2021 CVEs (page 88)
Page 88 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-33062 | High | 7.8 | 2021-11-17 | Incorrect default permissions in the software installer for the Intel(R) VTune(TM) Profiler before version 2021.3.0 may allow an authenticated user to potentia… |
CVE-2021-33059 | Medium | 6.7 | 2021-11-17 | Improper input validation in the Intel(R) Administrative Tools for Intel(R) Network Adapters driver for Windows before version 1.4.0.15, may allow a privileged… |
CVE-2021-33058 | High | 7.8 | 2021-11-17 | Improper access control in the installer Intel(R)Administrative Tools for Intel(R) Network Adaptersfor Windowsbefore version 1.4.0.21 may allow an unauthentica… |
CVE-2021-0200 | Medium | 6.7 | 2021-11-17 | Out-of-bounds write in the firmware for Intel(R) Ethernet 700 Series Controllers before version 8.2 may allow a privileged user to potentially enable an escala… |
CVE-2021-0199 | Medium | 4.4 | 2021-11-17 | Improper input validation in the firmware for the Intel(R) Ethernet Network Controller E810 before version 1.6.0.6 may allow a privileged user to potentially e… |
CVE-2021-0198 | Medium | 4.4 | 2021-11-17 | Improper access control in the firmware for the Intel(R) Ethernet Network Controller E810 before version 1.5.5.6 may allow a privileged user to potentially ena… |
CVE-2021-0197 | Medium | 4.4 | 2021-11-17 | Protection mechanism failure in the firmware for the Intel(R) Ethernet Network Controller E810 before version 1.5.5.6 may allow a privileged user to enable a d… |
CVE-2021-0186 | Medium | 6.7 | 2021-11-17 | Improper input validation in the Intel(R) SGX SDK applications compiled for SGX2 enabled processors may allow a privileged user to potentially escalation of pr… |
CVE-2021-0182 | Medium | 6.2 | 2021-11-17 | Uncontrolled resource consumption in the Intel(R) HAXM software before version 7.6.6 may allow an unauthenticated user to potentially enable information disclo… |
CVE-2021-0180 | High | 8.4 | 2021-11-17 | Uncontrolled resource consumption in the Intel(R) HAXM software before version 7.6.6 may allow an unauthenticated user to potentially enable privilege escalati… |
CVE-2021-0158 | Medium | 6.7 | 2021-11-17 | Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local… |
CVE-2021-0157 | Medium | 6.7 | 2021-11-17 | Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privileg… |
CVE-2021-0152 | Medium | 5.5 | 2021-11-17 | Improper verification of cryptographic signature in the installer for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products in Windows 10 ma… |
CVE-2021-0151 | High | 7.8 | 2021-11-17 | Improper access control in the installer for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products in Windows 10 may allow an authenticated… |
CVE-2021-0148 | Medium | 4.4 | 2021-11-17 | Insertion of information into log file in firmware for some Intel(R) SSD DC may allow a privileged user to potentially enable information disclosure via local… |
CVE-2021-0146 | Medium | 6.8 | 2021-11-17 | Hardware allows activation of test or debug logic at runtime for some Intel(R) processors which may allow an unauthenticated user to potentially enable escalat… |
CVE-2021-0135 | Medium | 6.7 | 2021-11-17 | Improper input validation in the Intel(R) Ethernet Diagnostic Driver for Windows before version 1.4.0.10 may allow a privileged user to potentially enable esca… |
CVE-2021-0120 | Medium | 5.5 | 2021-11-17 | Improper initialization in the installer for some Intel(R) Graphics DCH Drivers for Windows 10 before version 27.20.100.9316 may allow an authenticated user to… |
CVE-2021-0110 | Medium | 5.5 | 2021-11-17 | Improper access control in some Intel(R) Thunderbolt(TM) Windows DCH Drivers before version 1.41.1054.0 may allow unauthenticated user to potentially enable de… |
CVE-2021-0082 | High | 7.8 | 2021-11-17 | Uncontrolled search path in software installer for Intel(R) PROSet/Wireless WiFi in Windows 10 may allow an authenticated user to potentially enable escalation… |
CVE-2021-0079 | Medium | 6.5 | 2021-11-17 | Improper input validation in software for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows 10 may allow an unauthenticated user to potentially… |
CVE-2021-0078 | High | 8.1 | 2021-11-17 | Improper input validation in software for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows 10 may allow an unauthenticated user to potentially… |
