.1.6654. The Download Log feature in System / Maintenance was susceptible to a local file inclusion vulnerabil… |
CVE-2021-40094 | Medium | 5.4 | 2021-12-07 | A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654. If successfully exploited, this vulnerability may allow attackers to inject malicious code… |
CVE-2021-40093 | Medium | 5.4 | 2021-12-07 | A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script… |
CVE-2021-40092 | Medium | 5.4 | 2021-12-07 | A cross-site scripting (XSS) vulnerability in Image Tile in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via an… |
CVE-2021-28703 | High | 7.0 | 2021-12-07 | grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted access to certain Xen-owned pages of memory. The majority… |
CVE-2021-4049 | Medium | 6.5 | 2021-12-07 | livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-29116 | Medium | 6.1 | 2021-12-07 | A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, u… |
CVE-2021-29115 | Medium | 5.3 | 2021-12-07 | An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to vie… |
CVE-2021-29114 | Critical | 9.8 | 2021-12-07 | A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confide… |
CVE-2021-29113 | Medium | 4.7 | 2021-12-07 | A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html int… |
CVE-2021-44513 | High | 7.0 | 2021-12-07 | Insecure creation of temporary directories in tmate-ssh-server 2.3.0 allows a local attacker to compromise the integrity of session handling. |
CVE-2021-44512 | High | 7.0 | 2021-12-07 | World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity of session handlin… |
CVE-2021-44686 | High | 7.5 | 2021-12-07 | calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_rules in ebooks/conve… |
CVE-2021-44685 | Critical | 9.8 | 2021-12-07 | Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the… |
CVE-2021-44684 | Critical | 9.8 | 2021-12-07 | naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the _hook subcommand is concatenated without any validation, and is direc… |
CVE-2021-44682 | Critical | 9.8 | 2021-12-06 | An issue (6 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen… |
CVE-2021-44681 | Critical | 9.8 | 2021-12-06 | An issue (5 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen… |
CVE-2021-44680 | Critical | 9.8 | 2021-12-06 | An issue (4 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen… |
CVE-2021-44679 | Critical | 9.8 | 2021-12-06 | An issue (3 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen… |
CVE-2021-44678 | Critical | 9.8 | 2021-12-06 | An issue (2 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen… |
CVE-2021-44677 | Critical | 9.8 | 2021-12-06 | An issue (1 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen… |
CVE-2021-31632 | Critical | 9.8 | 2021-12-06 | b2evolution CMS v7.2.3 was discovered to contain a SQL injection vulnerability via the parameter cfqueryparam in the User login section. This vulnerability all… |
CVE-2021-31631 | High | 8.8 | 2021-12-06 | b2evolution CMS v7.2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the User login page. This vulnerability allows attackers to escalate p… |
CVE-2021-4075 | High | 7.2 | 2021-12-06 | snipe-it is vulnerable to Server-Side Request Forgery (SSRF) |
CVE-2021-40313 | High | 8.8 | 2021-12-06 | Piwigo v11.5 was discovered to contain a SQL injection vulnerability via the parameter pwg_token in /admin/batch_manager_global.php. |
CVE-2021-40091 | Critical | 9.8 | 2021-12-06 | An SSRF issue was discovered in SquaredUp for SCOM 5.2.1.6654. |
CVE-2021-36567 | Critical | 9.8 | 2021-12-06 | ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache. |
CVE-2021-36564 | Critical | 9.8 | 2021-12-06 | ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php. |
CVE-2021-43800 | High | 7.5 | 2021-12-06 | Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage module with local a… |
CVE-2021-43936 | Critical | 10.0 | 2021-12-06 | The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's… |
CVE-2021-43931 | Critical | 9.8 | 2021-12-06 | The authentication algorithm of the WebHMI portal is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary… |
CVE-2021-43784 | Medium | 6.0 | 2021-12-06 | runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization syst… |
CVE-2021-43781 | Medium | 6.4 | 2021-12-06 | Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versi… |
CVE-2021-39890 | Low | 3.1 | 2021-12-06 | It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above. |
CVE-2021-22170 | Medium | 6.2 | 2021-12-06 | Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted content |
CVE-2021-36198 | High | 8.3 | 2021-12-06 | Successful exploitation of this vulnerability could allow an unauthorized user to access sensitive data. |
CVE-2021-35245 | High | 8.4 | 2021-12-06 | When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine. |
CVE-2021-35242 | High | 8.3 | 2021-12-06 | Serv-U server responds with valid CSRFToken when the request contains only Session. |
CVE-2021-25041 | Medium | 6.1 | 2021-12-06 | The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and short… |
CVE-2021-24943 | Critical | 9.8 | 2021-12-06 | The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action… |
CVE-2021-24939 | Medium | 6.1 | 2021-12-06 | The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login_url and rul_logout_url parameter befor… |
CVE-2021-24938 | Medium | 6.1 | 2021-12-06 | The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authen… |
