2021 CVEs (page 85)
Page 85 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-41281 | High | 7.5 | 2021-11-23 | Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tr… |
CVE-2021-38980 | Medium | 5.3 | 2021-11-23 | IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive infor… |
CVE-2021-38891 | High | 7.5 | 2021-11-23 | IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiv… |
CVE-2021-38890 | High | 7.5 | 2021-11-23 | IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account crede… |
CVE-2021-38875 | Medium | 6.5 | 2021-11-23 | IBM MQ 8.0, 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.1 CD, and 9.2 CD is vulnerable to a denial of service attack caused by an error processing messages. IBM X-Force ID: 2… |
CVE-2021-36335 | Medium | 4.3 | 2021-11-23 | Dell EMC CloudLink 7.1 and all prior versions contain an Improper Input Validation Vulnerability. A remote low privileged attacker, may potentially exploit thi… |
CVE-2021-36334 | Medium | 5.9 | 2021-11-23 | Dell EMC CloudLink 7.1 and all prior versions contain a CSV formula Injection Vulnerability. A remote high privileged attacker, may potentially exploit this vu… |
CVE-2021-36333 | Medium | 5.5 | 2021-11-23 | Dell EMC CloudLink 7.1 and all prior versions contain a Buffer Overflow Vulnerability. A local low privileged attacker, may potentially exploit this vulnerabil… |
CVE-2021-36332 | Medium | 5.4 | 2021-11-23 | Dell EMC CloudLink 7.1 and all prior versions contain a HTML and Javascript Injection Vulnerability. A remote low privileged attacker, may potentially exploit… |
CVE-2021-36314 | High | 7.1 | 2021-11-23 | Dell EMC CloudLink 7.1 and all prior versions contain an Arbitrary File Creation Vulnerability. A remote unauthenticated attacker, may potentially exploit this… |
CVE-2021-36313 | Critical | 9.1 | 2021-11-23 | Dell EMC CloudLink 7.1 and all prior versions contain an OS command injection Vulnerability. A remote high privileged attacker, may potentially exploit this vu… |
CVE-2021-36312 | Critical | 9.1 | 2021-11-23 | Dell EMC CloudLink 7.1 and all prior versions contain a Hard-coded Password Vulnerability. A remote high privileged attacker, with the knowledge of the hard-co… |
CVE-2021-36311 | Medium | 6.0 | 2021-11-23 | Dell EMC Networker versions prior to 19.5 contain an Improper Authorization vulnerability. Any local malicious user with networker user privileges may exploit… |
CVE-2021-36301 | Medium | 5.9 | 2021-11-23 | Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm. An authenticated remote attacker ma… |
CVE-2021-36300 | Medium | 6.5 | 2021-11-23 | iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnera… |
CVE-2021-36299 | High | 7.1 | 2021-11-23 | Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. A remote authenticated malicious user… |
CVE-2021-31852 | Medium | 6.1 | 2021-11-23 | A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script… |
CVE-2021-31851 | Medium | 6.1 | 2021-11-23 | A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script… |
CVE-2021-25986 | Medium | 5.4 | 2021-11-23 | In Django-wiki, versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting (XSS) in Notifications Section. An attacker who has access to edit pages… |
CVE-2021-24894 | Medium | 6.5 | 2021-11-23 | The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the… |
CVE-2021-24892 | High | 8.8 | 2021-11-23 | Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's e… |
CVE-2021-24891 | Medium | 6.1 | 2021-11-23 | The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM… |
CVE-2021-24888 | Medium | 4.8 | 2021-11-23 | The ImageBoss WordPress plugin before 3.0.6 does not sanitise and escape its Source Name setting, which could allow high privilege users to perform Cross-Site… |
CVE-2021-24882 | Medium | 4.8 | 2021-11-23 | The Slideshow Gallery WordPress plugin before 1.7.4 does not sanitise and escape the Slide "Title", "Description", and Gallery "Title" fields, which could allo… |
CVE-2021-24877 | High | 7.2 | 2021-11-23 | The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL inject… |
CVE-2021-24875 | Medium | 6.1 | 2021-11-23 | The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page… |
CVE-2021-24873 | Medium | 6.1 | 2021-11-23 | The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, lea… |
CVE-2021-24830 | Medium | 4.8 | 2021-11-23 | The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them, allowing high privilege users to perform C… |
CVE-2021-24812 | Medium | 5.4 | 2021-11-23 | The BetterLinks WordPress plugin before 1.2.6 does not sanitise and escape some of imported link fields, which could lead to Stored Cross-Site Scripting issues… |
CVE-2021-24729 | Medium | 5.4 | 2021-11-23 | The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to… |
CVE-2021-24713 | Medium | 4.8 | 2021-11-23 | The Video Lessons Manager WordPress plugin before 1.7.2 and Video Lessons Manager Pro WordPress plugin before 3.5.9 do not properly sanitize and escape values… |