CVE-2021-0075 | Medium | 5.5 | 2021-11-17 | Out-of-bounds write in firmware for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and some Killer(TM) WiFi in Windows 10 may allow a privile… |
CVE-2021-0071 | High | 8.8 | 2021-11-17 | Improper input validation in firmware for some Intel(R) PROSet/Wireless WiFi in UEFI may allow an unauthenticated user to potentially enable escalation of priv… |
CVE-2021-0069 | Medium | 6.5 | 2021-11-17 | Improper input validation in firmware for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and some Killer(TM) WiFi in Windows 10 may allow an… |
CVE-2021-0065 | High | 7.8 | 2021-11-17 | Incorrect default permissions in the Intel(R) PROSet/Wireless WiFi software installer for Windows 10 before version 22.40 may allow an authenticated user to po… |
CVE-2021-0064 | High | 7.8 | 2021-11-17 | Insecure inherited permissions in the Intel(R) PROSet/Wireless WiFi software installer for Windows 10 before version 22.40 may allow an authenticated user to p… |
CVE-2021-0063 | Medium | 6.5 | 2021-11-17 | Improper input validation in firmware for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows 10 may allow an unauthenticated user to potentially… |
CVE-2021-0053 | Medium | 5.7 | 2021-11-17 | Improper initialization in firmware for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows 10 may allow an authenticated user to potentially ena… |
CVE-2021-0013 | High | 7.5 | 2021-11-17 | Improper input validation for Intel(R) EMA before version 1.5.0 may allow an unauthenticated user to potentially enable denial of service via network access. |
CVE-2021-43979 | Medium | 5.3 | 2021-11-17 | Styra Open Policy Agent (OPA) Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control. The data replication mechanism… |
CVE-2021-43553 | Low | 3.1 | 2021-11-17 | PI Vision could disclose information to a user with insufficient privileges for an AF attribute that is the child of another attribute and is configured as a L… |
CVE-2021-43551 | Medium | 6.5 | 2021-11-17 | A remote attacker with write access to PI Vision could inject code into a display. Unauthorized information disclosure, modification, or deletion is possible i… |
CVE-2021-42361 | Medium | 4.8 | 2021-11-17 | The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter f… |
CVE-2021-41164 | High | 8.2 | 2021-11-17 | CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may a… |
CVE-2021-33106 | High | 7.8 | 2021-11-17 | Integer overflow in the Safestring library maintained by Intel(R) may allow an authenticated user to potentially enable escalation of privilege via local acces… |
CVE-2021-33095 | High | 7.8 | 2021-11-17 | Unquoted search path in the installer for the Intel(R) NUC M15 Laptop Kit Keyboard LED Service driver pack before version 1.0.0.4 may allow an authenticated us… |
CVE-2021-33094 | High | 7.8 | 2021-11-17 | Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit Keyboard LED Service driver pack before version 1.0.0.4 may allow an authen… |
CVE-2021-33093 | High | 7.8 | 2021-11-17 | Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit Serial IO driver pack before version 30.100.2104.1 may allow an authenticat… |
CVE-2021-33092 | High | 7.8 | 2021-11-17 | Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit HID Event Filter driver pack before version 2.2.1.383 may allow an authentic… |
CVE-2021-33091 | High | 7.8 | 2021-11-17 | Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit audio driver pack before version 1.3 may allow an authenticated user to pot… |
CVE-2021-33090 | High | 7.8 | 2021-11-17 | Incorrect default permissionsin the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC10i3FN, NUC10i5FN, NUC10i7FN before version 1.78.2… |
CVE-2021-33089 | High | 7.8 | 2021-11-17 | Improper access control in the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC8i3BE, NUC8i5BE, NUC8i7BE before version 1.78.4.0.4 may… |
CVE-2021-33088 | High | 7.8 | 2021-11-17 | Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit Integrated Sensor Hub driver pack before version 5.4.1.4449 may allow an aut… |
CVE-2021-33087 | Medium | 5.5 | 2021-11-17 | Improper authentication in the installer for the Intel(R) NUC M15 Laptop Kit Management Engine driver pack before version 15.0.10.1508 may allow an authenticat… |
