2021 CVEs (page 95)
Page 95 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-38428 | Medium | 5.5 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript co… |
CVE-2021-38424 | Medium | 5.9 | 2021-11-03 | The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may… |
CVE-2021-38422 | High | 7.8 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior stores sensitive information in cleartext, which may allow an attacker to have extensive access to the app… |
CVE-2021-38420 | High | 7.8 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior default permissions give extensive permissions to low-privileged user accounts, which may allow an attacke… |
CVE-2021-38418 | High | 8.8 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traffic and perform a ma… |
CVE-2021-38416 | High | 7.8 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeover the system where… |
CVE-2021-38411 | Medium | 5.5 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript co… |
CVE-2021-38407 | Medium | 5.5 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript co… |
CVE-2021-38403 | Medium | 5.5 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript co… |
CVE-2021-35053 | High | 7.5 | 2021-11-03 | Possible system denial of service in case of arbitrary changing Firefox browser parameters. An attacker could change specific Firefox browser parameters file i… |
CVE-2021-33800 | High | 7.5 | 2021-11-03 | In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal. |
CVE-2021-22960 | Medium | 6.5 | 2021-11-03 | The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS… |
CVE-2021-43141 | Medium | 6.1 | 2021-11-03 | Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Simple Subscription Website 1.0 via the id parameter in plan_application. |
CVE-2021-43140 | Critical | 9.8 | 2021-11-03 | SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login. |
CVE-2021-41174 | Medium | 6.9 | 2021-11-03 | Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencin… |
CVE-2021-41134 | High | 8.7 | 2021-11-03 | nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting (XSS) issue exists within the Jupyter-ow… |
CVE-2021-23820 | Medium | 5.6 | 2021-11-03 | This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays. |
CVE-2021-23807 | Medium | 5.6 | 2021-11-03 | This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer c… |
CVE-2021-23784 | Medium | 5.4 | 2021-11-03 | This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without being escaped/sanitized… |
CVE-2021-23624 | Medium | 5.6 | 2021-11-03 | This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path… |
CVE-2021-23509 | Medium | 5.6 | 2021-11-03 | This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the po… |
CVE-2021-23472 | Low | 3.1 | 2021-11-03 | This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provid… |
CVE-2021-40985 | Medium | 5.5 | 2021-11-03 | A stack-based buffer under-read in htmldoc before 1.9.12, allows attackers to cause a denial of service via a crafted BMP image to image_load_bmp. |
CVE-2021-27836 | Medium | 6.5 | 2021-11-03 | An issue was discoverered in in function xls_getWorkSheet in xls.c in libxls 1.6.2, allows attackers to cause a denial of service, via a crafted XLS file. |
CVE-2021-26786 | High | 8.8 | 2021-11-03 | An issue was discoverered in in customercentric-selling-poland PlayTube, allows authenticated attackers to execute arbitrary code via the purchace code to the… |
CVE-2021-43082 | Critical | 9.8 | 2021-11-03 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker… |
CVE-2021-41585 | High | 7.5 | 2021-11-03 | Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the server stop accepting new conne… |
CVE-2021-38161 | High | 8.1 | 2021-11-03 | Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks. This issue affects Apache Traff… |
CVE-2021-37149 | High | 7.5 | 2021-11-03 | Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Se… |
CVE-2021-37148 | High | 7.5 | 2021-11-03 | Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Se… |
CVE-2021-37147 | High | 7.5 | 2021-11-03 | Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Se… |
CVE-2021-43324 | Medium | 6.1 | 2021-11-03 | LibreNMS through 21.10.2 allows XSS via a widget title. |
CVE-2021-43130 | Critical | 9.8 | 2021-11-03 | An SQL Injection vulnerability exists in Sourcecodester Customer Relationship Management System (CRM) 1.0 via the username parameter in customer/login.php. |
CVE-2021-36698 | Medium | 5.4 | 2021-11-03 | Pandora FMS through 755 allows XSS via a new Event Filter with a crafted name. |
CVE-2021-36697 | Medium | 6.7 | 2021-11-03 | With an admin account, the .htaccess file in Artica Pandora FMS <=755 can be overwritten with the File Manager component. The new .htaccess file contains a Rew… |
CVE-2021-40849 | Critical | 9.8 | 2021-11-03 | In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, res… |