CVE-2021-24703 | Medium | 5.7 | 2021-11-23 | The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated… |
CVE-2021-24700 | Medium | 4.8 | 2021-11-23 | The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high privilege users to perform Cross-Site… |
CVE-2021-24668 | Medium | 4.3 | 2021-11-23 | The MAZ Loader WordPress plugin before 1.4.1 does not enforce nonce checks, which allows attackers to make administrators delete arbitrary loaders via a CSRF a… |
CVE-2021-24644 | High | 7.5 | 2021-11-23 | The Images to WebP WordPress plugin before 1.9 does not validate or sanitise the tab parameter before passing it to the include() function, which could lead to… |
CVE-2021-24641 | High | 8.1 | 2021-11-23 | The Images to WebP WordPress plugin before 1.9 does not have CSRF checks in place when performing some administrative actions, which could result in modificati… |
CVE-2021-21561 | High | 7.8 | 2021-11-23 | Dell PowerScale OneFS version 8.1.2 contains a sensitive information exposure vulnerability. This would allow a malicious user with ISI_PRIV_LOGIN_SSH and/or I… |
CVE-2021-43019 | High | 7.8 | 2021-11-23 | Adobe Creative Cloud version 5.5 (and earlier) are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An una… |
CVE-2021-3672 | Medium | 5.6 | 2021-11-23 | A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong host… |
CVE-2021-37102 | High | 8.8 | 2021-11-23 | There is a command injection vulnerability in CMA service module of FusionCompute product when processing the default certificate file. The software constructs… |
CVE-2021-37035 | High | 7.5 | 2021-11-23 | There is a Remote DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the app to exit unexpectedly. |
CVE-2021-37034 | High | 7.5 | 2021-11-23 | There is an Unstandardized field names in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-37033 | High | 7.5 | 2021-11-23 | There is an Injection attack vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability. |
CVE-2021-37032 | Medium | 5.3 | 2021-11-23 | There is a Bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause Digital Balance to fail to work. |
CVE-2021-37031 | High | 7.5 | 2021-11-23 | There is a Remote DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the app to exit unexpectedly. |
CVE-2021-37030 | High | 7.5 | 2021-11-23 | There is an Improper permission vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability. |
CVE-2021-37029 | Medium | 5.3 | 2021-11-23 | There is an Identity verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability. |
CVE-2021-37026 | High | 7.5 | 2021-11-23 | There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash. |
CVE-2021-37025 | High | 7.5 | 2021-11-23 | There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash. |
CVE-2021-37024 | High | 7.5 | 2021-11-23 | There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash. |
CVE-2021-37023 | Medium | 6.5 | 2021-11-23 | There is a Improper Access Control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause media files which can be reads a… |
CVE-2021-37022 | Critical | 9.8 | 2021-11-23 | There is a Heap-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause root permission which can be… |
CVE-2021-37019 | High | 7.5 | 2021-11-23 | There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash. |
CVE-2021-37018 | High | 7.5 | 2021-11-23 | There is a Data Processing Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash. |
CVE-2021-37017 | High | 7.5 | 2021-11-23 | There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash. |
CVE-2021-37016 | Critical | 9.1 | 2021-11-23 | There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause Information Disclosure or Denial of S… |
CVE-2021-37015 | High | 7.5 | 2021-11-23 | There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash. |
CVE-2021-37013 | Medium | 5.3 | 2021-11-23 | There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the availability of users is a… |
CVE-2021-37012 | High | 7.5 | 2021-11-23 | There is a Data Processing Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash. |
CVE-2021-37010 | High | 7.5 | 2021-11-23 | There is a Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cau… |
CVE-2021-37009 | High | 7.5 | 2021-11-23 | There is a Configuration vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the confidentiality of users is affected. |
CVE-2021-37008 | High | 7.5 | 2021-11-23 | There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash. |
CVE-2021-37007 | High | 7.5 | 2021-11-23 | There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash. |
CVE-2021-37006 | High | 7.5 | 2021-11-23 | There is a Improper Preservation of Permissions vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the confidentiality… |
CVE-2021-37005 | High | 7.5 | 2021-11-23 | There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash. |
CVE-2021-37004 | High | 7.5 | 2021-11-23 | There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash. |
