2021 CVEs (page 83)
Page 83 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-3985 | Critical | 9.0 | 2021-12-01 | kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3984 | High | 7.8 | 2021-12-01 | vim is vulnerable to Heap-based Buffer Overflow |
CVE-2021-4019 | High | 7.8 | 2021-12-01 | vim is vulnerable to Heap-based Buffer Overflow |
CVE-2021-4018 | Medium | 5.4 | 2021-12-01 | snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-34599 | High | 7.4 | 2021-12-01 | Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes. CODESYS Git does not implement certificate vali… |
CVE-2021-20864 | High | 8.8 | 2021-12-01 | Improper access control vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware… |
CVE-2021-20863 | High | 8.0 | 2021-12-01 | OS command injection vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1… |
CVE-2021-20862 | Medium | 4.3 | 2021-12-01 | Improper access control vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware… |
CVE-2021-20861 | High | 8.8 | 2021-12-01 | Improper access control vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmw… |
CVE-2021-20860 | High | 8.8 | 2021-12-01 | Cross-site request forgery (CSRF) vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167G… |
CVE-2021-20859 | High | 8.0 | 2021-12-01 | ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmwa… |
CVE-2021-20858 | Medium | 5.4 | 2021-12-01 | Cross-site scripting vulnerability in ELECOM LAN router WRC-2533GHBK-I firmware v1.20 and prior allows a remote authenticated attacker to inject an arbitrary s… |
CVE-2021-20857 | Medium | 5.4 | 2021-12-01 | Cross-site scripting vulnerability in ELECOM LAN router WRC-2533GHBK-I firmware v1.20 and prior allows a remote authenticated attacker to inject an arbitrary s… |
CVE-2021-20856 | Medium | 5.4 | 2021-12-01 | Cross-site scripting vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a remote auth… |
CVE-2021-20855 | Medium | 5.4 | 2021-12-01 | Cross-site scripting vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a remote auth… |
CVE-2021-20854 | Medium | 6.8 | 2021-12-01 | ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker with an administrator p… |
CVE-2021-20853 | Medium | 6.8 | 2021-12-01 | ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker with an administrator p… |
CVE-2021-20852 | Medium | 6.8 | 2021-12-01 | Buffer overflow vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent… |
CVE-2021-20851 | High | 8.8 | 2021-12-01 | Cross-site request forgery (CSRF) vulnerability in Browser and Operating System Finder versions prior to 1.2 allows a remote unauthenticated attacker to hijack… |
CVE-2021-20847 | Medium | 6.1 | 2021-12-01 | Cross-site scripting vulnerability in Wi-Fi STATION SH-52A (38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and… |
CVE-2021-43360 | High | 8.8 | 2021-12-01 | Sunnet eHRD e-mail delivery task schedule’s serialization function has inadequate input object validation and restriction, which allows a post-authenticated re… |
CVE-2021-43359 | High | 8.8 | 2021-12-01 | Sunnet eHRD has broken access control vulnerability, which allows a remote attacker to access account management page after being authenticated as a general us… |
CVE-2021-43358 | High | 7.5 | 2021-12-01 | Sunnet eHRD has inadequate filtering for special characters in URLs, which allows a remote attacker to perform path traversal attacks without authentication, a… |
CVE-2021-40809 | High | 8.8 | 2021-12-01 | An issue was discovered in Jamf Pro before 10.32.0, aka PI-009921. An account can be granted incorrect privileges in response to authentication that uses speci… |
CVE-2021-41256 | Medium | 5.8 | 2021-11-30 | nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issu… |
CVE-2021-36330 | High | 8.1 | 2021-11-30 | Dell EMC Streaming Data Platform versions before 1.3 contain an Insufficient Session Expiration Vulnerability. A remote unauthenticated attacker may potentiall… |
CVE-2021-36329 | Medium | 6.5 | 2021-11-30 | Dell EMC Streaming Data Platform versions before 1.3 contain an Indirect Object Reference Vulnerability. A remote malicious user may potentially exploit this v… |
CVE-2021-36328 | High | 8.8 | 2021-11-30 | Dell EMC Streaming Data Platform versions before 1.3 contain a SQL Injection Vulnerability. A remote malicious user may potentially exploit this vulnerability… |
CVE-2021-36327 | Medium | 5.3 | 2021-11-30 | Dell EMC Streaming Data Platform versions before 1.3 contain a Server Side Request Forgery Vulnerability. A remote unauthenticated attacker may potentially exp… |
CVE-2021-36326 | Medium | 6.5 | 2021-11-30 | Dell EMC Streaming Data Platform, versions prior to 1.3 contain an SSL Strip Vulnerability in the User Interface (UI). A remote unauthenticated attacker could… |
CVE-2021-4026 | Medium | 4.3 | 2021-11-30 | bookstack is vulnerable to Improper Access Control |
CVE-2021-42564 | Medium | 5.4 | 2021-11-30 | An open redirect through HTML injection in confidential messages in Cryptshare before 5.1.0 allows remote attackers (with permission to provide confidential me… |