CVE-2021-40848 | High | 7.8 | 2021-11-03 | In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, l… |
CVE-2021-36192 | Medium | 5.2 | 2021-11-03 | An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiManager 7.0.1 and below, 6.4.6 and below, 6.2.x, 6.0.x, 5.6.0 may… |
CVE-2021-33209 | Medium | 5.3 | 2021-11-03 | An issue was discovered in Fimer Aurora Vision before 2.97.10. The response to a failed login attempt discloses whether the username or password is wrong, help… |
CVE-2021-33210 | Medium | 4.3 | 2021-11-03 | An issue was discovered in Fimer Aurora Vision before 2.97.10. An attacker can (in the WebUI) obtain plant information without authentication by reading the re… |
CVE-2021-41312 | High | 7.5 | 2021-11-03 | Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Management to enable and… |
CVE-2021-39238 | Critical | 9.8 | 2021-11-03 | Certain HP Enterprise LaserJet, HP LaserJet Managed, HP Enterprise PageWide, HP PageWide Managed products may be vulnerable to potential buffer overflow. |
CVE-2021-39237 | Medium | 4.6 | 2021-11-03 | Certain HP LaserJet, HP LaserJet Managed, HP PageWide, and HP PageWide Managed printers may be vulnerable to potential information disclosure. |
CVE-2021-38502 | Medium | 5.9 | 2021-11-03 | Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted mes… |
CVE-2021-38501 | High | 8.8 | 2021-11-03 | Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presu… |
CVE-2021-38500 | High | 8.8 | 2021-11-03 | Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presu… |
CVE-2021-38499 | High | 8.8 | 2021-11-03 | Mozilla developers reported memory safety bugs present in Firefox 92. Some of these bugs showed evidence of memory corruption and we presume that with enough e… |
CVE-2021-38498 | High | 7.5 | 2021-11-03 | During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potentially exploitabl… |
CVE-2021-38497 | Medium | 6.5 | 2021-11-03 | Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusi… |
CVE-2021-38496 | High | 8.8 | 2021-11-03 | During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable cras… |
CVE-2021-38495 | High | 8.8 | 2021-11-03 | Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. Some of these bugs showed evidence of memory corruption and we presume that with… |
CVE-2021-38494 | High | 8.8 | 2021-11-03 | Mozilla developers reported memory safety bugs present in Firefox 91. Some of these bugs showed evidence of memory corruption and we presume that with enough e… |
CVE-2021-38493 | High | 8.8 | 2021-11-03 | Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these bugs showed evidence of memory corruption and we pres… |
CVE-2021-38492 | Medium | 6.5 | 2021-11-03 | When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might allow attackers to launch pages and execute scripts in In… |
CVE-2021-38491 | Medium | 6.5 | 2021-11-03 | Mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded. This vulnerability affects Firefox < 92. |
CVE-2021-29993 | High | 8.1 | 2021-11-03 | Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI spoofs. *This bug only affects Firefox fo… |
CVE-2021-29991 | High | 8.1 | 2021-11-03 | Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers. This allowed for a header splitting attack against servers… |
CVE-2021-41036 | Critical | 9.8 | 2021-11-03 | In versions prior to 1.1 of the Eclipse Paho MQTT C Client, the client does not check rem_len size in readpacket. |
CVE-2021-20707 | High | 7.5 | 2021-11-03 | Improper input validation vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUST… |
CVE-2021-20706 | High | 7.5 | 2021-11-03 | Improper input validation vulnerability in the WebManager CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X… |
CVE-2021-20705 | High | 7.5 | 2021-11-03 | Improper input validation vulnerability in the WebManager CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X… |
CVE-2021-20704 | Critical | 9.8 | 2021-11-03 | Buffer overflow vulnerability in the compatible API with previous versions CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earli… |
CVE-2021-20703 | Critical | 9.8 | 2021-11-03 | Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4… |
CVE-2021-20702 | Critical | 9.8 | 2021-11-03 | Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4… |
CVE-2021-20701 | Critical | 9.8 | 2021-11-03 | Buffer overflow vulnerability in the Disk Agent CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 Single… |
CVE-2021-20700 | Critical | 9.8 | 2021-11-03 | Buffer overflow vulnerability in the Disk Agent CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 Single… |
CVE-2021-20135 | Medium | 6.7 | 2021-11-03 | Nessus versions 8.15.2 and earlier were found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to… |
CVE-2021-43270 | High | 7.5 | 2021-11-02 | Datalust Seq.App.EmailPlus (aka seq-app-htmlemail) 3.1.0-dev-00148, 3.1.0-dev-00170, and 3.1.0-dev-00176 can use cleartext SMTP on port 25 in some cases where… |