CVE-2021-37003 | High | 7.5 | 2021-11-23 | There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash. |
CVE-2021-35052 | High | 7.8 | 2021-11-23 | A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High. |
CVE-2021-22356 | Medium | 5.9 | 2021-11-23 | There is a weak secure algorithm vulnerability in Huawei products. A weak secure algorithm is used in a module. Attackers can exploit this vulnerability by cap… |
CVE-2021-39976 | High | 7.8 | 2021-11-23 | There is a privilege escalation vulnerability in CloudEngine 5800 V200R020C00SPC600. Due to lack of privilege restrictions, an authenticated local attacker can… |
CVE-2021-37036 | Medium | 5.5 | 2021-11-23 | There is an information leakage vulnerability in FusionCompute 6.5.1, eCNS280_TD V100R005C00 and V100R005C10. Due to the improperly storage of specific informa… |
CVE-2021-22410 | Medium | 5.4 | 2021-11-23 | There is a XSS injection vulnerability in iMaster NCE-Fabric V100R019C10. A module of the client does not verify the input sufficiently. Attackers can exploit… |
CVE-2021-20601 | High | 7.5 | 2021-11-23 | Improper input validation vulnerability in GOT2000 series GT27 model all versions, GOT2000 series GT25 model all versions, GOT2000 series GT23 model all versio… |
CVE-2021-40831 | Medium | 6.3 | 2021-11-23 | The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macO… |
CVE-2021-40830 | Medium | 6.3 | 2021-11-23 | The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix… |
CVE-2021-40829 | Medium | 6.3 | 2021-11-23 | Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and N… |
CVE-2021-40828 | Medium | 6.3 | 2021-11-23 | Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and… |
CVE-2021-44150 | High | 7.5 | 2021-11-22 | The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content. |
CVE-2021-44147 | Medium | 5.5 | 2021-11-22 | An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose local files via a craf… |
CVE-2021-44144 | Critical | 9.1 | 2021-11-22 | Croatia Control Asterix 2.8.1 has a heap-based buffer over-read, with additional details to be disclosed at a later date. |
CVE-2021-32004 | Low | 3.7 | 2021-11-22 | This issue affects: Secomea GateManager All versions prior to 9.6. Improper Check of host header in web server of Secomea GateManager allows attacker to cause… |
CVE-2021-44143 | Critical | 9.8 | 2021-11-22 | A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message… |
CVE-2021-42707 | High | 7.8 | 2021-11-22 | PLC Editor Versions 1.3.8 and prior is vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to execute arbitrary co… |
CVE-2021-42705 | High | 7.8 | 2021-11-22 | PLC Editor Versions 1.3.8 and prior is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbit… |
CVE-2021-38448 | High | 7.5 | 2021-11-22 | The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller… |
CVE-2021-23732 | Critical | 9.0 | 2021-11-22 | This affects all versions of package docker-cli-js. If the command parameter of the Docker.command method can at least be partially controlled by a user, they… |
CVE-2021-23718 | Medium | 6.5 | 2021-11-22 | The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if th… |
CVE-2021-23673 | Medium | 5.4 | 2021-11-22 | This affects all versions of package pekeupload. If an attacker induces a user to upload a file whose name contains javascript code, the javascript code will b… |
CVE-2021-43560 | Medium | 5.3 | 2021-11-22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it p… |
CVE-2021-43559 | High | 8.8 | 2021-11-22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality… |
CVE-2021-43558 | Medium | 6.1 | 2021-11-22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site adm… |
CVE-2021-43016 | Medium | 5.5 | 2021-11-22 | Adobe InCopy version 16.4 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attac… |
CVE-2021-43015 | High | 7.8 | 2021-11-22 | Adobe InCopy version 16.4 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious GIF file, potentially resultin… |
CVE-2021-42738 | High | 7.8 | 2021-11-22 | Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious MXF file, potentially resulti… |
CVE-2021-42737 | High | 7.8 | 2021-11-22 | Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially resulti… |
CVE-2021-42733 | Medium | 5.5 | 2021-11-22 | Adobe Bridge version 11.1.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated att… |
CVE-2021-42727 | High | 7.8 | 2021-11-22 | Adobe Bridge 11.1.1 (and earlier) is affected by a stack overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary… |
CVE-2021-40775 | High | 7.8 | 2021-11-22 | Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious SVG file, potentially resulti… |
CVE-2021-40774 | Medium | 5.5 | 2021-11-22 | Adobe Prelude version 10.1 (and earlier) is affected by a null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated atta… |
CVE-2021-40773 | Medium | 5.5 | 2021-11-22 | Adobe Prelude version 10.1 (and earlier) is affected by a null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated atta… |