2021 CVEs (page 87)
Page 87 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-3957 | Medium | 4.3 | 2021-11-19 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3950 | Medium | 5.4 | 2021-11-19 | django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3976 | Medium | 6.5 | 2021-11-19 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3974 | High | 7.8 | 2021-11-19 | vim is vulnerable to Use After Free |
CVE-2021-41532 | Medium | 5.3 | 2021-11-19 | In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user can access the data… |
CVE-2021-39236 | High | 8.8 | 2021-11-19 | In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user. |
CVE-2021-39235 | Medium | 6.5 | 2021-11-19 | In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do… |
CVE-2021-39234 | Medium | 6.8 | 2021-11-19 | In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypas… |
CVE-2021-39233 | Critical | 9.1 | 2021-11-19 | In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client. |
CVE-2021-39232 | High | 8.8 | 2021-11-19 | In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins. |
CVE-2021-39231 | Critical | 9.1 | 2021-11-19 | In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to d… |
CVE-2021-36372 | Critical | 9.8 | 2021-11-19 | In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users… |
CVE-2021-42338 | Critical | 9.8 | 2021-11-19 | 4MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in… |
CVE-2021-44033 | Medium | 6.8 | 2021-11-19 | In Ionic Identity Vault before 5.0.5, the protection mechanism for invalid unlock attempts can be bypassed. |
CVE-2021-44026 | Critical | 9.8 | 2021-11-19 | Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. |
CVE-2021-44025 | Medium | 6.1 | 2021-11-19 | Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message. |
CVE-2021-41278 | Medium | 5.7 | 2021-11-19 | Functions SDK for EdgeX is meant to provide all the plumbing necessary for developers to get started in processing/transforming/exporting data out of the EdgeX… |
CVE-2021-40131 | Medium | 5.5 | 2021-11-19 | A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to condu… |
CVE-2021-40130 | Medium | 4.9 | 2021-11-19 | A vulnerability in the web application of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to specify non-log file… |
CVE-2021-40129 | Medium | 4.9 | 2021-11-19 | A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to submit a SQL… |
CVE-2021-37322 | High | 7.8 | 2021-11-18 | GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c. |
CVE-2021-43017 | Medium | 4.2 | 2021-11-18 | Adobe Creative Cloud version 5.5 (and earlier) are affected by an Application denial of service vulnerability in the Creative Cloud Desktop installer. An authe… |
CVE-2021-39928 | High | 7.5 | 2021-11-18 | NULL pointer exception in the IEEE 802.11 dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted ca… |
CVE-2021-39920 | High | 7.5 | 2021-11-18 | NULL pointer exception in the IPPUSB dissector in Wireshark 3.4.0 to 3.4.9 allows denial of service via packet injection or crafted capture file |
CVE-2021-23197 | Medium | 5.2 | 2021-11-18 | Unquoted service path vulnerability in the Gallagher Controller Service allows an unprivileged user to execute arbitrary code as the account that runs the Cont… |
CVE-2021-23193 | High | 8.1 | 2021-11-18 | Improper privilege validation vulnerability in COM Interface of Gallagher Command Centre Server allows authenticated unprivileged operators to retrieve sensiti… |
CVE-2021-23167 | High | 8.1 | 2021-11-18 | Improper certificate validation vulnerability in SMTP Client allows man-in-the-middle attack to retrieve sensitive information from the Command Centre Server… |
CVE-2021-23162 | High | 7.7 | 2021-11-18 | Improper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This… |
CVE-2021-23155 | Critical | 9.0 | 2021-11-18 | Improper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This i… |
CVE-2021-23146 | High | 7.1 | 2021-11-18 | An Incomplete Comparison with Missing Factors vulnerability in the Gallagher Controller allows an attacker to bypass PIV verification. This issue affects: Gall… |
CVE-2021-42525 | Low | 3.3 | 2021-11-18 | Acrobat Animate versions 21.0.9 (and earlier)is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2021-42524 | High | 7.8 | 2021-11-18 | Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of… |
CVE-2021-42272 | High | 7.8 | 2021-11-18 | Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of… |
CVE-2021-42271 | High | 7.8 | 2021-11-18 | Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of… |
CVE-2021-42270 | High | 7.8 | 2021-11-18 | Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of… |