CVE-2021-40101 | High | 7.2 | 2021-11-30 | An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be changed without a prompt for the current password. |
CVE-2021-31787 | Medium | 6.5 | 2021-11-30 | The Bluetooth Classic implementation on Actions ATS2815 chipsets does not properly handle the reception of continuous unsolicited LMP responses, allowing attac… |
CVE-2021-44230 | Medium | 6.5 | 2021-11-30 | PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead to privilege escal… |
CVE-2021-43319 | Critical | 9.8 | 2021-11-30 | Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality. |
CVE-2021-43296 | High | 7.5 | 2021-11-30 | Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor. |
CVE-2021-43295 | Medium | 6.1 | 2021-11-30 | Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module. |
CVE-2021-43294 | Medium | 6.1 | 2021-11-30 | Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module. |
CVE-2021-43284 | High | 7.8 | 2021-11-30 | An issue was discovered on Victure WR1200 devices through 1.0.3. The root SSH password never gets updated from its default value of admin. This enables an atta… |
CVE-2021-43283 | High | 8.8 | 2021-11-30 | An issue was discovered on Victure WR1200 devices through 1.0.3. A command injection vulnerability was found within the web interface of the device, allowing a… |
CVE-2021-43282 | Medium | 6.5 | 2021-11-30 | An issue was discovered on Victure WR1200 devices through 1.0.3. The default Wi-Fi WPA2 key is advertised to anyone within Wi-Fi range through the router's MAC… |
CVE-2021-42099 | Critical | 9.8 | 2021-11-30 | Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution. |
CVE-2021-26612 | High | 8.1 | 2021-11-30 | An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy method to execute… |
CVE-2021-22095 | Medium | 6.5 | 2021-11-30 | In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the m… |
CVE-2021-39000 | Medium | 5.5 | 2021-11-30 | IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagnostics. IBM X-Force… |
CVE-2021-38999 | Medium | 5.5 | 2021-11-30 | IBM MQ Appliance could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace. |
CVE-2021-38967 | Medium | 6.7 | 2021-11-30 | IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local privileged user to inject and execute malicious code. IBM X-Force ID: 212441. |
CVE-2021-38958 | Medium | 5.5 | 2021-11-30 | IBM MQ Appliance 9.2 CD and 9.2 LTS is affected by a denial of service attack caused by a concurrency issue. IBM X-Force ID: 212042 |
CVE-2021-43202 | Critical | 9.8 | 2021-11-30 | In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases. |
CVE-2021-43998 | Medium | 6.5 | 2021-11-30 | HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity a… |
CVE-2021-41679 | Critical | 9.8 | 2021-11-30 | A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL co… |
CVE-2021-41678 | Critical | 9.8 | 2021-11-30 | A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL co… |
CVE-2021-25987 | Medium | 5.0 | 2021-11-30 | Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Loca… |
CVE-2021-41677 | Critical | 9.8 | 2021-11-30 | A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL co… |
CVE-2021-43771 | High | 7.8 | 2021-11-30 | Trend Micro Antivirus for Mac 2021 v11 (Consumer) is vulnerable to an improper access control privilege escalation vulnerability that could allow an attacker t… |
CVE-2021-42545 | High | 8.1 | 2021-11-30 | An insufficient session expiration vulnerability exists in Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27, which allows a remote attacker to… |
CVE-2021-42544 | High | 7.5 | 2021-11-30 | Missing Rate Limiting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on the Login Form allows an unauthenti… |
CVE-2021-42123 | High | 7.3 | 2021-11-30 | Unrestricted File Upload in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 in the File Upload Functions allows… |
CVE-2021-42122 | Medium | 4.3 | 2021-11-30 | Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s attributes with… |
CVE-2021-42121 | Medium | 4.3 | 2021-11-30 | Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s date attribute(… |
CVE-2021-42120 | Medium | 6.5 | 2021-11-30 | Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on all object attributes allow… |
CVE-2021-42119 | High | 7.3 | 2021-11-30 | Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Search Functionality… |
CVE-2021-42118 | High | 8.1 | 2021-11-30 | Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Structure Component… |
CVE-2021-42117 | Low | 3.5 | 2021-11-30 | Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote… |
CVE-2021-42116 | Medium | 4.3 | 2021-11-30 | Incorrect Access Control in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote atta… |
CVE-2021-42115 | High | 8.1 | 2021-11-30 | Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attac… |
CVE-2021-3769 | High | 7.5 | 2021-11-30 | # Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied strings to print them… |
