2021 CVEs (page 86)
Page 86 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-40772 | High | 7.8 | 2021-11-22 | Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulti… |
CVE-2021-40771 | High | 7.8 | 2021-11-22 | Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially resulti… |
CVE-2021-40770 | High | 7.8 | 2021-11-22 | Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulti… |
CVE-2021-3943 | Critical | 9.8 | 2021-11-22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A remote code execution risk when restor… |
CVE-2021-3935 | High | 8.1 | 2021-11-22 | When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established… |
CVE-2021-26614 | High | 7.5 | 2021-11-22 | ius_get.cgi in IpTime C200 camera allows remote code execution. A remote attacker may send a crafted parameters to the exposed vulnerable web service interface… |
CVE-2021-43582 | High | 7.8 | 2021-11-22 | A Use-After-Free Remote Vulnerability exists when reading a DWG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within t… |
CVE-2021-43581 | High | 8.8 | 2021-11-22 | An Out-of-Bounds Read vulnerability exists when reading a U3D file using Open Design Alliance PRC SDK before 2022.11. The specific issue exists within the pars… |
CVE-2021-43557 | High | 7.5 | 2021-11-22 | The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normaliza… |
CVE-2021-38378 | Medium | 4.3 | 2021-11-22 | OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name. |
CVE-2021-38377 | Medium | 6.1 | 2021-11-22 | OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML tra… |
CVE-2021-38376 | Medium | 5.3 | 2021-11-22 | OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call. |
CVE-2021-38375 | Medium | 6.1 | 2021-11-22 | OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message. |
CVE-2021-38374 | Medium | 5.4 | 2021-11-22 | OX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader reference within an app loader URL. |
CVE-2021-38146 | High | 7.5 | 2021-11-22 | The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute path traversal in th… |
CVE-2021-33495 | Medium | 6.1 | 2021-11-22 | OX App Suite 7.10.5 allows XSS via an OX Chat system message. |
CVE-2021-33494 | Medium | 6.1 | 2021-11-22 | OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering. |
CVE-2021-33493 | Medium | 6.0 | 2021-11-22 | The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format. |
CVE-2021-33492 | Medium | 6.1 | 2021-11-22 | OX App Suite 7.10.5 allows XSS via an OX Chat room name. |
CVE-2021-33491 | Medium | 6.5 | 2021-11-22 | OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses i… |
CVE-2021-33490 | Medium | 6.1 | 2021-11-22 | OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature. |
CVE-2021-33489 | Medium | 6.1 | 2021-11-22 | OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file. |
CVE-2021-33488 | Medium | 6.1 | 2021-11-22 | chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook. |
CVE-2021-44079 | Critical | 9.8 | 2021-11-22 | In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially resulting in remote… |
CVE-2021-28710 | High | 8.8 | 2021-11-21 | certain VT-d IOMMUs may not work in shared page table mode For efficiency reasons, address translation control structures (page tables) may (and, on suitable h… |
CVE-2021-34400 | Medium | 4.1 | 2021-11-20 | NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to gain access to informa… |
CVE-2021-34399 | Medium | 4.1 | 2021-11-20 | NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to gain access to informa… |
CVE-2021-23219 | Medium | 4.1 | 2021-11-20 | NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to access protected info… |
CVE-2021-23217 | High | 7.5 | 2021-11-20 | NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to instantiate a DMA wri… |
CVE-2021-23201 | High | 7.5 | 2021-11-20 | NVIDIA GPU and Tegra hardware contain a vulnerability in an internal microcontroller, which may allow a user with elevated privileges to generate valid microco… |
CVE-2021-1125 | Medium | 4.1 | 2021-11-20 | NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to corrupt program data. |
CVE-2021-1105 | Medium | 4.1 | 2021-11-20 | NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to access debug registers… |
CVE-2021-1088 | Medium | 4.1 | 2021-11-20 | NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to utilize debug mechanis… |
CVE-2021-36340 | High | 7.8 | 2021-11-20 | Dell EMC SCG 5.00.00.10 and earlier, contain a sensitive information disclosure vulnerability. A local malicious user may exploit this vulnerability to read se… |
CVE-2021-36322 | Medium | 6.1 | 2021-11-20 | Dell Networking X-Series firmware versions prior to 3.0.1.8 contain a host header injection vulnerability. A remote unauthenticated attacker may potentially ex… |