CVE-2021-43267 | Critical | 9.8 | 2021-11-02 | An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote… |
CVE-2021-43266 | High | 7.3 | 2021-11-02 | In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collec… |
CVE-2021-43265 | Medium | 5.4 | 2021-11-02 | In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, certain tag syntax could be used for XSS, such as via a SCRIPT element. |
CVE-2021-43264 | Low | 3.3 | 2021-11-02 | In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access con… |
CVE-2021-42697 | High | 7.5 | 2021-11-02 | Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a… |
CVE-2021-37996 | Medium | 5.5 | 2021-11-02 | Insufficient validation of untrusted input Downloads in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a m… |
CVE-2021-37995 | Medium | 6.5 | 2021-11-02 | Inappropriate implementation in WebApp Installer in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially overlay and spoof the contents… |
CVE-2021-37994 | Medium | 6.5 | 2021-11-02 | Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a crafted… |
CVE-2021-37993 | High | 8.8 | 2021-11-02 | Use after free in PDF Accessibility in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2021-37992 | High | 8.8 | 2021-11-02 | Out of bounds read in WebAudio in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-37991 | High | 7.5 | 2021-11-02 | Race in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-37990 | Medium | 5.5 | 2021-11-02 | Inappropriate implementation in WebView in Google Chrome on Android prior to 95.0.4638.54 allowed a remote attacker to leak cross-origin data via a crafted app. |
CVE-2021-37989 | Medium | 6.5 | 2021-11-02 | Inappropriate implementation in Blink in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to abuse content security policy via a crafted HTML page. |
CVE-2021-37988 | High | 8.8 | 2021-11-02 | Use after free in Profiles in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who convinced a user to engage in specific gestures to potentially… |
CVE-2021-37987 | High | 8.8 | 2021-11-02 | Use after free in Network APIs in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-37986 | High | 8.8 | 2021-11-02 | Heap buffer overflow in Settings in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to engage with Dev Tools to potentially exploit heap corrupti… |
CVE-2021-37985 | High | 8.8 | 2021-11-02 | Use after free in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had convinced a user to allow for connection to debugger to potential… |
CVE-2021-37984 | High | 8.8 | 2021-11-02 | Heap buffer overflow in PDFium in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-37983 | High | 8.8 | 2021-11-02 | Use after free in Dev Tools in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-37982 | High | 8.8 | 2021-11-02 | Use after free in Incognito in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-37981 | Critical | 9.6 | 2021-11-02 | Heap buffer overflow in Skia in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2021-37980 | High | 7.4 | 2021-11-02 | Inappropriate implementation in Sandbox in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially bypass site isolation via Windows. |
CVE-2021-37979 | High | 8.8 | 2021-11-02 | heap buffer overflow in WebRTC in Google Chrome prior to 94.0.4606.81 allowed a remote attacker who convinced a user to browse to a malicious website to potent… |
CVE-2021-37978 | High | 8.8 | 2021-11-02 | Heap buffer overflow in Blink in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-37977 | High | 8.8 | 2021-11-02 | Use after free in Garbage Collection in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2021-42754 | Low | 3.2 | 2021-11-02 | An improper control of generation of code vulnerability [CWE-94] in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may allow an authenticated at… |
CVE-2021-41023 | Medium | 5.5 | 2021-11-02 | A unprotected storage of credentials in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows an authenticated user to disclosure agent password due… |
CVE-2021-41022 | High | 7.8 | 2021-11-02 | A improper privilege management in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows attacker to execute privileged code or commands via powershe… |
CVE-2021-36187 | Medium | 5.3 | 2021-11-02 | A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to cause a denial of service… |
CVE-2021-36186 | High | 8.8 | 2021-11-02 | A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute unauthorized code or com… |
CVE-2021-36185 | High | 8.8 | 2021-11-02 | A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to ex… |
CVE-2021-36184 | High | 8.8 | 2021-11-02 | A improper neutralization of Special Elements used in an SQL Command ('SQL Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclosu… |