CVE-2021-3727 | High | 7.5 | 2021-11-30 | # Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn re… |
CVE-2021-3726 | High | 7.5 | 2021-11-30 | # Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-sup… |
CVE-2021-3725 | High | 7.5 | 2021-11-30 | Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, us… |
CVE-2021-43790 | High | 8.5 | 2021-11-30 | Lucet is a native WebAssembly compiler and runtime. There is a bug in the main branch of `lucet-runtime` affecting all versions published to crates.io that all… |
CVE-2021-44429 | High | 7.5 | 2021-11-29 | Serva 4.4.0 allows remote attackers to cause a denial of service (daemon crash) via a TFTP read (RRQ) request, aka opcode 1, a related issue to CVE-2013-0145. |
CVE-2021-44428 | High | 7.5 | 2021-11-29 | Pinkie 2.15 allows remote attackers to cause a denial of service (daemon crash) via a TFTP read (RRQ) request, aka opcode 1. |
CVE-2021-44427 | Critical | 9.8 | 2021-11-29 | An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQ… |
CVE-2021-43788 | Medium | 5.0 | 2021-11-29 | Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files out… |
CVE-2021-43787 | Critical | 9.0 | 2021-11-29 | Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user… |
CVE-2021-43786 | Critical | 9.8 | 2021-11-29 | Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed mast… |
CVE-2021-43783 | High | 8.5 | 2021-11-29 | @backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write access to a… |
CVE-2021-34800 | High | 7.5 | 2021-11-29 | Sensitive information could be logged. The following products are affected: Acronis Agent (Windows, Linux, macOS) before build 27147 |
CVE-2021-44203 | Medium | 5.4 | 2021-11-29 | Stored cross-site scripting (XSS) was possible in protection plan details. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) befor… |
CVE-2021-44202 | Medium | 5.4 | 2021-11-29 | Stored cross-site scripting (XSS) was possible in activity details. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build… |
CVE-2021-44201 | Medium | 6.1 | 2021-11-29 | Cross-site scripting (XSS) was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28… |
CVE-2021-44200 | Medium | 5.4 | 2021-11-29 | Self cross-site scripting (XSS) was possible on devices page. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035 |
CVE-2021-44199 | Medium | 5.5 | 2021-11-29 | DLL hijacking could lead to denial of service. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windo… |
CVE-2021-44198 | High | 7.8 | 2021-11-29 | DLL hijacking could lead to local privilege escalation. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035 |
CVE-2021-42365 | Medium | 4.8 | 2021-11-29 | The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the ~/admin/table… |
CVE-2021-42364 | High | 8.8 | 2021-11-29 | The Stetic WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the stats_page function found in the ~/stetic.php f… |
CVE-2021-42358 | High | 8.8 | 2021-11-29 | The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the ~/cfwc-form.php file during c… |
CVE-2021-43691 | Critical | 9.8 | 2021-11-29 | tripexpress v1.1 is affected by a path manipulation vulnerability in file system/helpers/dompdf/load_font.php. The variable src is coming from $_SERVER["argv"]… |
CVE-2021-3802 | Medium | 4.2 | 2021-11-29 | A vulnerability found in udisks2. This flaw allows an attacker to input a specially crafted image file/USB leading to kernel panic. The highest threat from thi… |
CVE-2021-39995 | Medium | 6.5 | 2021-11-29 | Some Huawei products use the OpenHpi software for hardware management. A function that parses data returned by OpenHpi contains an out-of-bounds read vulnerabi… |
CVE-2021-43693 | Critical | 9.8 | 2021-11-29 | vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php. |
CVE-2021-43692 | Medium | 6.1 | 2021-11-29 | youtube-php-mirroring (last update Jun 9, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in file ytproxy/index.php. |
CVE-2021-43695 | Medium | 6.1 | 2021-11-29 | issabelPBX version 2.11 is affected by a Cross Site Scripting (XSS) vulnerability. In file page.backup_restore.php, the exit function will terminate the script… |
CVE-2021-43697 | Medium | 6.1 | 2021-11-29 | Workerman-ThinkPHP-Redis (last update Mar 16, 2018) is affected by a Cross Site Scripting (XSS) vulnerability. In file Controller.class.php, the exit function… |
CVE-2021-43696 | Medium | 6.1 | 2021-11-29 | twmap v2.91_v4.33 is affected by a Cross Site Scripting (XSS) vulnerability. In file list.php, the exit function will terminate the script and print the messag… |
CVE-2021-43698 | Medium | 6.1 | 2021-11-29 | phpWhois (last update Jun 30 2021) is affected by a Cross Site Scripting (XSS) vulnerability. In file example.php, the exit function will terminate the script… |
CVE-2021-24927 | Medium | 5.4 | 2021-11-29 | The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenti… |
CVE-2021-24918 | Medium | 5.4 | 2021-11-29 | The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result… |