CVE-2021-42269 | High | 7.8 | 2021-11-18 | Adobe Animate version 21.0.9 (and earlier) are affected by a use-after-free vulnerability in the processing of a malformed FLA file that could result in arbitr… |
CVE-2021-42268 | Medium | 5.5 | 2021-11-18 | Adobe Animate version 21.0.9 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted FLA file. An unauthenticate… |
CVE-2021-42267 | High | 7.8 | 2021-11-18 | Adobe Animate version 21.0.9 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious FLA file, potentially resul… |
CVE-2021-42266 | High | 7.8 | 2021-11-18 | Adobe Animate version 21.0.9 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious FLA file, potentially resul… |
CVE-2021-40761 | Medium | 5.5 | 2021-11-18 | Adobe After Effects version 18.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthentica… |
CVE-2021-40760 | High | 7.8 | 2021-11-18 | Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .m4a file, potentiall… |
CVE-2021-40759 | High | 7.8 | 2021-11-18 | Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .m4a file, potentiall… |
CVE-2021-40758 | High | 7.8 | 2021-11-18 | Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially… |
CVE-2021-40757 | High | 7.8 | 2021-11-18 | Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious MXF file, potentially… |
CVE-2021-40756 | Medium | 5.5 | 2021-11-18 | Adobe After Effects version 18.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthentica… |
CVE-2021-40755 | High | 7.8 | 2021-11-18 | Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious SGI file in the DoRea… |
CVE-2021-40754 | High | 7.8 | 2021-11-18 | Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially… |
CVE-2021-40753 | High | 7.8 | 2021-11-18 | Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious SVG file, potentially… |
CVE-2021-40752 | High | 7.8 | 2021-11-18 | Adobe After Effects version 18.4 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .m4a file, potentially… |
CVE-2021-40751 | High | 7.8 | 2021-11-18 | Adobe After Effects version 18.4 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .m4a file, potentially… |
CVE-2021-40733 | High | 7.8 | 2021-11-18 | Adobe Animate version 21.0.9 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .psd file, potentially resu… |
CVE-2021-35534 | High | 7.2 | 2021-11-18 | Insufficient security control vulnerability in internal database access mechanism of Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC600 allows… |
CVE-2021-43669 | High | 7.5 | 2021-11-18 | A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This b… |
CVE-2021-43668 | Medium | 5.5 | 2021-11-18 | Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered. They will crash with "runtime error: invalid m… |
CVE-2021-43667 | High | 7.5 | 2021-11-18 | A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and se… |
CVE-2021-37939 | Low | 2.7 | 2021-11-18 | It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentional… |
CVE-2021-37938 | Medium | 4.3 | 2021-11-18 | It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf files. Because of this… |
CVE-2021-35535 | High | 8.1 | 2021-11-18 | Insecure Boot Image vulnerability in Hitachi Energy Relion Relion 670/650/SAM600-IO series allows an attacker who manages to get access to the front network po… |
CVE-2021-43549 | Medium | 6.9 | 2021-11-18 | A remote authenticated attacker with write access to a PI Server could trick a user into interacting with a PI Web API endpoint and redirect them to a maliciou… |
CVE-2021-36909 | High | 8.8 | 2021-11-18 | Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe the entire databas… |
CVE-2021-36908 | High | 8.8 | 2021-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in WebFactory Ltd. WP Reset PRO plugin <= 5.98 versions. |
CVE-2021-27026 | Medium | 4.4 | 2021-11-18 | A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged |
CVE-2021-27025 | Medium | 6.5 | 2021-11-18 | A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the fi… |
CVE-2021-27024 | High | 8.1 | 2021-11-18 | A flaw was discovered in Continuous Delivery for Puppet Enterprise (CD4PE) that results in a user with lower privileges being able to access a Puppet Enterpris… |
CVE-2021-27023 | Critical | 9.8 | 2021-11-18 | A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This i… |
CVE-2021-0672 | Medium | 5.5 | 2021-11-18 | In Browser app, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additiona… |
CVE-2021-0671 | Medium | 6.7 | 2021-11-18 | In apusys, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2021-0670 | Medium | 6.7 | 2021-11-18 | In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges nee… |