CVE-2021-33086 | Medium | 5.5 | 2021-11-17 | Out-of-bounds write in firmware for some Intel(R) NUCs may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2021-0121 | High | 7.8 | 2021-11-17 | Improper access control in the installer for some Intel(R) Iris(R) Xe MAX Dedicated Graphics Drivers for Windows 10 before version 27.20.100.9466 may allow aut… |
CVE-2021-0096 | High | 7.8 | 2021-11-17 | Improper authentication in the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN, NUC7i7DN before version 1.78.1.1 may a… |
CVE-2021-42362 | High | 8.8 | 2021-11-17 | The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.ph… |
CVE-2021-42360 | High | 7.6 | 2021-11-17 | On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which includes Contributor-level… |
CVE-2021-35528 | High | 7.2 | 2021-11-17 | Improper Access Control vulnerability in the application authentication and authorization of Hitachi Energy Retail Operations, Counterparty Settlement and Bill… |
CVE-2021-33481 | High | 7.8 | 2021-11-17 | A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in try_to_divide_boxes() in pgm2asc.c. |
CVE-2021-33480 | Medium | 5.5 | 2021-11-17 | An use-after-free vulnerability was discovered in gocr through 0.53-20200802 in context_correction() in pgm2asc.c. |
CVE-2021-33479 | High | 7.8 | 2021-11-17 | A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in measure_pitch() in pgm2asc.c. |
CVE-2021-43977 | Medium | 6.1 | 2021-11-17 | SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS. |
CVE-2021-43976 | Medium | 4.6 | 2021-11-17 | In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a crafted USB device) to… |
CVE-2021-43975 | Medium | 6.7 | 2021-11-17 | In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introd… |
CVE-2021-32234 | Critical | 9.8 | 2021-11-17 | SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution. |
CVE-2021-40745 | High | 7.5 | 2021-11-17 | Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading arbitrary server files. By leveraging an e… |
CVE-2021-42250 | Medium | 6.5 | 2021-11-17 | Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious co… |
CVE-2021-38959 | Medium | 5.5 | 2021-11-17 | IBM SPSS Statistics for Windows 24.0, 25.0, 26.0, 27.0, 27.0.1, and 28.0 could allow a local user to cause a denial of service by writing arbitrary files to ad… |
CVE-2021-29861 | Medium | 6.2 | 2021-11-17 | IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in EFS to expose sensitive information. IBM X-Force ID: 20608… |
CVE-2021-29860 | Medium | 6.2 | 2021-11-17 | IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the libc.a library to expose sensitive information. IBM X-… |
CVE-2021-42955 | High | 7.3 | 2021-11-17 | Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability. Because of the de… |
CVE-2021-42954 | High | 7.8 | 2021-11-17 | Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable… |
CVE-2021-42956 | High | 7.8 | 2021-11-17 | Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability. Due to improper pri… |
CVE-2021-41931 | Critical | 9.8 | 2021-11-17 | The Company's Recruitment Management System in id=2 of the parameter from view_vacancy app on-page appears to be vulnerable to SQL injection. The payloads 1942… |
CVE-2021-32600 | Medium | 5.0 | 2021-11-17 | An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS CLI 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, 6.0.x and 5.6.x may… |
CVE-2021-24856 | Medium | 4.8 | 2021-11-17 | The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perf… |
CVE-2021-24854 | Medium | 5.4 | 2021-11-17 | The QR Redirector WordPress plugin before 1.6.1 does not sanitise and escape some of the QR Redirect fields, which could allow users with a role as low as Cont… |
CVE-2021-24853 | Medium | 4.3 | 2021-11-17 | The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action… |
CVE-2021-24852 | Medium | 6.5 | 2021-11-17 | The MouseWheel Smooth Scroll WordPress plugin before 5.7 does not have CSRF check in place on its settings page, which could allow attackers to make a logged i… |
CVE-2021-24851 | Medium | 4.3 | 2021-11-17 | The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardl… |
CVE-2021-24850 | Medium | 5.4 | 2021-11-17 | The Insert Pages WordPress plugin before 3.7.0 adds a shortcode that prints out other pages' content and custom fields. It can be used by users with a role as… |