CVE-2021-36321 | High | 7.5 | 2021-11-20 | Dell Networking X-Series firmware versions prior to 3.0.1.8 contain an improper input validation vulnerability. A remote unauthenticated attacker may potential… |
CVE-2021-36320 | High | 7.5 | 2021-11-20 | Dell Networking X-Series firmware versions prior to 3.0.1.8 contain an authentication bypass vulnerability. A remote unauthenticated attacker may potentially h… |
CVE-2021-36319 | Low | 3.3 | 2021-11-20 | Dell Networking OS10 versions 10.4.3.x, 10.5.0.x and 10.5.1.x contain an information exposure vulnerability. A low privileged authenticated malicious user can… |
CVE-2021-36310 | Medium | 4.9 | 2021-11-20 | Dell Networking OS10, versions 10.4.3.x, 10.5.0.x, 10.5.1.x & 10.5.2.x, contain an uncontrolled resource consumption flaw in its API service. A high-privileged… |
CVE-2021-36308 | Medium | 5.9 | 2021-11-20 | Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an authentication bypass vulnerability. A remote unauthenticated a… |
CVE-2021-36307 | High | 8.8 | 2021-11-20 | Networking OS10, versions prior to October 2021 with RESTCONF API enabled, contains a privilege escalation vulnerability. A malicious low privileged user with… |
CVE-2021-36306 | High | 8.1 | 2021-11-20 | Networking OS10, versions prior to October 2021 with RESTCONF API enabled, contains an authentication bypass vulnerability. A remote unauthenticated attacker c… |
CVE-2021-38681 | Medium | 5.3 | 2021-11-20 | A reflected cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Ragic Cloud DB. If exploited, this vulnerability allows remot… |
CVE-2021-34358 | Medium | 6.8 | 2021-11-20 | We have already fixed this vulnerability in the following versions of QmailAgent: QmailAgent 3.0.2 ( 2021/08/25 ) and later |
CVE-2021-39198 | Medium | 4.2 | 2021-11-19 | OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is… |
CVE-2021-41280 | Critical | 9.8 | 2021-11-19 | Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go… |
CVE-2021-23433 | Medium | 5.9 | 2021-11-19 | The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchPara… |
CVE-2021-21898 | High | 8.8 | 2021-11-19 | A code execution vulnerability exists in the dwgCompressor::decompress18() functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg… |
CVE-2021-44038 | High | 7.8 | 2021-11-19 | An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned direc… |
CVE-2021-43555 | High | 7.3 | 2021-11-19 | mySCADA myDESIGNER Versions 8.20.0 and prior fails to properly validate contents of an imported project file, which may make the product vulnerable to a path t… |
CVE-2021-42744 | Medium | 5.5 | 2021-11-19 | Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
CVE-2021-42254 | High | 7.8 | 2021-11-19 | BeyondTrust Privilege Management prior to version 21.6 creates a Temporary File in a Directory with Insecure Permissions. |
CVE-2021-40391 | Critical | 9.8 | 2021-11-19 | An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and the forked version… |
CVE-2021-36884 | Medium | 4.8 | 2021-11-19 | Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions. |
CVE-2021-26262 | Medium | 5.5 | 2021-11-19 | Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
CVE-2021-26248 | Medium | 5.5 | 2021-11-19 | Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
CVE-2021-22970 | High | 7.5 | 2021-11-19 | Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable toa. SSRF attacks on… |
CVE-2021-22969 | Medium | 5.3 | 2021-11-19 | Concrete CMS (formerly concrete5) versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability to fetch cloud IAAS… |
CVE-2021-22968 | High | 7.2 | 2021-11-19 | A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 a… |
CVE-2021-22967 | High | 7.5 | 2021-11-19 | In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To r… |
CVE-2021-22966 | High | 8.8 | 2021-11-19 | Privilege escalation from Editor to Admin using Groups in Concrete CMS versions 8.5.6 and below. If a group is granted "view" permissions on the bulkupdate pag… |
CVE-2021-22965 | High | 7.5 | 2021-11-19 | A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is… |
CVE-2021-22951 | High | 7.5 | 2021-11-19 | Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7. Concrete CMS now… |
CVE-2021-21900 | High | 8.8 | 2021-11-19 | A code execution vulnerability exists in the dxfRW::processLType() functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dxf file can… |
CVE-2021-21899 | High | 8.8 | 2021-11-19 | A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg… |
CVE-2021-41569 | High | 7.5 | 2021-11-19 | SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included by default) in the appstart.sas file, allows end-users of the… |
CVE-2021-44037 | High | 7.5 | 2021-11-19 | Team Password Manager (aka TeamPasswordManager) before 10.135.236 allows password-reset poisoning. |
CVE-2021-44036 | High | 8.8 | 2021-11-19 | Team Password Manager (aka TeamPasswordManager) before 10.135.236 has a CSRF vulnerability during import. |
