2021 CVEs (page 82)
Page 82 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-44349 | Critical | 9.8 | 2021-12-03 | SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameter in App\Manage\Controller\DownloadController.class.php. |
CVE-2021-44348 | Critical | 9.8 | 2021-12-03 | SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameer in App\Manage\Controller\AdvertController.class.php. |
CVE-2021-35346 | Critical | 9.8 | 2021-12-03 | tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function HevcSpsUnit::short_term_ref_pic_set(int) in hevc.cpp. |
CVE-2021-35344 | Critical | 9.8 | 2021-12-03 | tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function BitStreamReader::getCurVal in bitStream.h. |
CVE-2021-23758 | High | 8.1 | 2021-12-03 | All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, whic… |
CVE-2021-23562 | Medium | 4.2 | 2021-12-03 | This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upl… |
CVE-2021-44352 | Critical | 9.8 | 2021-12-03 | A Stack-based Buffer Overflow vulnerability exists in the Tenda AC15 V15.03.05.18_multi device via the list parameter in a post request in goform/SetIpMacBind. |
CVE-2021-44347 | Critical | 9.8 | 2021-12-03 | SQL Injection vulnerability exists in TuziCMS v2.0.6 in App\Manage\Controller\GuestbookController.class.php. |
CVE-2021-38909 | Medium | 5.4 | 2021-12-03 | IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2021-29867 | Medium | 5.4 | 2021-12-03 | IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated to view or edit a Jupyter notebook that they should not have access to. IBM X-Force ID: 206… |
CVE-2021-29756 | High | 8.8 | 2021-12-03 | IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attacker to execute malicio… |
CVE-2021-29719 | Medium | 5.3 | 2021-12-03 | IBM Cognos Analytics 11.1.7 and 11.2.0 could be vulnerable to client side vulnerabilties due to a web response specifying an incorrect content type. IBM X-Forc… |
CVE-2021-29716 | Medium | 6.5 | 2021-12-03 | IBM Cognos Analytics 11.1.7 and 11.2.0 could allow a low level user to reas of the application that privileged user should only be allowed to view. IBM X-Force… |
CVE-2021-20493 | Medium | 6.1 | 2021-12-03 | IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2021-20470 | High | 7.5 | 2021-12-03 | IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise u… |
CVE-2021-43991 | Medium | 6.8 | 2021-12-03 | The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order X… |
CVE-2021-3980 | High | 7.5 | 2021-12-03 | elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor |
CVE-2021-43676 | Critical | 9.8 | 2021-12-03 | matyhtf framework v3.0.5 is affected by a path manipulation vulnerability in Smarty.class.php. |
CVE-2021-44278 | Critical | 9.8 | 2021-12-03 | Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php. |
CVE-2021-43674 | Critical | 9.8 | 2021-12-03 | ThinkUp 2.0-beta.10 is affected by a path manipulation vulnerability in Smarty.class.php. NOTE: This vulnerability only affects products that are no longer sup… |
CVE-2021-43673 | Medium | 6.1 | 2021-12-03 | dzzoffice 2.02.1_SC_UTF8 is affected by a Cross Site Scripting (XSS) vulnerability in explorerfile.php. The output of the exit function is printed for the user… |
CVE-2021-4000 | Medium | 6.1 | 2021-12-03 | showdoc is vulnerable to URL Redirection to Untrusted Site |
CVE-2021-44022 | Medium | 5.5 | 2021-12-03 | A reachable assertion vulnerability in Trend Micro Apex One could allow an attacker to crash the program on affected installations, leading to a denial-of-serv… |
CVE-2021-44021 | High | 7.8 | 2021-12-03 | An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected ins… |
CVE-2021-44020 | High | 7.8 | 2021-12-03 | An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected ins… |
CVE-2021-44019 | High | 7.8 | 2021-12-03 | An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected ins… |
CVE-2021-43772 | Medium | 5.5 | 2021-12-03 | Trend Micro Security 2021 v17.0 (Consumer) contains a vulnerability that allows files inside the protected folder to be modified without any detection. |
CVE-2021-25785 | Medium | 4.8 | 2021-12-02 | Taocms v2.5Beta5 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Management column. |
CVE-2021-25784 | High | 7.2 | 2021-12-02 | Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Edit Article. |
CVE-2021-25783 | High | 7.2 | 2021-12-02 | Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Article Search. |
CVE-2021-28237 | Critical | 9.8 | 2021-12-02 | LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13. |
CVE-2021-28236 | High | 7.5 | 2021-12-02 | LibreDWG v0.12.3 was discovered to contain a NULL pointer dereference via out_dxfb.c. |
CVE-2021-43327 | Medium | 4.6 | 2021-12-02 | An issue was discovered on Renesas RX65 and RX65N devices. With a VCC glitch, an attacker can extract the security ID key from the device. Then, the protected… |
