2021 CVEs (page 93)
Page 93 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-24645 | Medium | 4.8 | 2021-11-08 | The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode, which could allow high… |
CVE-2021-24631 | High | 8.8 | 2021-11-08 | The Unlimited PopUps WordPress plugin through 4.5.3 does not sanitise or escape the did GET parameter before using it in a SQL statement, available to users as… |
CVE-2021-24630 | High | 8.8 | 2021-11-08 | The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard… |
CVE-2021-24629 | High | 7.2 | 2021-11-08 | The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin… |
CVE-2021-24628 | High | 7.2 | 2021-11-08 | The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the… |
CVE-2021-24627 | High | 7.2 | 2021-11-08 | The G Auto-Hyperlink WordPress plugin through 1.0.1 does not sanitise or escape an 'id' GET parameter before using it in a SQL statement, to select data to be… |
CVE-2021-24626 | High | 8.8 | 2021-11-08 | The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as sub… |
CVE-2021-24625 | High | 7.2 | 2021-11-08 | The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them… |
CVE-2021-24616 | Medium | 4.8 | 2021-11-08 | The AddToAny Share Buttons WordPress plugin before 1.7.48 does not escape its Image URL button setting, which could lead allow high privilege users to perform… |
CVE-2021-24607 | Medium | 4.8 | 2021-11-08 | The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the "Footer Credit Text" added to pages, allowing high privilege users t… |
CVE-2021-24594 | Medium | 4.8 | 2021-11-08 | The Translate WordPress – Google Language Translator WordPress plugin before 6.0.12 does not sanitise and escape some of its settings before outputting it in v… |
CVE-2021-24575 | High | 8.8 | 2021-11-08 | The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before using POST variable in… |
CVE-2021-24537 | High | 7.2 | 2021-11-08 | The Similar Posts WordPress plugin through 3.1.5 allow high privilege users to execute arbitrary PHP code in an hardened environment (ie with DISALLOW_FILE_EDI… |
CVE-2021-29843 | Medium | 6.5 | 2021-11-08 | IBM MQ 9.1 LTS, 9.1 CD, 9.2 LTS, and 9.2CD is vulnerable to a denial of service attack caused by an issue processing message properties. IBM X-Force ID: 205203. |
CVE-2021-29735 | Medium | 5.4 | 2021-11-08 | IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, and 11.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri… |
CVE-2021-42770 | Medium | 6.1 | 2021-11-08 | A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester. |
CVE-2021-41733 | Medium | 6.1 | 2021-11-08 | Oppia 3.1.4 does not verify that certain URLs are valid before navigating to them. |
CVE-2021-39182 | High | 7.5 | 2021-11-08 | EnroCrypt is a Python module for encryption and hashing. Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing file. Beginners who ar… |
CVE-2021-28024 | Critical | 9.8 | 2021-11-08 | Unauthorized system access in the login form in ServiceTonic Helpdesk software version < 9.0.35937 allows attacker to login without using a password. |
CVE-2021-28023 | Critical | 9.8 | 2021-11-08 | Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version < 9.0.35937 allows a malicious user to execute JSP code by uploading… |
CVE-2021-28022 | High | 7.5 | 2021-11-08 | Blind SQL injection in the login form in ServiceTonic Helpdesk software < 9.0.35937 allows attacker to exfiltrate information via specially crafted HQL-compati… |
CVE-2021-25979 | Critical | 9.8 | 2021-11-08 | Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation… |
CVE-2021-37850 | Medium | 5.5 | 2021-11-08 | ESET was made aware of a vulnerability in its consumer and business products for macOS that enables a user logged on to the system to stop the ESET daemon, eff… |
CVE-2021-32483 | Medium | 5.3 | 2021-11-08 | Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges to view the restricted Dashboard. |
CVE-2021-30132 | Critical | 9.8 | 2021-11-08 | Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges. |
CVE-2021-22051 | Medium | 6.5 | 2021-11-08 | Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affec… |
CVE-2021-32482 | Medium | 6.1 | 2021-11-08 | Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter. |
CVE-2021-32481 | Medium | 6.1 | 2021-11-08 | Cloudera Hue 4.6.0 allows XSS via the type parameter. |
CVE-2021-29994 | Medium | 6.1 | 2021-11-08 | Cloudera Hue 4.6.0 allows XSS. |
CVE-2021-29243 | Medium | 6.1 | 2021-11-08 | Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS. |
CVE-2021-41772 | High | 7.5 | 2021-11-08 | Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename fi… |
CVE-2021-41771 | High | 7.5 | 2021-11-08 | ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an… |
CVE-2021-42372 | High | 8.8 | 2021-11-08 | A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers to execute arbitrary… |
CVE-2021-42371 | Critical | 9.8 | 2021-11-08 | lpar2rrd is a hardcoded system account in XoruX LPAR2RRD and STOR2RRD before 7.30. |
CVE-2021-42370 | High | 7.5 | 2021-11-08 | A password mismanagement situation exists in XoruX LPAR2RRD and STOR2RRD before 7.30 because cleartext information is present in HTML password input fields in… |
