2021 CVEs (page 89)
Page 89 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-26331 | High | 7.8 | 2021-11-16 | AMD System Management Unit (SMU) contains a potential issue where a malicious user may be able to manipulate mailbox entries leading to arbitrary code executio… |
CVE-2021-26330 | Medium | 5.5 | 2021-11-16 | AMD System Management Unit (SMU) may experience a heap-based overflow which may result in a loss of resources. |
CVE-2021-26327 | Medium | 5.5 | 2021-11-16 | Insufficient validation of guest context in the SNP Firmware could lead to a potential loss of guest confidentiality. |
CVE-2021-26325 | Medium | 5.5 | 2021-11-16 | Insufficient input validation in the SNP_GUEST_REQUEST command may lead to a potential data abort error and a denial of service. |
CVE-2021-26323 | High | 7.8 | 2021-11-16 | Failure to validate SEV Commands while SNP is active may result in a potential impact to memory integrity. |
CVE-2021-26321 | Medium | 5.5 | 2021-11-16 | Insufficient ID command validation in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP. |
CVE-2021-26320 | Medium | 5.5 | 2021-11-16 | Insufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV Firmware may allow a local authenticated attacker to perform a de… |
CVE-2021-26315 | High | 7.8 | 2021-11-16 | When the AMD Platform Security Processor (PSP) boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient verification of th… |
CVE-2021-43048 | Critical | 9.8 | 2021-11-16 | The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain a vulnerability that theoretically allows an unauthenti… |
CVE-2021-43047 | Critical | 9.0 | 2021-11-16 | The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain easily exploitable Stored and Reflected Cross Site Scri… |
CVE-2021-43046 | High | 7.5 | 2021-11-16 | The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain an easily exploitable vulnerability that allows an unau… |
CVE-2021-41258 | High | 7.3 | 2021-11-16 | Kirby is an open source file structured CMS. In affected versions Kirby's blocks field stores structured data for each block. This data is then used in block s… |
CVE-2021-41252 | High | 7.3 | 2021-11-16 | Kirby is an open source file structured CMS ### Impact Kirby's writer field stores its formatted content as HTML code. Unlike with other field types, it is not… |
CVE-2021-26338 | High | 7.5 | 2021-11-16 | Improper access controls in System Management Unit (SMU) may allow for an attacker to override performance control tables located in DRAM resulting in a potent… |
CVE-2021-26329 | Medium | 5.5 | 2021-11-16 | AMD System Management Unit (SMU) may experience an integer overflow when an invalid length is provided which may result in a potential loss of resources. |
CVE-2021-26326 | High | 7.8 | 2021-11-16 | Failure to validate VM_HSAVE_PA during SNP_INIT may result in a loss of memory integrity. |
CVE-2021-26322 | High | 7.5 | 2021-11-16 | Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”. |
CVE-2021-26312 | Medium | 5.5 | 2021-11-16 | Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be abl… |
CVE-2021-38949 | Medium | 5.5 | 2021-11-16 | IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 211403. |
CVE-2021-38882 | Medium | 4.4 | 2021-11-16 | IBM Spectrum Scale 5.1.0 through 5.1.1.1 could allow a privileged admin to destroy filesystem audit logging records before expiration time. IBM X-Force ID: 209… |
CVE-2021-43362 | Critical | 9.9 | 2021-11-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MedData HBYS allows SQL Injection.This issue affects HBYS… |
CVE-2021-43361 | Critical | 9.9 | 2021-11-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MedData HBYS allows SQL Injection.This issue affects HBYS… |
CVE-2021-3958 | Critical | 9.8 | 2021-11-16 | Improper Handling of Parameters vulnerability in Ipack Automation Systems Ipack SCADA Software allows : Blind SQL Injection.This issue affects Ipack SCADA Soft… |
CVE-2021-42114 | Critical | 9.0 | 2021-11-16 | Modern DRAM devices (PC-DDR4, LPDDR4X) are affected by a vulnerability in their internal Target Row Refresh (TRR) mitigation against Rowhammer attacks. Novel n… |
CVE-2021-37580 | Critical | 9.8 | 2021-11-16 | A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apac… |
CVE-2021-25985 | High | 7.8 | 2021-11-16 | In Factor (App Framework & Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition… |
CVE-2021-25984 | Medium | 6.1 | 2021-11-16 | In Factor (App Framework & Headless CMS) forum plugin, versions v1.3.3 to v1.8.30, are vulnerable to stored Cross-Site Scripting (XSS) at the “post reply” sect… |
CVE-2021-25983 | Medium | 6.1 | 2021-11-16 | In Factor (App Framework & Headless CMS) forum plugin, versions v1.3.8 to v1.8.30, are vulnerable to reflected Cross-Site Scripting (XSS) at the “tags” and “ca… |