CVE-2021-24935 | Medium | 6.1 | 2021-12-06 | The WP Google Fonts WordPress plugin before 3.1.5 does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx a… |
CVE-2021-24931 | Critical | 9.8 | 2021-12-06 | The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file… |
CVE-2021-24930 | Medium | 5.4 | 2021-12-06 | The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page… |
CVE-2021-24924 | Medium | 6.1 | 2021-12-06 | The Email Log WordPress plugin before 2.4.8 does not escape the d parameter before outputting it back in an attribute in the Log page, leading to a Reflected C… |
CVE-2021-24917 | High | 7.5 | 2021-12-06 | The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to… |
CVE-2021-24914 | High | 8.0 | 2021-12-06 | The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, avai… |
CVE-2021-24866 | Critical | 9.8 | 2021-12-06 | The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a… |
CVE-2021-24759 | Medium | 5.4 | 2021-12-06 | The PDF.js Viewer WordPress plugin before 2.0.2 does not escape some of its shortcode and Gutenberg Block attributes, which could allow users with a role as lo… |
CVE-2021-24718 | Medium | 4.8 | 2021-12-06 | The Contact Form, Survey & Popup Form Plugin for WordPress plugin before 1.5 does not properly sanitize some of its settings allowing high privilege users to p… |
CVE-2021-24714 | Medium | 4.8 | 2021-12-06 | The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin… |
CVE-2021-43471 | High | 7.5 | 2021-12-06 | In Canon LBP223 printers, the System Manager Mode login does not require an account password or PIN. An attacker can remotely shut down the device after enteri… |
CVE-2021-4069 | High | 7.8 | 2021-12-06 | vim is vulnerable to Use After Free |
CVE-2021-43469 | High | 8.8 | 2021-12-06 | VINGA WR-N300U 77.102.1.4853 is affected by a command execution vulnerability in the goahead component. |
CVE-2021-43044 | Critical | 9.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The SNMP daemon was configured with a weak default community. |
CVE-2021-43043 | Medium | 6.5 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecu… |
CVE-2021-43042 | Critical | 9.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A buffer overflow existed in the vaultServer component. This was exploitable by a r… |
CVE-2021-43041 | High | 8.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A crafted HTTP request could induce a format string vulnerability in the privileged… |
CVE-2021-43040 | High | 8.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The privileged vaultServer could be leveraged to create arbitrary writable files, l… |
CVE-2021-43039 | Medium | 6.5 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The Samba file sharing service allowed anonymous read/write access. |
CVE-2021-43038 | High | 8.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The wguest account could execute commands by injecting into PostgreSQL trigger func… |
CVE-2021-43037 | High | 7.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The Unitrends Windows agent was vulnerable to DLL injection and binary planting due… |
CVE-2021-43036 | Critical | 9.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The password for the PostgreSQL wguest account is weak. |
CVE-2021-43035 | Critical | 9.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Two unauthenticated SQL injection vulnerabilities were discovered, allowing arbitra… |
CVE-2021-43034 | High | 7.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A world writable file allowed local users to execute arbitrary code as the user apa… |
CVE-2021-43033 | Critical | 9.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Multiple functions in the bpserverd daemon were vulnerable to arbitrary remote code… |
CVE-2021-44048 | High | 7.8 | 2021-12-05 | An out-of-bounds write vulnerability exists when reading a TIF file using Open Design Alliance (ODA) Drawings Explorer before 2022.11. The specific issue exist… |
CVE-2021-44047 | High | 7.8 | 2021-12-05 | A use-after-free vulnerability exists when reading a DWF/DWFX file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists with parsi… |
CVE-2021-44046 | High | 7.8 | 2021-12-05 | An out-of-bounds write vulnerability exists when reading U3D files in Open Design Alliance PRC SDK before 2022.11. An unchecked return value of a function (ver… |
CVE-2021-44045 | High | 7.8 | 2021-12-05 | An out-of-bounds write vulnerability exists when reading a DGN file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within th… |
CVE-2021-44044 | High | 7.8 | 2021-12-05 | An out-of-bounds write vulnerability exists when reading a JPG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists with pars… |
CVE-2021-37253 | High | 7.5 | 2021-12-05 | M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers). NOTE: this is… |
CVE-2021-4005 | Medium | 4.3 | 2021-12-04 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-43415 | High | 8.8 | 2021-12-03 | HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabil… |
CVE-2021-35415 | Medium | 4.8 | 2021-12-03 | A stored cross-site scripting (XSS) vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the course "Title" and "Co… |
CVE-2021-35414 | Critical | 9.8 | 2021-12-03 | Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php. |
CVE-2021-35413 | High | 8.8 | 2021-12-03 | A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute arbitrary code via… |