2021 CVEs (page 90)
Page 90 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-3945 | Medium | 6.1 | 2021-11-13 | django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3938 | Medium | 5.4 | 2021-11-13 | snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3932 | Medium | 4.3 | 2021-11-13 | twill is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3931 | Medium | 4.3 | 2021-11-13 | snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3921 | Medium | 4.3 | 2021-11-13 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3918 | Critical | 9.8 | 2021-11-13 | json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-38684 | High | 8.1 | 2021-11-13 | A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Multimedia Console. If exploited, this vulnerability allows attackers to exe… |
CVE-2021-34357 | Medium | 6.9 | 2021-11-13 | A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QmailAgent. If exploited, this vulnerability allows remote attackers… |
CVE-2021-41229 | Medium | 4.3 | 2021-11-12 | BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be… |
CVE-2021-36325 | High | 7.5 | 2021-11-12 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2021-36324 | High | 7.5 | 2021-11-12 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2021-36323 | High | 7.5 | 2021-11-12 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2021-36315 | Medium | 6.8 | 2021-11-12 | Dell EMC PowerScale Nodes contain a hardware design flaw. This may allow a local unauthenticated user to escalate privileges. This also affects Compliance mode… |
CVE-2021-36305 | Medium | 6.5 | 2021-11-12 | Dell PowerScale OneFS contains an Unsynchronized Access to Shared Data in a Multithreaded Context in SMB CA handling. An authenticated user of SMB on a cluster… |
CVE-2021-21528 | High | 7.5 | 2021-11-12 | Dell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, 9.2.1.x contain an Exposure of Information through Directory Listing vulnerability. This vulnerability is tr… |
CVE-2021-43611 | High | 7.5 | 2021-11-12 | Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via " \ " in the display name of a From header. |
CVE-2021-43610 | High | 7.5 | 2021-11-12 | Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via an invalid From header (request URI without a parameter) in an unauthenticated S… |
CVE-2021-3843 | Medium | 6.7 | 2021-11-12 | A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execu… |
CVE-2021-3840 | High | 8.8 | 2021-11-12 | A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during… |
CVE-2021-3793 | Medium | 6.5 | 2021-11-12 | An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated attacker on the sam… |
CVE-2021-3792 | Medium | 5.3 | 2021-11-12 | Some device communications in some Motorola-branded Binatone Hubble Cameras with backend Hubble services are not encrypted which could lead to the communicatio… |
CVE-2021-3791 | Medium | 6.5 | 2021-11-12 | An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same… |
CVE-2021-3790 | Medium | 6.5 | 2021-11-12 | A buffer overflow was reported in the local web server of some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the sam… |
CVE-2021-3789 | Medium | 4.2 | 2021-11-12 | An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access to obta… |
CVE-2021-3788 | Medium | 6.8 | 2021-11-12 | An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access unauthorized access… |
CVE-2021-3787 | Medium | 6.4 | 2021-11-12 | A vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with local access to obtain the MQTT credentials tha… |
CVE-2021-3786 | Medium | 4.4 | 2021-11-12 | A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data o… |
CVE-2021-3723 | High | 7.2 | 2021-11-12 | A command injection vulnerability was reported in the Integrated Management Module (IMM) of legacy IBM System x 3550 M3 and IBM System x 3650 M3 servers that c… |
CVE-2021-3720 | Medium | 5.5 | 2021-11-12 | An information disclosure vulnerability was reported in the Time Weather system widget on Legion Phone Pro (L79031) and Legion Phone2 Pro (L70081) that could a… |
CVE-2021-3719 | Medium | 6.7 | 2021-11-12 | A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some ThinkCentre and Thi… |
CVE-2021-3718 | Medium | 4.3 | 2021-11-12 | A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setting is enabled in BI… |
CVE-2021-3599 | Medium | 6.7 | 2021-11-12 | A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an attacker with local access and elevated… |
CVE-2021-3577 | High | 8.8 | 2021-11-12 | An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker on the same n… |
CVE-2021-3519 | Medium | 6.4 | 2021-11-12 | A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List"… |
CVE-2021-43332 | Medium | 6.5 | 2021-11-12 | In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potential… |
CVE-2021-43331 | Medium | 6.1 | 2021-11-12 | In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS. |