CVE-2021-3962 | High | 7.8 | 2021-11-19 | A flaw was found in ImageMagick where it did not properly sanitize certain input before using it to invoke convert processes. This flaw allows an attacker to c… |
CVE-2021-39929 | High | 7.5 | 2021-11-19 | Uncontrolled Recursion in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted… |
CVE-2021-39926 | High | 7.5 | 2021-11-19 | Buffer overflow in the Bluetooth HCI_ISO dissector in Wireshark 3.4.0 to 3.4.9 allows denial of service via packet injection or crafted capture file |
CVE-2021-39925 | High | 7.5 | 2021-11-19 | Buffer overflow in the Bluetooth SDP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture… |
CVE-2021-39924 | High | 7.5 | 2021-11-19 | Large loop in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file |
CVE-2021-39923 | High | 7.5 | 2021-11-19 | Large loop in the PNRP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file |
CVE-2021-39922 | High | 7.5 | 2021-11-19 | Buffer overflow in the C12.22 dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file |
CVE-2021-39921 | High | 7.5 | 2021-11-19 | NULL pointer exception in the Modbus dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture… |
CVE-2021-29329 | High | 7.8 | 2021-11-19 | OpenSource Moddable v10.5.0 was discovered to contain a stack overflow in the fxBinaryExpressionNodeDistribute function at /moddable/xs/sources/xsTree.c. |
CVE-2021-29328 | High | 7.1 | 2021-11-19 | OpenSource Moddable v10.5.0 was discovered to contain buffer over-read in the fxDebugThrow function at /moddable/xs/sources/xsDebug.c. |
CVE-2021-29327 | High | 7.8 | 2021-11-19 | OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow in the fx_ArrayBuffer function at /moddable/xs/sources/xsDataView.c. |
CVE-2021-29326 | High | 7.8 | 2021-11-19 | OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow in the fxIDToString function at /moddable/xs/sources/xsSymbol.c. |
CVE-2021-29325 | High | 7.8 | 2021-11-19 | OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow in the fx_String_prototype_repeat function at /moddable/xs/sources/xsString.c. |
CVE-2021-29324 | High | 7.8 | 2021-11-19 | OpenSource Moddable v10.5.0 was discovered to contain a stack overflow via the component /moddable/xs/sources/xsScript.c. |
CVE-2021-29323 | Medium | 5.5 | 2021-11-19 | OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow via the component /modules/network/wifi/esp/modwifi.c. |
CVE-2021-22030 | Medium | 6.5 | 2021-11-19 | In versions of Greenplum database prior to 5.28.14 and 6.17.0, certain statements execution led to the storage of sensitive(credential) information in the logs… |
CVE-2021-22028 | Critical | 9.1 | 2021-11-19 | In versions of Greenplum database prior to 5.28.6 and 6.14.0, greenplum database contains a file path traversal vulnerability leading to information disclosure… |
CVE-2021-43409 | Critical | 9.3 | 2021-11-19 | The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (… |
CVE-2021-43408 | Medium | 6.5 | 2021-11-19 | The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. SQL injection vulnerabilities occur when client supplie… |
CVE-2021-42363 | Medium | 6.1 | 2021-11-19 | The Preview E-Mails for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the search_order parameter found in the ~/views/form.p… |
CVE-2021-39353 | High | 8.8 | 2021-11-19 | The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajax_add_form function found i… |
CVE-2021-36003 | Medium | 5.5 | 2021-11-19 | Adobe Audition version 14.2 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a specially crafted file. An unauthenticated attacker… |
CVE-2021-33850 | Medium | 5.4 | 2021-11-19 | There is a Cross-Site Scripting vulnerability in Microsoft Clarity version 0.3. The XSS payload executes whenever the user changes the clarity configuration in… |
CVE-2021-22053 | High | 8.8 | 2021-11-19 | Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request… |
CVE-2021-37592 | Critical | 9.8 | 2021-11-19 | Suricata before 5.0.8 and 6.x before 6.0.4 allows TCP evasion via a client with a crafted TCP/IP stack that can send a certain sequence of segments. |
CVE-2021-3920 | Medium | 5.4 | 2021-11-19 | grav-plugin-admin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-41436 | High | 7.5 | 2021-11-19 | An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDI… |
CVE-2021-41435 | Critical | 9.8 | 2021-11-19 | A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U G… |
CVE-2021-3973 | High | 7.8 | 2021-11-19 | vim is vulnerable to Heap-based Buffer Overflow |
CVE-2021-3968 | High | 8.0 | 2021-11-19 | vim is vulnerable to Heap-based Buffer Overflow |
CVE-2021-3963 | Medium | 4.3 | 2021-11-19 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3961 | Medium | 5.4 | 2021-11-19 | snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |