2021 CVEs (page 92)
Page 92 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-37158 | High | 8.8 | 2021-11-10 | An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. An authenticated attacker could inject OS commands by starting a Counter-Strike se… |
CVE-2021-37157 | High | 8.8 | 2021-11-10 | An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. $HOME/OGP/Cfg/Config.pm has the root password in cleartext. |
CVE-2021-43575 | Medium | 5.5 | 2021-11-09 | KNX ETS6 through 6.0.0 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project information, a simil… |
CVE-2021-35489 | Medium | 6.1 | 2021-11-09 | Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflected XSS via the host or service parameter… |
CVE-2021-35488 | Medium | 6.1 | 2021-11-09 | Thruk 2.40-2 allows /thruk/#cgi-bin/status.cgi?style=combined&title={TITLE] Reflected XSS via the host or title parameter. An attacker could inject arbitrary J… |
CVE-2021-43572 | Critical | 9.8 | 2021-11-09 | The verify function in the Stark Bank Python ECDSA library (aka starkbank-escada or ecdsa-python) before 2.0.1 fails to check that the signature is non-zero, w… |
CVE-2021-43571 | Critical | 9.8 | 2021-11-09 | The verify function in the Stark Bank Node.js ECDSA library (ecdsa-node) 1.1.2 fails to check that the signature is non-zero, which allows attackers to forge s… |
CVE-2021-43570 | Critical | 9.8 | 2021-11-09 | The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge sign… |
CVE-2021-43569 | Critical | 9.8 | 2021-11-09 | The verify function in the Stark Bank .NET ECDSA library (ecdsa-dotnet) 1.3.1 fails to check that the signature is non-zero, which allows attackers to forge si… |
CVE-2021-43568 | Critical | 9.8 | 2021-11-09 | The verify function in the Stark Bank Elixir ECDSA library (ecdsa-elixir) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge… |
CVE-2021-20119 | High | 7.1 | 2021-11-09 | The password change utility for the Arris SurfBoard SB8200 can have safety measures bypassed that allow any logged-in user to change the administrator password. |
CVE-2021-43174 | High | 7.5 | 2021-11-09 | NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. This encoding can be used… |
CVE-2021-43173 | High | 7.5 | 2021-11-09 | In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to… |
CVE-2021-43172 | High | 7.5 | 2021-11-09 | NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run. In RPKI, a… |
CVE-2021-43182 | High | 7.5 | 2021-11-09 | In JetBrains Hub before 2021.1.13415, a DoS via user information is possible. |
CVE-2021-43181 | Medium | 6.1 | 2021-11-09 | In JetBrains Hub before 2021.1.13690, stored XSS is possible. |
CVE-2021-43180 | High | 7.5 | 2021-11-09 | In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible. |
CVE-2021-43203 | High | 7.5 | 2021-11-09 | In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly. |
CVE-2021-43201 | Medium | 5.3 | 2021-11-09 | In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project. |
CVE-2021-43200 | Critical | 9.8 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient. |
CVE-2021-43199 | Medium | 5.3 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient. |
CVE-2021-43198 | Medium | 5.4 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, stored XSS is possible. |
CVE-2021-43197 | Medium | 6.1 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS. |
CVE-2021-43196 | High | 7.5 | 2021-11-09 | In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible. |
CVE-2021-43195 | Medium | 5.3 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing. |
CVE-2021-43194 | Medium | 5.3 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, user enumeration was possible. |
CVE-2021-43193 | Critical | 9.8 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible. |
CVE-2021-43192 | Medium | 5.3 | 2021-11-09 | In JetBrains YouTrack Mobile before 2021.2, iOS URL scheme hijacking is possible. |
CVE-2021-43191 | Medium | 5.3 | 2021-11-09 | JetBrains YouTrack Mobile before 2021.2, is missing the security screen on Android and iOS. |
CVE-2021-43190 | Medium | 5.3 | 2021-11-09 | In JetBrains YouTrack Mobile before 2021.2, task hijacking on Android is possible. |
CVE-2021-43189 | High | 7.3 | 2021-11-09 | In JetBrains YouTrack Mobile before 2021.2, access token protection on Android is incomplete. |
CVE-2021-43188 | High | 7.3 | 2021-11-09 | In JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete. |
CVE-2021-43187 | Medium | 5.3 | 2021-11-09 | In JetBrains YouTrack Mobile before 2021.2, the client-side cache on iOS could contain sensitive information. |
CVE-2021-43186 | Medium | 5.4 | 2021-11-09 | JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS. |
CVE-2021-43185 | Critical | 9.8 | 2021-11-09 | JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. |