CVE-2021-44050 | Medium | 6.5 | 2021-12-02 | CA Network Flow Analysis (NFA) 21.2.1 and earlier contain a SQL injection vulnerability in the NFA web application, due to insufficient input validation, that… |
CVE-2021-40334 | High | 8.6 | 2021-12-02 | Missing Handler vulnerability in the proprietary management protocol (port TCP 5558) of Hitachi Energy FOX61x, XCM20 allows an attacker that exploits the vulne… |
CVE-2021-40333 | Critical | 9.0 | 2021-12-02 | Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access to the Data Communication Network (DCN)… |
CVE-2021-43795 | High | 7.5 | 2021-12-02 | Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted direc… |
CVE-2021-44518 | Medium | 6.8 | 2021-12-02 | An issue was discovered in the eGeeTouch 3rd Generation Travel Padlock application for Android. The lock sends a pairing code before each operation (lock or un… |
CVE-2021-3944 | Medium | 6.8 | 2021-12-02 | bookstack is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-23264 | High | 8.1 | 2021-12-02 | Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes. |
CVE-2021-23263 | Medium | 5.9 | 2021-12-02 | Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary). |
CVE-2021-23262 | Medium | 4.2 | 2021-12-02 | Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE. |
CVE-2021-23261 | Medium | 4.5 | 2021-12-02 | Authenticated administrators may override the system configuration file and cause a denial of service. |
CVE-2021-23260 | Medium | 6.5 | 2021-12-02 | Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site. |
CVE-2021-23259 | Medium | 4.2 | 2021-12-02 | Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script… |
CVE-2021-23258 | Medium | 4.2 | 2021-12-02 | Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security re… |
CVE-2021-43679 | Critical | 9.8 | 2021-12-02 | ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php. |
CVE-2021-43682 | Medium | 6.1 | 2021-12-02 | thinkphp-bjyblog (last update Jun 4 2021) is affected by a Cross Site Scripting (XSS) vulnerability in AdminBaseController.class.php. The exit function termina… |
CVE-2021-43686 | Medium | 6.1 | 2021-12-02 | nZEDb v0.4.20 is affected by a Cross Site Scripting (XSS) vulnerability in www/pages/api.php. The exit function will terminate the script and print the message… |
CVE-2021-43683 | Medium | 6.1 | 2021-12-02 | pictshare v1.5 is affected by a Cross Site Scripting (XSS) vulnerability in api/info.php. The exit function will terminate the script and print the message whi… |
CVE-2021-43681 | Medium | 6.1 | 2021-12-02 | SakuraPanel v1.0.1.1 is affected by a Cross Site Scripting (XSS) vulnerability in /master/core/PostHandler.php. The exit function will terminate the script and… |
CVE-2021-26777 | Critical | 9.8 | 2021-12-02 | Buffer overflow vulnerability in function SetFirewall in index.cgi in CIRCUTOR COMPACT DC-S BASIC smart metering concentrator Firwmare version CIR_CDC_v1.2.17… |
CVE-2021-44227 | High | 8.8 | 2021-12-02 | In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make… |
CVE-2021-43791 | Medium | 6.5 | 2021-12-02 | Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmat… |
CVE-2021-42711 | High | 7.8 | 2021-12-01 | Barracuda Network Access Client before 5.2.2 creates a Temporary File in a Directory with Insecure Permissions. This file is executed with SYSTEM privileges wh… |
CVE-2021-33274 | Critical | 9.8 | 2021-12-01 | D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FU… |
CVE-2021-33271 | Critical | 9.8 | 2021-12-01 | D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function su… |
CVE-2021-33270 | Critical | 9.8 | 2021-12-01 | D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FU… |
CVE-2021-33269 | Critical | 9.8 | 2021-12-01 | D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FU… |
CVE-2021-33268 | Critical | 9.8 | 2021-12-01 | D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function su… |
CVE-2021-33267 | Critical | 9.8 | 2021-12-01 | D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FU… |
CVE-2021-33266 | Critical | 9.8 | 2021-12-01 | D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FU… |
CVE-2021-33265 | Critical | 9.8 | 2021-12-01 | D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FU… |
CVE-2021-43794 | Medium | 5.3 | 2021-12-01 | Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the… |
CVE-2021-43793 | Medium | 4.3 | 2021-12-01 | Discourse is an open source discussion platform. In affected versions a vulnerability in the Polls feature allowed users to vote multiple times in a single-opt… |
CVE-2021-43792 | Medium | 4.3 | 2021-12-01 | Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who use the "Tags are visible only to the fol… |
CVE-2021-43137 | High | 8.8 | 2021-12-01 | Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exits in hostel management system 2.1 via the name field in my-profile.php. Chai… |