CVE-2021-42563 | High | 7.8 | 2021-11-12 | There is an Unquoted Service Path in NI Service Locator (nisvcloc.exe) in versions prior to 18.0 on Windows. This may allow an authorized local user to insert… |
CVE-2021-39303 | Critical | 9.8 | 2021-11-12 | The server in Jamf Pro before 10.32.0 has an SSRF vulnerability, aka PI-006352. NOTE: Jamf Nation will also publish an article about this vulnerability. |
CVE-2021-41972 | Medium | 6.5 | 2021-11-12 | Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-t… |
CVE-2021-41264 | Critical | 9.8 | 2021-11-12 | OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an… |
CVE-2021-41254 | High | 8.8 | 2021-11-12 | kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads defined with Kubernetes ma… |
CVE-2021-38985 | Medium | 4.3 | 2021-11-12 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the prop… |
CVE-2021-38973 | Low | 2.7 | 2021-11-12 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the prop… |
CVE-2021-38972 | Medium | 4.3 | 2021-11-12 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the prop… |
CVE-2021-43493 | High | 7.5 | 2021-11-12 | ServerManagement master branch as of commit 49491cc6f94980e6be7791d17be947c27071eb56 is affected by a directory traversal vulnerability. This vulnerability can… |
CVE-2021-43492 | High | 7.5 | 2021-11-12 | AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability. This attack can cause the discl… |
CVE-2021-43496 | High | 7.5 | 2021-11-12 | Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability. This attack can cause the di… |
CVE-2021-43494 | High | 7.5 | 2021-11-12 | OpenCV-REST-API master branch as of commit 69be158c05d4dd5a4aff38fdc680a162dd6b9e49 is affected by a directory traversal vulnerability. This attack can cause t… |
CVE-2021-3934 | High | 7.5 | 2021-11-12 | ohmyzsh is vulnerable to Improper Neutralization of Special Elements used in an OS Command |
CVE-2021-43578 | High | 8.1 | 2021-11-12 | Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its i… |
CVE-2021-43577 | High | 7.1 | 2021-11-12 | Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-43576 | Medium | 6.5 | 2021-11-12 | Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read… |
CVE-2021-21701 | Medium | 6.5 | 2021-11-12 | Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21700 | Medium | 5.4 | 2021-11-12 | Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site… |
CVE-2021-21699 | Medium | 5.4 | 2021-11-12 | Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a stor… |
CVE-2021-30321 | Critical | 9.8 | 2021-11-12 | Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer… |
CVE-2021-30284 | High | 7.5 | 2021-11-12 | Possible information exposure and denial of service due to NAS not dropping messages when integrity check fails in Snapdragon Auto, Snapdragon Compute, Snapdra… |
CVE-2021-30266 | Medium | 6.7 | 2021-11-12 | Possible use after free due to improper memory validation when initializing new interface via Interface add command in Snapdragon Auto, Snapdragon Compute, Sna… |
CVE-2021-30265 | Medium | 6.7 | 2021-11-12 | Possible memory corruption due to improper validation of memory address while processing user-space IOCTL for clearing Filter and Route statistics in Snapdrago… |
CVE-2021-30264 | Medium | 6.7 | 2021-11-12 | Possible use after free due improper validation of reference from call back to internal store table in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Con… |
CVE-2021-30263 | Medium | 6.7 | 2021-11-12 | Possible race condition can occur due to lack of synchronization mechanism when On-Device Logging node open twice concurrently in Snapdragon Compute, Snapdrago… |
CVE-2021-30259 | High | 7.8 | 2021-11-12 | Possible out of bound access due to improper validation of function table entries in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon C… |
CVE-2021-30255 | High | 7.8 | 2021-11-12 | Possible buffer overflow due to improper input validation in PDM DIAG command in FTM in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdrago… |
CVE-2021-30254 | High | 7.8 | 2021-11-12 | Possible buffer overflow due to improper input validation in factory calibration and test DIAG command in Snapdragon Auto, Snapdragon Compute, Snapdragon Conne… |
CVE-2021-1982 | High | 7.5 | 2021-11-12 | Possible denial of service scenario due to improper input validation of received NAS OTA message in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivit… |
CVE-2021-1981 | High | 7.5 | 2021-11-12 | Possible buffer over read due to improper IE size check of Bearer capability IE in MT setup request from network in Snapdragon Auto, Snapdragon Compute, Snapdr… |
CVE-2021-1979 | High | 7.8 | 2021-11-12 | Possible buffer overflow due to improper validation of FTM command payload in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer… |
CVE-2021-1975 | Critical | 9.8 | 2021-11-12 | Possible heap overflow due to improper length check of domain while parsing the DNS response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, S… |