CVE-2021-24847 | High | 8.8 | 2021-11-17 | The importFromRedirection AJAX action of the SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 8.2, available to any authenticated user, do… |
CVE-2021-24841 | Medium | 4.8 | 2021-11-17 | The Helpful WordPress plugin before 4.4.59 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scri… |
CVE-2021-24834 | Medium | 5.4 | 2021-11-17 | The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in the Create Poll - Options module where a… |
CVE-2021-24833 | Medium | 5.4 | 2021-11-17 | The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user wi… |
CVE-2021-24815 | Medium | 4.8 | 2021-11-17 | The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created Buttons, which could allow a high privileg… |
CVE-2021-24804 | High | 8.8 | 2021-11-17 | The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed th… |
CVE-2021-24802 | Medium | 6.5 | 2021-11-17 | The Colorful Categories WordPress plugin before 2.0.15 does not enforce nonce checks which could allow attackers to make a logged in admin or editor change tax… |
CVE-2021-24796 | Medium | 6.1 | 2021-11-17 | The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin… |
CVE-2021-24787 | Medium | 4.8 | 2021-11-17 | The Client Invoicing by Sprout Invoices WordPress plugin before 19.9.7 does not sanitise and escape some of its settings, which could allow high privilege user… |
CVE-2021-24776 | Medium | 4.3 | 2021-11-17 | The WP Performance Score Booster WordPress plugin before 2.1 does not have CSRF check when saving its settings, which could allow attackers to make a logged in… |
CVE-2021-24772 | High | 8.8 | 2021-11-17 | The Stream WordPress plugin before 3.8.2 does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQ… |
CVE-2021-24758 | High | 8.8 | 2021-11-17 | The Email Log WordPress plugin before 2.4.7 does not properly validate, sanitise and escape the "orderby" and "order" GET parameters before using them in SQL s… |
CVE-2021-24598 | Medium | 4.8 | 2021-11-17 | The Testimonial WordPress plugin before 1.6.0 does not escape some testimonial fields which could allow high privilege users to perform Cross Site Scripting at… |
CVE-2021-43337 | Medium | 6.5 | 2021-11-17 | SchedMD Slurm 21.08.* before 21.08.4 has Incorrect Access Control. On sites using the new AccountingStoreFlags=job_script and/or job_env options, the access co… |
CVE-2021-3939 | High | 7.8 | 2021-11-17 | Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static… |
CVE-2021-43012 | High | 7.8 | 2021-11-16 | Adobe Prelude version 10.1 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to ac… |
CVE-2021-43011 | High | 7.8 | 2021-11-16 | Adobe Prelude version 10.1 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to ac… |
CVE-2021-42731 | High | 7.8 | 2021-11-16 | Adobe InDesign versions 16.4 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted file. An unauthenticated attacker c… |
CVE-2021-42725 | High | 7.8 | 2021-11-16 | Adobe Bridge version 11.1.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially result… |
CVE-2021-42723 | High | 7.8 | 2021-11-16 | Adobe Bridge version 11.1.1 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted SGI file, which could result in a read past… |
CVE-2021-42721 | High | 7.8 | 2021-11-16 | Acrobat Bridge versions 11.1.1 and earlier are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitr… |
CVE-2021-43013 | High | 7.8 | 2021-11-16 | Adobe Media Encoder version 15.4.1 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerabili… |
CVE-2021-42726 | High | 7.8 | 2021-11-16 | Adobe Bridge version 11.1.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially result… |
CVE-2021-26337 | Medium | 5.5 | 2021-11-16 | Insufficient DRAM address validation in System Management Unit (SMU) may result in a DMA read from invalid DRAM address to SRAM resulting in SMU not servicing… |
CVE-2021-26336 | Medium | 5.5 | 2021-11-16 | Insufficient bounds checking in System Management Unit (SMU) may cause invalid memory accesses/updates that could result in SMU hang and subsequent failure to… |
CVE-2021-26335 | High | 7.8 | 2021-11-16 | Improper input and range checking in the AMD Secure Processor (ASP) boot loader image header may allow an attacker to use attacker-controlled values prior to s… |