CVE-2021-41039 | High | 7.5 | 2021-12-01 | In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number of user-property properties could cause excessive CPU usage, l… |
CVE-2021-43451 | Critical | 9.8 | 2021-12-01 | SQL Injection vulnerability exists in PHPGURUKUL Employee Record Management System 1.2 via the Email POST parameter in /forgetpassword.php. |
CVE-2021-38575 | High | 8.1 | 2021-12-01 | NetworkPkg/IScsiDxe has remotely exploitable buffer overflows. |
CVE-2021-42776 | High | 7.7 | 2021-12-01 | CloverDX Server before 5.11.2 and and 5.12.x before 5.12.1 allows XXE during configuration import. |
CVE-2021-29863 | Medium | 4.3 | 2021-12-01 | IBM QRadar SIEM 7.3 and 7.4 is vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from th… |
CVE-2021-29849 | Medium | 6.1 | 2021-12-01 | IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri… |
CVE-2021-29779 | Medium | 5.9 | 2021-12-01 | IBM QRadar SIEM 7.3 and 7.4 could allow an attacker to obtain sensitive information due to the server performing key exchange without entity authentication on… |
CVE-2021-20400 | High | 7.5 | 2021-12-01 | IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Forc… |
CVE-2021-44480 | High | 8.1 | 2021-12-01 | Wokka Lokka Q50 devices through 2021-11-30 allow remote attackers (who know the SIM phone number and password) to listen to a device's surroundings via a callb… |
CVE-2021-43687 | Medium | 6.1 | 2021-12-01 | chamilo-lms v1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php if an attacker passes a message hex2bin in the co… |
CVE-2021-43685 | Critical | 9.8 | 2021-12-01 | libretime hv3.0.0-alpha.10 is affected by a path manipulation vulnerability in /blob/master/legacy/application/modules/rest/controllers/ShowImageController.php… |
CVE-2021-26334 | Critical | 9.9 | 2021-12-01 | The AMDPowerProfiler.sys driver of AMD μProf tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 c… |
CVE-2021-20611 | High | 7.5 | 2021-12-01 | Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EN)CPU, MELSEC iQ-R Series… |
CVE-2021-20610 | High | 7.5 | 2021-12-01 | Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(E… |
CVE-2021-20609 | High | 7.5 | 2021-12-01 | Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EN)CPU, MELSEC iQ-R… |
CVE-2021-44479 | Medium | 6.1 | 2021-12-01 | NXP Kinetis K82 devices have a buffer over-read via a crafted wlength value in a GET Status-Other request during use of USB In-System Programming (ISP) mode. T… |
CVE-2021-43689 | Medium | 6.1 | 2021-12-01 | manage (last update Oct 24, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in Application/Home/Controller/GoodsController.class.php. The exit… |
CVE-2021-40154 | Medium | 6.1 | 2021-12-01 | NXP LPC55S69 devices before A3 have a buffer over-read via a crafted wlength value in a GET Descriptor Configuration request during use of USB In-System Progra… |
CVE-2021-44279 | Medium | 6.1 | 2021-12-01 | Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/forms/poller-groups.inc.php. |
CVE-2021-44277 | Medium | 6.1 | 2021-12-01 | Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/common/alert-log.inc.php. |
CVE-2021-25967 | Medium | 5.4 | 2021-12-01 | In CKAN, versions 2.9.0 to 2.9.3 are affected by a stored XSS vulnerability via SVG file upload of users’ profile picture. This allows low privileged applicati… |
CVE-2021-44280 | Critical | 9.8 | 2021-12-01 | attendance management system 1.0 is affected by a SQL injection vulnerability in admin/incFunctions.php through the makeSafe function. |
CVE-2021-43690 | Medium | 6.1 | 2021-12-01 | YurunProxy v0.01 is affected by a Cross Site Scripting (XSS) vulnerability in src/Client.php. The exit function will terminate the script and print a message w… |
CVE-2021-3983 | Medium | 6.1 | 2021-12-01 | kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3964 | Medium | 5.9 | 2021-12-01 | elgg is vulnerable to Authorization Bypass Through User-Controlled Key |
CVE-2021-32592 | High | 7.8 | 2021-12-01 | An unsafe search path vulnerability in FortiClientWindows 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x and FortiClientEMS 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x may allo… |
CVE-2021-4017 | High | 8.8 | 2021-12-01 | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-4015 | Medium | 4.3 | 2021-12-01 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3994 | Critical | 9.6 | 2021-12-01 | django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3993 | Medium | 6.5 | 2021-12-01 | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3992 | Medium | 6.5 | 2021-12-01 | kimai2 is vulnerable to Improper Access Control |
CVE-2021-3990 | Medium | 6.5 | 2021-12-01 | showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) |
CVE-2021-3989 | Medium | 6.1 | 2021-12-01 | showdoc is vulnerable to URL Redirection to Untrusted Site |