2021 CVEs (page 94)
Page 94 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-42699 | Medium | 5.7 | 2021-11-05 | The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP. An attacker can capture network traffic, obtain the user’s c… |
CVE-2021-42698 | High | 7.8 | 2021-11-05 | Project files are stored memory objects in the form of binary serialized data that can later be read and deserialized again to instantiate the original objects… |
CVE-2021-42543 | High | 7.8 | 2021-11-05 | The affected application uses specific functions that could be abused through a crafted project file, which could lead to code execution, system reboot, and sy… |
CVE-2021-39416 | Medium | 6.1 | 2021-11-05 | Multiple Cross Site Scripting (XSS) vulnerabilities exists in Remote Clinic v2.0 in (1) patients/register-patient.php via the (a) Contact, (b) Email, (c) Weigh… |
CVE-2021-39413 | Medium | 6.1 | 2021-11-05 | Multiple Cross Site Scripting (XSS) vulnerabilities exits in SEO Panel v4.8.0 via the (1) to_time parameter in (a) backlinks.php, (b) analytics.php, (c) log.ph… |
CVE-2021-3928 | High | 7.8 | 2021-11-05 | vim is vulnerable to Use of Uninitialized Variable |
CVE-2021-3927 | High | 7.8 | 2021-11-05 | vim is vulnerable to Heap-based Buffer Overflow |
CVE-2021-3924 | High | 7.5 | 2021-11-05 | grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2021-3916 | Medium | 6.5 | 2021-11-05 | bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2021-39412 | Medium | 6.1 | 2021-11-05 | Multiple Cross Site Scripting (XSS) vulnerabilities exists in PHPGurukul Shopping v3.1 via the (1) callback parameter in (a) server_side/scripts/id_jsonp.php… |
CVE-2021-39411 | Medium | 6.1 | 2021-11-05 | Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the (1) searchdata parameter in (a) doctor/search.ph… |
CVE-2021-42671 | High | 7.5 | 2021-11-05 | An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitoring_system/admin/uploads. An attacker can… |
CVE-2021-42670 | Critical | 9.8 | 2021-11-05 | A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the announcements_student.php web page. As a resu… |
CVE-2021-42669 | Critical | 9.8 | 2021-11-05 | A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the avatar through teacher… |
CVE-2021-42668 | Critical | 9.8 | 2021-11-05 | A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the my_classmates.php web page.. As a result, an… |
CVE-2021-42667 | Critical | 9.8 | 2021-11-05 | A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views. An attacker can leverage t… |
CVE-2021-42666 | High | 8.8 | 2021-11-05 | A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quiz_question.php, which could let a malicious us… |
CVE-2021-42665 | Critical | 9.8 | 2021-11-05 | An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to b… |
CVE-2021-42664 | Medium | 5.4 | 2021-11-05 | A Stored Cross Site Scripting (XSS) Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the (1) Quiz title and (2) quiz description para… |
CVE-2021-42663 | Medium | 4.3 | 2021-11-05 | An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the msg parameter to /event-management/in… |
CVE-2021-42662 | Medium | 5.4 | 2021-11-05 | A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the Holiday reason para… |
CVE-2021-26844 | Medium | 5.4 | 2021-11-05 | A cross-site scripting (XSS) vulnerability in Power Admin PA Server Monitor 8.2.1.1 allows remote attackers to inject arbitrary web script or HTML via Console… |
CVE-2021-42237 | Critical | 9.8 | 2021-11-05 | Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command… |
CVE-2021-25509 | Medium | 5.9 | 2021-11-05 | A missing input validation in Samsung Flow Windows application prior to Version 4.8.5.0 allows attackers to overwrite abtraty file in the Windows known folders. |
CVE-2021-25508 | Medium | 5.3 | 2021-11-05 | Improper privilege management vulnerability in API Key used in SmartThings prior to 1.7.73.22 allows an attacker to abuse the API key without limitation. |
CVE-2021-25507 | Medium | 5.7 | 2021-11-05 | Improper authorization vulnerability in Samsung Flow mobile application prior to 4.8.03.5 allows Samsung Flow PC application connected with user device to acce… |
CVE-2021-25506 | Medium | 4.0 | 2021-11-05 | Non-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provider or lead to denial of service. |
CVE-2021-25505 | Low | 3.3 | 2021-11-05 | Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is unlocked. |
CVE-2021-25504 | Medium | 4.0 | 2021-11-05 | Intent redirection vulnerability in Group Sharing prior to 10.8.03.2 allows attacker to access contact information. |
CVE-2021-25503 | Medium | 5.0 | 2021-11-05 | Improper input validation vulnerability in HDCP prior to SMR Nov-2021 Release 1 allows attackers to arbitrary code execution. |