CVE-2021-43184 | Medium | 5.4 | 2021-11-09 | In JetBrains YouTrack before 2021.3.21051, stored XSS is possible. |
CVE-2021-43183 | Critical | 9.8 | 2021-11-09 | In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed. |
CVE-2021-3641 | Medium | 6.1 | 2021-11-09 | Improper Link Resolution Before File Access ('Link Following') vulnerability in the EPAG component of Bitdefender Endpoint Security Tools for Windows allows a… |
CVE-2021-43519 | Medium | 5.5 | 2021-11-09 | Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file. |
CVE-2021-43114 | High | 7.5 | 2021-11-09 | FORT Validator versions prior to 1.5.2 will crash if an RPKI CA publishes an X.509 EE certificate. This will lead to RTR clients such as BGP routers to lose ac… |
CVE-2021-43466 | Critical | 9.8 | 2021-11-09 | In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution. |
CVE-2021-42026 | Medium | 4.3 | 2021-11-09 | A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (All versions < V9.6.2)… |
CVE-2021-42025 | Medium | 6.5 | 2021-11-09 | A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (All versions < V9.6.2)… |
CVE-2021-42021 | High | 7.5 | 2021-11-09 | A vulnerability has been identified in Siveillance Video DLNA Server (2019 R1), Siveillance Video DLNA Server (2019 R2), Siveillance Video DLNA Server (2019 R3… |
CVE-2021-42015 | Medium | 5.5 | 2021-11-09 | A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.26), Mendix Applications using Mendix 8 (All versions < V8.18.1… |
CVE-2021-40366 | High | 7.4 | 2021-11-09 | A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.42), Climatix POL909 (AWM module) (All versions < V11.34). The web serv… |
CVE-2021-40364 | Medium | 5.5 | 2021-11-09 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions <… |
CVE-2021-40359 | High | 7.7 | 2021-11-09 | A vulnerability has been identified in OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd4), OpenPCS 7 V9.1 (All versions), SIMATIC BATCH V… |
CVE-2021-40358 | Critical | 9.9 | 2021-11-09 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions <… |
CVE-2021-37207 | High | 7.8 | 2021-11-09 | A vulnerability has been identified in SENTRON powermanager V3 (All versions). The affected application assigns improper access rights to a specific folder con… |
CVE-2021-31890 | High | 7.5 | 2021-11-09 | A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTR… |
CVE-2021-31889 | High | 7.5 | 2021-11-09 | A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTR… |
CVE-2021-31888 | High | 8.8 | 2021-11-09 | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All… |
CVE-2021-31887 | High | 8.8 | 2021-11-09 | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All… |
CVE-2021-31886 | Critical | 9.8 | 2021-11-09 | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All… |
CVE-2021-31885 | High | 7.5 | 2021-11-09 | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All… |
CVE-2021-31884 | Critical | 9.8 | 2021-11-09 | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All… |
CVE-2021-31883 | High | 7.1 | 2021-11-09 | A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). When proc… |
CVE-2021-31882 | Medium | 6.5 | 2021-11-09 | A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). The DHCP… |
CVE-2021-31881 | High | 7.1 | 2021-11-09 | A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). When proc… |
CVE-2021-31346 | High | 8.2 | 2021-11-09 | A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTR… |
CVE-2021-31345 | High | 7.5 | 2021-11-09 | A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTR… |
CVE-2021-31344 | Medium | 5.3 | 2021-11-09 | A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTR… |
CVE-2021-41253 | Medium | 5.9 | 2021-11-08 | Zydis is an x86/x86-64 disassembler library. Users of Zydis versions v3.2.0 and older that use the string functions provided in `zycore` in order to append unt… |
CVE-2021-40261 | Medium | 6.1 | 2021-11-08 | Multiple Cross Site Scripting (XSS) vulnerabilities exist in SourceCodester CASAP Automated Enrollment System 1.0 via the (1) user_username and (2) category pa… |
CVE-2021-40260 | Medium | 6.1 | 2021-11-08 | Multiple Cross Site Scripting (XSS) vulnerabilities exist in SourceCodester Tailor Management 1.0 via the (1) eid parameter in (a) partedit.php and (b) custome… |
CVE-2021-41170 | Critical | 9.8 | 2021-11-08 | neoan3-apps/template is a neoan3 minimal template engine. Versions prior to 1.1.1 have allowed for passing in closures directly into the template engine. As a… |
CVE-2021-39420 | Medium | 6.1 | 2021-11-08 | Multiple Cross Site Scripting (XSS) vulnerabilities exist in VFront 0.99.5 via the (1) s parameter in search_all.php and the (2) msg parameter in add.attach.ph… |