CVE-2021-0669 | Medium | 6.7 | 2021-11-18 | In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges nee… |
CVE-2021-0668 | Medium | 6.7 | 2021-11-18 | In apusys, there is a possible memory corruption due to incorrect error handling. This could lead to local escalation of privilege with System execution privil… |
CVE-2021-0667 | Medium | 6.7 | 2021-11-18 | In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges nee… |
CVE-2021-0666 | Medium | 4.4 | 2021-11-18 | In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privi… |
CVE-2021-0665 | Medium | 4.4 | 2021-11-18 | In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privi… |
CVE-2021-0664 | Medium | 6.7 | 2021-11-18 | In ccu, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2021-0659 | Medium | 4.4 | 2021-11-18 | In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privi… |
CVE-2021-0658 | Medium | 6.7 | 2021-11-18 | In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2021-0657 | Medium | 6.7 | 2021-11-18 | In apusys, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local escalation of privilege with System execution… |
CVE-2021-0656 | Medium | 6.7 | 2021-11-18 | In edma driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privilege… |
CVE-2021-0655 | Medium | 6.7 | 2021-11-18 | In mdlactl driver, there is a possible memory corruption due to an incorrect bounds check. This could lead to local escalation of privilege with System executi… |
CVE-2021-0629 | Medium | 6.7 | 2021-11-18 | In mdlactl driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privil… |
CVE-2021-0624 | Medium | 5.5 | 2021-11-18 | In flv extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional exec… |
CVE-2021-0623 | Medium | 5.5 | 2021-11-18 | In asf extractor, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with no additional executi… |
CVE-2021-0622 | Medium | 5.5 | 2021-11-18 | In asf extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional exec… |
CVE-2021-0621 | Medium | 5.5 | 2021-11-18 | In asf extractor, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with no additional executi… |
CVE-2021-0620 | Medium | 5.5 | 2021-11-18 | In asf extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional exec… |
CVE-2021-0619 | Medium | 5.5 | 2021-11-18 | In ape extractor, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional exec… |
CVE-2021-43997 | High | 7.8 | 2021-11-17 | FreeRTOS versions 10.2.0 through 10.4.5 do not prevent non-kernel code from calling the xPortRaisePrivilege internal function to raise privilege. FreeRTOS vers… |
CVE-2021-43996 | Critical | 9.8 | 2021-11-17 | The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control. |
CVE-2021-41277 | Critical | 10.0 | 2021-11-17 | Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->ma… |
CVE-2021-41275 | Critical | 9.3 | 2021-11-17 | spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an un… |
CVE-2021-41274 | Critical | 9.3 | 2021-11-17 | solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subj… |
CVE-2021-41273 | Medium | 4.3 | 2021-11-17 | Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a mali… |
CVE-2021-41190 | Low | 3.0 | 2021-11-17 | The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification vers… |
CVE-2021-41165 | High | 8.2 | 2021-11-17 | CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all… |
CVE-2021-33118 | High | 7.8 | 2021-11-17 | Improper access control in the software installer for the Intel(R) Serial IO driver for Intel(R) NUC 11 Gen before version 30.100.2104.1 may allow an authentic… |
CVE-2021-33098 | Medium | 5.5 | 2021-11-17 | Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow an authenticated user to potentially enable denial of… |
CVE-2021-33097 | Medium | 6.6 | 2021-11-17 | Time-of-check time-of-use vulnerability in the Crypto API Toolkit for Intel(R) SGX may allow a privileged user to potentially enable escalation of privilege vi… |
CVE-2021-33073 | Medium | 5.5 | 2021-11-17 | Uncontrolled resource consumption in the Intel(R) Distribution of OpenVINOâ„¢ Toolkit before version 2021.4 may allow an unauthenticated user to potentially en… |
CVE-2021-33071 | High | 7.8 | 2021-11-17 | Incorrect default permissions in the installer for the Intel(R) oneAPI Rendering Toolkit before version 2021.2 may allow an authenticated user to potentially e… |
CVE-2021-33063 | High | 7.8 | 2021-11-17 | Uncontrolled search path in the Intel(R) RealSense(TM) D400 Series UWP driver for Windows 10 before version 6.1.160.22 may allow an authenticated user to poten… |