CVE-2021-42078 | Medium | 6.1 | 2021-11-08 | PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting (XSS), as demonstrated by the /server/ajax/events_manager.php title parameter. Thi… |
CVE-2021-42077 | Critical | 9.8 | 2021-11-08 | PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter. This can be used to execute… |
CVE-2021-42076 | High | 7.5 | 2021-11-08 | An issue was discovered in Barrier before 2.3.4. An attacker can cause memory exhaustion in the barriers component (aka the server-side implementation of Barri… |
CVE-2021-42075 | High | 7.5 | 2021-11-08 | An issue was discovered in Barrier before 2.3.4. The barriers component (aka the server-side implementation of Barrier) does not correctly close file descripto… |
CVE-2021-42074 | High | 7.5 | 2021-11-08 | An issue was discovered in Barrier before 2.3.4. An unauthenticated attacker can cause a segmentation fault in the barriers component (aka the server-side impl… |
CVE-2021-42073 | High | 8.2 | 2021-11-08 | An issue was discovered in Barrier before 2.4.0. An attacker can enter an active session state with the barriers component (aka the server-side implementation… |
CVE-2021-42072 | High | 8.8 | 2021-11-08 | An issue was discovered in Barrier before 2.4.0. The barriers component (aka the server-side implementation of Barrier) does not sufficiently verify the identi… |
CVE-2021-34685 | Low | 2.7 | 2021-11-08 | UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authenticated user to upl… |
CVE-2021-34684 | Critical | 9.8 | 2021-11-08 | Hitachi Vantara Pentaho Business Analytics through 9.1 allows an unauthenticated user to execute arbitrary SQL queries on any Pentaho data source and thus retr… |
CVE-2021-31602 | Medium | 5.3 | 2021-11-08 | An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. The Security Model has different layers of… |
CVE-2021-31601 | High | 7.1 | 2021-11-08 | An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services us… |
CVE-2021-31600 | Medium | 4.3 | 2021-11-08 | An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services us… |
CVE-2021-31599 | High | 8.8 | 2021-11-08 | An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. A reports (.prpt) file allows the inclusio… |
CVE-2021-43414 | High | 7.0 | 2021-11-07 | An issue was discovered in GNU Hurd before 0.9 20210404-9. The use of an authentication protocol in the proc server is vulnerable to man-in-the-middle attacks… |
CVE-2021-43413 | High | 8.8 | 2021-11-07 | An issue was discovered in GNU Hurd before 0.9 20210404-9. A single pager port is shared among everyone who mmaps a file, allowing anyone to modify any files t… |
CVE-2021-43412 | High | 7.8 | 2021-11-07 | An issue was discovered in GNU Hurd before 0.9 20210404-9. libports accepts fake notification messages from any client on any port, which can lead to port use-… |
CVE-2021-43411 | High | 7.5 | 2021-11-07 | An issue was discovered in GNU Hurd before 0.9 20210404-9. When trying to exec a setuid executable, there's a window of time when the process already has the n… |
CVE-2021-25978 | Medium | 5.4 | 2021-11-07 | Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Im… |
CVE-2021-37471 | High | 7.5 | 2021-11-07 | Cradlepoint IBR900-600 devices running versions < 7.21.10 are vulnerable to a restricted shell escape sequence that provides an attacker the capability to simu… |
CVE-2021-41251 | Medium | 5.9 | 2021-11-05 | @sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions. This affects application… |
CVE-2021-41250 | Medium | 4.3 | 2021-11-05 | Python discord bot is the community bot for the Python Discord community. In affected versions when a non-blacklisted URL and an otherwise triggering filter to… |
CVE-2021-41230 | Medium | 5.3 | 2021-11-05 | Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in poli… |
CVE-2021-41228 | High | 7.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's `saved_model_cli` tool is vulnerable to a code injection as it ca… |
CVE-2021-41227 | Medium | 6.6 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the `ImmutableConst` operation in TensorFlow can be tricked into reading arbit… |
CVE-2021-41225 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's Grappler optimizer has a use of unitialized variable. If the `tra… |
CVE-2021-41222 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SplitV` can trigger a segfault is an attacker supplies… |
CVE-2021-41221 | High | 7.8 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for the `Cudnn*` operations in TensorFlow can be tric… |
CVE-2021-41220 | High | 7.8 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the async implementation of `CollectiveReduceV2` suffers from a memory leak an… |
CVE-2021-41216 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the shape inference function for `Transpose` is vulnerable to a heap buffer ov… |
CVE-2021-41213 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the code behind `tf.function` API can be made to deadlock when two `tf.functio… |
CVE-2021-41218 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `AllToAll` can be made to execute a division by 0… |