CVE-2021-1973 | High | 7.8 | 2021-11-12 | A FTM Diag command can allow an arbitrary write into modem OS space in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, S… |
CVE-2021-1924 | Critical | 9.0 | 2021-11-12 | Information disclosure through timing and power side-channels during mod exponentiation for RSA-CRT in Snapdragon Auto, Snapdragon Compute, Snapdragon Connecti… |
CVE-2021-1921 | High | 7.8 | 2021-11-12 | Possible memory corruption due to Improper handling of hypervisor unmap operations for concurrent memory operations in Snapdragon Auto, Snapdragon Compute, Sna… |
CVE-2021-1912 | High | 8.4 | 2021-11-12 | Possible integer overflow can occur due to improper length check while calculating count and grace period in Snapdragon Auto, Snapdragon Compute, Snapdragon Co… |
CVE-2021-1903 | Medium | 5.3 | 2021-11-12 | Possible denial of service scenario can occur due to lack of length check on Channel Switch Announcement IE in beacon or probe response frame in Snapdragon Aut… |
CVE-2021-42775 | Critical | 9.1 | 2021-11-12 | Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, have a vulnerab… |
CVE-2021-42774 | Critical | 9.8 | 2021-11-12 | Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, have a buffer o… |
CVE-2021-42773 | High | 7.5 | 2021-11-12 | Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, could allow a u… |
CVE-2021-37910 | Low | 3.7 | 2021-11-12 | ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can r… |
CVE-2021-34422 | High | 7.2 | 2021-11-11 | The Keybase Client for Windows before version 5.7.0 contains a path traversal vulnerability when checking the name of a file uploaded to a team folder. A malic… |
CVE-2021-34421 | Low | 3.7 | 2021-11-11 | The Keybase Client for Android before version 5.8.0 and the Keybase Client for iOS before version 5.8.0 fails to properly remove exploded messages initiated by… |
CVE-2021-34420 | Medium | 4.7 | 2021-11-11 | The Zoom Client for Meetings for Windows installer before version 5.5.4 does not properly verify the signature of files with .msi, .ps1, and .bat extensions. T… |
CVE-2021-34419 | Low | 3.7 | 2021-11-11 | In the Zoom Client for Meetings for Ubuntu Linux before version 5.1.0, there is an HTML injection flaw when sending a remote control request to a user in the p… |
CVE-2021-34418 | Medium | 4.0 | 2021-11-11 | The login routine of the web console in the Zoom On-Premise Meeting Connector before version 4.6.239.20200613, Zoom On-Premise Meeting Connector MMR before ver… |
CVE-2021-34417 | High | 7.9 | 2021-11-11 | The network proxy page on the web portal for the Zoom On-Premise Meeting Connector Controller before version 4.6.365.20210703, Zoom On-Premise Meeting Connecto… |
CVE-2021-3912 | Medium | 4.2 | 2021-11-11 | OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a reposi… |
CVE-2021-3911 | Medium | 4.2 | 2021-11-11 | If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash. |
CVE-2021-3910 | Medium | 4.4 | 2021-11-11 | OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character). |
CVE-2021-3909 | Medium | 4.4 | 2021-11-11 | OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repo… |
CVE-2021-3908 | Medium | 5.9 | 2021-11-11 | OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end. |
CVE-2021-3907 | High | 7.4 | 2021-11-11 | OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/e… |
CVE-2021-43350 | Critical | 9.8 | 2021-11-11 | An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version… |
CVE-2021-26558 | High | 7.5 | 2021-11-11 | Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. This issue affects Apache Shardi… |
CVE-2021-25980 | High | 8.8 | 2021-11-11 | In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular thr… |
CVE-2021-43397 | High | 8.8 | 2021-11-11 | LiquidFiles before 3.6.3 allows remote attackers to elevate their privileges from Admin (or User Admin) to Sysadmin. |
CVE-2021-42847 | Critical | 9.8 | 2021-11-11 | Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files. |
CVE-2021-42002 | Critical | 9.8 | 2021-11-11 | Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution. |
CVE-2021-41833 | Critical | 9.8 | 2021-11-11 | Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution. |
CVE-2021-41081 | Critical | 9.8 | 2021-11-11 | Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search. |
CVE-2021-41080 | Critical | 9.8 | 2021-11-11 | Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a hardware details search. |
CVE-2021-43573 | Critical | 9.8 | 2021-11-11 | A buffer overflow was discovered on Realtek RTL8195AM devices before 2.0.10. It exists in the client code when processing a malformed IE length of HT capabilit… |
CVE-2021-40873 | High | 7.5 | 2021-11-10 | An issue was discovered in Softing Industrial Automation OPC UA C++ SDK before 5.66, and uaToolkit Embedded before 1.40. Remote attackers to cause a denial of… |