CVE-2021-25982 | Medium | 6.1 | 2021-11-16 | In Factor (App Framework & Headless CMS) forum plugin, versions 1.3.5 to 1.8.30, are vulnerable to reflected Cross-Site Scripting (XSS) at the “search” paramet… |
CVE-2021-25965 | High | 8.8 | 2021-11-16 | In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF). By luring an authenticated user to click on a link, an attacker c… |
CVE-2021-25940 | High | 8.8 | 2021-11-16 | In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the sess… |
CVE-2021-25976 | High | 8.1 | 2021-11-16 | In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management s… |
CVE-2021-42337 | Medium | 4.3 | 2021-11-16 | The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the remote attacker ca… |
CVE-2021-41271 | Medium | 4.8 | 2021-11-15 | Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cached by intermediate… |
CVE-2021-42386 | High | 7.2 | 2021-11-15 | A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function |
CVE-2021-42385 | High | 7.2 | 2021-11-15 | A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function |
CVE-2021-42384 | High | 7.2 | 2021-11-15 | A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special fun… |
CVE-2021-42383 | High | 7.2 | 2021-11-15 | A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function |
CVE-2021-42382 | High | 7.2 | 2021-11-15 | A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function |
CVE-2021-42381 | High | 7.2 | 2021-11-15 | A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function |
CVE-2021-42380 | High | 7.2 | 2021-11-15 | A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function |
CVE-2021-42379 | High | 7.2 | 2021-11-15 | A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file fu… |
CVE-2021-42378 | High | 7.2 | 2021-11-15 | A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function |
CVE-2021-42377 | Critical | 9.8 | 2021-11-15 | An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, du… |
CVE-2021-42376 | Medium | 5.5 | 2021-11-15 | A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03… |
CVE-2021-42375 | Medium | 5.5 | 2021-11-15 | An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaki… |
CVE-2021-42374 | Medium | 5.3 | 2021-11-15 | An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This… |
CVE-2021-42373 | Medium | 5.5 | 2021-11-15 | A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given |
CVE-2021-41269 | Critical | 10.0 | 2021-11-15 | cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Inj… |
CVE-2021-41266 | High | 8.6 | 2021-11-15 | Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versions are subject to… |
CVE-2021-41263 | High | 8.3 | 2021-11-15 | rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications using `rails_multisite… |
CVE-2021-41244 | Critical | 9.1 | 2021-11-15 | Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled and ther… |
CVE-2021-39222 | Medium | 6.4 | 2021-11-15 | Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting (XSS) vulnerabil… |
CVE-2021-42580 | Critical | 9.8 | 2021-11-15 | Sourcecodester Online Learning System 2.0 is vunlerable to sql injection authentication bypass in admin login file (/admin/login.php) and authenticated file up… |
CVE-2021-41951 | Medium | 6.1 | 2021-11-15 | ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_use… |
CVE-2021-41950 | Critical | 9.1 | 2021-11-15 | A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace se… |
CVE-2021-41765 | Critical | 9.8 | 2021-11-15 | A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute a… |
CVE-2021-38984 | High | 7.5 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sen… |
CVE-2021-38983 | High | 7.5 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sen… |
CVE-2021-38982 | Medium | 5.4 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2021-38981 | Medium | 5.3 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message… |
CVE-2021-38979 | High | 7.5 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be reversible, such as a password… |
CVE-2021-38978 | Medium | 5.9 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enab… |
CVE-2021-38977 | Medium | 4.3 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able t… |
CVE-2021-38976 | Medium | 5.5 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read by a local user. X-Force ID: 212781. |
CVE-2021-38975 | Medium | 6.5 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to to obtain sensitive information from a specially crafted HTTP re… |
CVE-2021-38974 | Medium | 6.5 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to cause a denial of service using specially crafted HTTP requests… |
CVE-2021-34992 | High | 8.8 | 2021-11-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS 6.10. Authentication is required to exploit… |
CVE-2021-34991 | High | 8.8 | 2021-11-15 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400v2 1.0.4.106_10.0.80 routers. Authenti… |