CVE-2021-41209 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the implementations for convolution operators trigger a division by 0 if passe… |
CVE-2021-41208 | High | 8.8 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the code for boosted trees in TensorFlow is still missing validation. As a res… |
CVE-2021-41207 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the implementation of `ParallelConcat` misses some input validation and can pr… |
CVE-2021-41206 | High | 7.0 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions several TensorFlow operations are missing validation for the shapes of the ten… |
CVE-2021-41202 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions while calculating the size of the output within the `tf.range` kernel, there i… |
CVE-2021-42359 | High | 7.5 | 2021-11-05 | WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthe… |
CVE-2021-41226 | High | 7.1 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseBinCount` is vulnerable to a heap OOB access. Thi… |
CVE-2021-41224 | High | 7.1 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseFillEmptyRows` can be made to trigger a heap OOB… |
CVE-2021-41223 | High | 7.1 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the implementation of `FusedBatchNorm` kernels is vulnerable to a heap OOB acc… |
CVE-2021-41219 | High | 7.8 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the code for sparse matrix multiplication is vulnerable to undefined behavior… |
CVE-2021-41217 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the process of building the control flow graph for a TensorFlow model is vulne… |
CVE-2021-41215 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `DeserializeSparse` can trigger a null pointer de… |
CVE-2021-41214 | High | 7.8 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `tf.ragged.cross` has an undefined behavior due t… |
CVE-2021-41212 | High | 7.1 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `tf.ragged.cross` can trigger a read outside of b… |
CVE-2021-41211 | High | 7.1 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `QuantizeV2` can trigger a read outside of bounds… |
CVE-2021-41205 | High | 7.1 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for the `QuantizeAndDequantizeV*` operations can… |
CVE-2021-41204 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions during TensorFlow's Grappler optimizer phase, constant folding might attempt t… |
CVE-2021-41203 | High | 7.8 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and `… |
CVE-2021-3774 | High | 7.4 | 2021-11-05 | Meross Smart Wi-Fi 2 Way Wall Switch (MSS550X), on its 3.1.3 version and before, creates an open Wi-Fi Access Point without the required security measures in i… |
CVE-2021-41210 | High | 7.1 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for `SparseCountSparseOutput` can trigger a read… |
CVE-2021-41201 | High | 7.8 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affeced versions during execution, `EinsumHelper::ParseEquation()` is supposed to set the flags… |
CVE-2021-41200 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions if `tf.summary.create_file_writer` is called with non-scalar arguments code cr… |
CVE-2021-41199 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions if `tf.image.resize` is called with a large input argument then the TensorFlow… |
CVE-2021-41198 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions if `tf.tile` is called with a large input argument then the TensorFlow process… |
CVE-2021-41197 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions TensorFlow allows tensor to have a large number of dimensions and each dimensi… |
CVE-2021-41196 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the Keras pooling layers can trigger a segfault if the size of the pool is 0 o… |
CVE-2021-41195 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions the implementation of `tf.math.segment_*` operations results in a `CHECK`-fail… |
CVE-2021-43406 | High | 8.8 | 2021-11-05 | An issue was discovered in FusionPBX before 4.5.30. The fax_post_size may have risky characters (it is not constrained to preset values). |
CVE-2021-43405 | High | 8.8 | 2021-11-05 | An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained to be numeric). |
CVE-2021-43404 | High | 8.8 | 2021-11-05 | An issue was discovered in FusionPBX before 4.5.30. The FAX file name may have risky characters. |
CVE-2021-42837 | Critical | 9.8 | 2021-11-05 | An issue was discovered in Talend Data Catalog before 7.3-20210930. After setting up SAML/OAuth, authentication is not correctly enforced on the native login p… |
CVE-2021-35368 | Critical | 9.8 | 2021-11-05 | OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname. |
CVE-2021-29753 | Medium | 5.9 | 2021-11-05 | IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an i… |
CVE-2021-42701 | Medium | 5.0 | 2021-11-05 | An attacker could prepare a specially crafted project file that, if opened, would attempt to connect to the cloud and trigger a man in the middle (MiTM) attack… |