CVE-2021-40577 | Medium | 5.4 | 2021-11-08 | A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Enrollment Management System in PHP and PayPal Free Source Code 1.0 in the Ad… |
CVE-2021-24844 | High | 7.2 | 2021-11-08 | The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leadin… |
CVE-2021-24840 | Medium | 5.3 | 2021-11-08 | The Squaretype WordPress theme before 3.0.4 allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display in one of its REST… |
CVE-2021-24835 | High | 8.8 | 2021-11-08 | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with… |
CVE-2021-24832 | Medium | 4.3 | 2021-11-08 | The WP SEO Redirect 301 WordPress plugin before 2.3.2 does not have CSRF in place when deleting redirects, which could allow attackers to make a logged in admi… |
CVE-2021-24829 | High | 8.8 | 2021-11-08 | The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_index AJAX action (ava… |
CVE-2021-24827 | Critical | 9.8 | 2021-11-08 | The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leadi… |
CVE-2021-24816 | Medium | 4.3 | 2021-11-08 | The Phoenix Media Rename WordPress plugin before 3.4.4 does not have capability checks in its phoenix_media_rename AJAX action, which could allow users with Au… |
CVE-2021-24807 | Medium | 5.4 | 2021-11-08 | The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes f… |
CVE-2021-24806 | Medium | 4.3 | 2021-11-08 | The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users s… |
CVE-2021-24801 | Medium | 4.3 | 2021-11-08 | The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them an… |
CVE-2021-24798 | Medium | 6.1 | 2021-11-08 | The WP Header Images WordPress plugin before 2.0.1 does not sanitise and escape the t parameter before outputting it back in the plugin's settings page, leadin… |
CVE-2021-24791 | High | 7.2 | 2021-11-08 | The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a… |
CVE-2021-24788 | Medium | 6.5 | 2021-11-08 | The Batch Cat WordPress plugin through 0.3 defines 3 custom AJAX actions, which both require authentication but are available for all roles. As a result, any a… |
CVE-2021-24783 | Medium | 6.5 | 2021-11-08 | The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to… |
CVE-2021-24767 | Medium | 6.5 | 2021-11-08 | The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow at… |
CVE-2021-24766 | Medium | 6.5 | 2021-11-08 | The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place when cleaning the logs, which could allow… |
CVE-2021-24731 | Critical | 9.8 | 2021-11-08 | The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not proper… |
CVE-2021-24721 | Medium | 6.5 | 2021-11-08 | The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulti… |
CVE-2021-24710 | Medium | 4.8 | 2021-11-08 | The Print-O-Matic WordPress plugin before 2.0.3 does not escape some of its settings before outputting them in attribute, which could allow high privilege user… |
CVE-2021-24708 | Medium | 4.8 | 2021-11-08 | The Export any WordPress data to XML/CSV WordPress plugin before 1.3.1 does not escape its Export's Name before outputting it in Manage Exports settings, which… |
CVE-2021-24706 | Medium | 4.8 | 2021-11-08 | The Qwizcards – online quizzes and flashcards WordPress plugin before 3.62 does not properly sanitize and escape some of its settings, allowing high privilege… |
CVE-2021-24701 | Medium | 4.8 | 2021-11-08 | The Quiz Tool Lite WordPress plugin through 2.3.15 does not sanitize multiple input fields used when creating or managing quizzes and in other setting options… |
CVE-2021-24698 | Medium | 4.3 | 2021-11-08 | The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, e… |
CVE-2021-24697 | Medium | 6.1 | 2021-11-08 | The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date PO… |
CVE-2021-24695 | High | 7.5 | 2021-11-08 | The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place… |
CVE-2021-24693 | Critical | 9.0 | 2021-11-08 | The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow… |
CVE-2021-24674 | Medium | 6.5 | 2021-11-08 | The Genie WP Favicon WordPress plugin through 0.5.2 does not have CSRF in place when updating the favicon, which could allow attackers to make a logged in admi… |
CVE-2021-24669 | High | 8.8 | 2021-11-08 | The MAZ Loader – Preloader Builder for WordPress plugin before 1.3.3 does not validate or escape the loader_id parameter of the mzldr shortcode, which allows u… |
CVE-2021-24664 | Medium | 4.8 | 2021-11-08 | The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitize_text_field() but does not escape them before ou… |
CVE-2021-24647 | High | 8.1 | 2021-11-08 | The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in t… |
CVE-2021-24646 | Medium | 4.8 | 2021-11-08 | The Booking.com Banner Creator WordPress plugin before 1.4.3 does not properly sanitize inputs when creating banners, which could allow high privilege users to… |