CVE-2021-43574 | Medium | 6.1 | 2021-11-15 | WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI. NOTE: This vulnerability only affec… |
CVE-2021-42703 | Medium | 5.4 | 2021-11-15 | This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user t… |
CVE-2021-22959 | Medium | 6.5 | 2021-11-15 | The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4… |
CVE-2021-42706 | High | 7.8 | 2021-11-15 | This vulnerability could allow an attacker to disclose information and execute arbitrary code on affected installations of WebAccess/MHI Designer |
CVE-2021-43495 | High | 7.5 | 2021-11-15 | AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability in alquist/IO/input.py. This att… |
CVE-2021-42839 | High | 8.8 | 2021-11-15 | Grand Vice info Co. webopac7 file upload function fails to filter special characters. While logging in with general user’s permission, remote attackers can upl… |
CVE-2021-42838 | Medium | 6.1 | 2021-11-15 | Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject… |
CVE-2021-41289 | Medium | 6.3 | 2021-11-15 | ASUS P453UJ contains the Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability. With a general user’s permission, local attacke… |
CVE-2021-43620 | High | 7.5 | 2021-11-15 | An issue was discovered in the fruity crate through 0.2.0 for Rust. Security-relevant validation of filename extensions is plausibly affected. Methods of NSStr… |
CVE-2021-43618 | High | 7.5 | 2021-11-15 | GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to… |
CVE-2021-43391 | High | 7.8 | 2021-11-14 | An Out-of-Bounds Read vulnerability exists when reading a DXF file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the… |
CVE-2021-43390 | High | 7.8 | 2021-11-14 | An Out-of-Bounds Write vulnerability exists when reading a DGN file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within th… |
CVE-2021-43336 | High | 7.8 | 2021-11-14 | An Out-of-Bounds Write vulnerability exists when reading a DXF or DWG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists wi… |
CVE-2021-43280 | High | 7.8 | 2021-11-14 | A stack-based buffer overflow vulnerability exists in the DWF file reading procedure in Open Design Alliance Drawings SDK before 2022.8. The issue results from… |
CVE-2021-43279 | High | 7.8 | 2021-11-14 | An out-of-bounds write vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before 2022.10. Crafted data in a U3D file can tr… |
CVE-2021-43278 | High | 7.8 | 2021-11-14 | An Out-of-bounds Read vulnerability exists in the OBJ file reading procedure in Open Design Alliance Drawings SDK before 2022.11. The lack of validating the in… |
CVE-2021-43277 | High | 7.8 | 2021-11-14 | An out-of-bounds read vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before 2022.10. Crafted data in a U3D file can tri… |
CVE-2021-43276 | High | 7.8 | 2021-11-14 | An Out-of-bounds Read vulnerability exists in Open Design Alliance ODA Viewer before 2022.8. Crafted data in a DWF file can trigger a read past the end of an a… |
CVE-2021-43275 | High | 7.8 | 2021-11-14 | A Use After Free vulnerability exists in the DGN file reading procedure in Open Design Alliance Drawings SDK before 2022.8. The issue results from the lack of… |
CVE-2021-43274 | High | 7.8 | 2021-11-14 | A Use After Free Vulnerability exists in the Open Design Alliance Drawings SDK before 2022.11. The specific flaw exists within the parsing of DWF files. The is… |
CVE-2021-43273 | Low | 3.3 | 2021-11-14 | An Out-of-bounds Read vulnerability exists in the DGN file reading procedure in Open Design Alliance Drawings SDK before 2022.11. Crafted data in a DGN file an… |
CVE-2021-43272 | Critical | 9.8 | 2021-11-14 | An improper handling of exceptional conditions vulnerability exists in Open Design Alliance ODA Viewer sample before 2022.11. ODA Viewer continues to process i… |
CVE-2021-41057 | High | 7.1 | 2021-11-14 | In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions. |
CVE-2021-26795 | High | 8.8 | 2021-11-14 | A SQL Injection vulnerability in /appliance/shiftmgn.php in TalariaX sendQuick Alert Plus Server Admin 4.3 before 8HF11 allows attackers to obtain sensitive in… |
CVE-2021-43617 | Critical | 9.8 | 2021-11-14 | Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.ph… |
CVE-2021-43616 | Critical | 9.0 | 2021-11-13 | The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json… |
CVE-2021-41653 | Critical | 9.8 | 2021-11-13 | The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payl… |
CVE-2021-3915 | Medium | 5.7 | 2021-11-13 | bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type |
CVE-2021-3776 | Medium | 5.4 | 2021-11-13 | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3775 | Medium | 5.4 | 2021-11-13 | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3683 | Medium | 6.5 | 2021-11-13 | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) |