CVE-2021-25502 | High | 7.9 | 2021-11-05 | A vulnerability of storing sensitive information insecurely in Property Settings prior to SMR Nov-2021 Release 1 allows attackers to read ESN value without pri… |
CVE-2021-25501 | Medium | 5.7 | 2021-11-05 | An improper access control vulnerability in SCloudBnRReceiver in SecTelephonyProvider prior to SMR Nov-2021 Release 1 allows untrusted application to call some… |
CVE-2021-25500 | High | 7.2 | 2021-11-05 | A missing input validation in HDCP LDFW prior to SMR Nov-2021 Release 1 allows attackers to overwrite TZASC allowing TEE compromise. |
CVE-2021-39913 | Medium | 4.4 | 2021-11-05 | Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versions starting from 14.3 before 14.3.4, a… |
CVE-2021-39912 | Medium | 5.3 | 2021-11-05 | A potential DoS vulnerability was discovered in GitLab CE/EE starting with version 13.7. Using a malformed TIFF images was possible to trigger memory exhaustio… |
CVE-2021-39911 | Low | 1.7 | 2021-11-05 | An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versio… |
CVE-2021-39909 | Medium | 5.3 | 2021-11-05 | Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions starting fro… |
CVE-2021-39907 | Medium | 5.3 | 2021-11-05 | A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7. The stripping of EXIF data from certain images resulted in high CPU us… |
CVE-2021-39906 | High | 8.7 | 2021-11-05 | Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf. |
CVE-2021-39905 | Medium | 4.3 | 2021-11-05 | An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groups that a public proj… |
CVE-2021-39904 | Medium | 4.3 | 2021-11-05 | An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 b… |
CVE-2021-39901 | Low | 2.7 | 2021-11-05 | In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiting a specific endpoint. |
CVE-2021-39898 | Low | 3.7 | 2021-11-05 | In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was… |
CVE-2021-39897 | Low | 2.6 | 2021-11-05 | Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have ac… |
CVE-2021-39895 | Medium | 6.0 | 2021-11-05 | In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner im… |
CVE-2021-22260 | High | 7.7 | 2021-11-05 | A stored Cross-Site Scripting vulnerability in the DataDog integration in all versions of GitLab CE/EE starting from 13.7 before 14.0.9, all versions starting… |
CVE-2021-43400 | Critical | 9.1 | 2021-11-04 | An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call. |
CVE-2021-39914 | Low | 3.1 | 2021-11-04 | A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a spe… |
CVE-2021-39903 | Medium | 6.5 | 2021-11-04 | In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a project to a restri… |
CVE-2021-39902 | Medium | 4.3 | 2021-11-04 | Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident. |
CVE-2021-43398 | Medium | 5.3 | 2021-11-04 | Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing leakage in MakePublicKey(). There is a clear correlation between execution time and private key len… |
CVE-2021-42057 | High | 7.8 | 2021-11-04 | Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker to craft malicious… |
CVE-2021-41248 | High | 7.1 | 2021-11-04 | GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. All versions of graphiql older than g… |
CVE-2021-43396 | High | 7.5 | 2021-11-04 | In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-J… |
CVE-2021-41249 | High | 7.1 | 2021-11-04 | GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than graphql-playground-rea… |
CVE-2021-43389 | Medium | 5.5 | 2021-11-04 | An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kca… |
CVE-2021-43293 | Medium | 4.3 | 2021-11-04 | Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request F… |
CVE-2021-43281 | High | 7.2 | 2021-11-04 | MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not vali… |
CVE-2021-41247 | Low | 3.5 | 2021-11-04 | JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser ses… |
CVE-2021-21698 | High | 7.5 | 2021-11-04 | Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent. |
CVE-2021-21697 | Critical | 9.1 | 2021-11-04 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restr… |
CVE-2021-21696 | Critical | 9.8 | 2021-11-04 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePa… |
CVE-2021-21695 | High | 8.8 | 2021-11-04 | FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2 an… |
CVE-2021-21694 | Critical | 9.8 | 2021-11-04 | FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Jenkins 2.318 and e… |
CVE-2021-21693 | Critical | 9.8 | 2021-11-04 | When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and earlier, LTS 2… |
CVE-2021-21692 | Critical | 9.8 | 2021-11-04 | FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission… |
CVE-2021-21691 | Critical | 9.8 | 2021-11-04 | Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. |
CVE-2021-21690 | Critical | 9.8 | 2021-11-04 | Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303… |
CVE-2021-21689 | Critical | 9.1 | 2021-11-04 | FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. |
CVE-2021-21688 | High | 7.5 | 2021-11-04 | The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject any operations, allo… |
CVE-2021-21687 | Critical | 9.1 | 2021-11-04 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FileP… |
CVE-2021-21686 | High | 8.1 | 2021-11-04 | File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing opera… |
CVE-2021-21685 | Critical | 9.1 | 2021-11-04 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs. |
CVE-2021-40128 | Medium | 5.3 | 2021-11-04 | A vulnerability in the account activation feature of Cisco Webex Meetings could allow an unauthenticated, remote attacker to send an account activation email w… |
CVE-2021-40127 | Medium | 5.3 | 2021-11-04 | A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and… |
CVE-2021-40126 | Medium | 4.3 | 2021-11-04 | A vulnerability in the web-based dashboard of Cisco Umbrella could allow an authenticated, remote attacker to perform an email enumeration attack against the U… |
CVE-2021-40124 | Medium | 6.7 | 2021-11-04 | A vulnerability in the Network Access Manager (NAM) module of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker… |
CVE-2021-40120 | Medium | 6.5 | 2021-11-04 | A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker with admi… |
CVE-2021-40119 | Critical | 9.8 | 2021-11-04 | A vulnerability in the key-based SSH authentication mechanism of Cisco Policy Suite could allow an unauthenticated, remote attacker to log in to an affected sy… |
CVE-2021-40115 | Medium | 6.1 | 2021-11-04 | A vulnerability in Cisco Webex Video Mesh could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the… |
CVE-2021-40113 | Critical | 10.0 | 2021-11-04 | Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ON… |
CVE-2021-40112 | Critical | 10.0 | 2021-11-04 | Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ON… |
CVE-2021-34795 | Critical | 10.0 | 2021-11-04 | Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ON… |
CVE-2021-34784 | Medium | 5.4 | 2021-11-04 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM) could allow an a… |
CVE-2021-34774 | Medium | 4.9 | 2021-11-04 | A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to acces… |
CVE-2021-34773 | Medium | 6.5 | 2021-11-04 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Manage… |
CVE-2021-34741 | High | 7.5 | 2021-11-04 | A vulnerability in the email scanning algorithm of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attac… |
CVE-2021-34739 | High | 8.1 | 2021-11-04 | A vulnerability in the web-based management interface of multiple Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to repla… |
CVE-2021-34731 | Medium | 4.8 | 2021-11-04 | A vulnerability in the web-based management interface of Cisco Prime Access Registrar could allow an authenticated, remote attacker to perform a stored cross-s… |
CVE-2021-34701 | Medium | 4.3 | 2021-11-04 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Manage… |
CVE-2021-1500 | Medium | 5.4 | 2021-11-04 | A vulnerability in the web-based management interface of Cisco Webex Video Mesh could allow an unauthenticated, remote attacker to redirect a user to a malicio… |
CVE-2021-42624 | High | 7.8 | 2021-11-04 | A local buffer overflow vulnerability exists in the latest version of Miniftpd in ftpproto.c through the tmp variable, where a crafted payload can be sent to t… |
CVE-2021-34597 | High | 7.8 | 2021-11-04 | Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a manipulated project fi… |
CVE-2021-34594 | Medium | 6.5 | 2021-11-04 | TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a relative path trav… |
CVE-2021-41562 | Medium | 6.1 | 2021-11-03 | A vulnerability in Snow Snow Agent for Windows allows a non-admin user to cause arbitrary deletion of files. This issue affects: Snow Snow Agent for Windows ve… |
CVE-2021-43339 | High | 8.8 | 2021-11-03 | In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via file_name in the export functionality. For… |
CVE-2021-43032 | Medium | 4.8 | 2021-11-03 | In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and save an XSS payload in… |
CVE-2021-42772 | Critical | 9.8 | 2021-11-03 | Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, have a buffer o… |
CVE-2021-41492 | Critical | 9.8 | 2021-11-03 | Multiple SQL Injection vulnerabilities exist in Sourcecodester Simple Cashiering System (POS) 1.0 via the (1) Product Code in the pos page in cashiering. (2) i… |
CVE-2021-38488 | Medium | 5.5 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript co… |