2021 CVEs (page 98)
Page 98 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-22452 | Medium | 5.5 | 2021-10-28 | A component of the HarmonyOS has a Improper Input Validation vulnerability. Local attackers may exploit this vulnerability to read at any address. |
CVE-2021-22451 | High | 7.8 | 2021-10-28 | A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. Local attackers may exploit this vulnerability to cause memory overwriting. |
CVE-2021-22450 | Medium | 5.5 | 2021-10-28 | A component of the HarmonyOS has a Incomplete Cleanup vulnerability. Local attackers may exploit this vulnerability to cause memory exhaustion. |
CVE-2021-22436 | Critical | 9.1 | 2021-10-28 | There is a Logic Bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service integrity and availability. |
CVE-2021-22407 | Medium | 5.3 | 2021-10-28 | There is a Configuration defects in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-22406 | High | 7.5 | 2021-10-28 | There is an Uncaught Exception vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the app to exit unexpectedly. |
CVE-2021-22405 | High | 7.5 | 2021-10-28 | There is a Configuration defects in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability. |
CVE-2021-22404 | Medium | 5.3 | 2021-10-28 | There is a Directory traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-22403 | Critical | 9.8 | 2021-10-28 | There is a vulnerability of hijacking unverified providers in Huawei Smartphone.Successful exploitation of this vulnerability may allow attackers to hijack the… |
CVE-2021-22402 | High | 7.5 | 2021-10-28 | There is a DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause DoS attacks. |
CVE-2021-22401 | High | 7.5 | 2021-10-28 | There is a Remote DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability can affect service integrity. |
CVE-2021-22278 | Medium | 6.7 | 2021-10-28 | A certificate validation vulnerability in PCM600 Update Manager allows attacker to get unwanted software packages to be installed on computer which has PCM600… |
CVE-2021-37915 | High | 8.8 | 2021-10-28 | An issue was discovered on the Grandstream HT801 Analog Telephone Adaptor before 1.0.29.8. From the limited configuration shell, it is possible to set the mali… |
CVE-2021-37748 | High | 8.8 | 2021-10-28 | Multiple buffer overflows in the limited configuration shell (/sbin/gs_config) on Grandstream HT801 devices before 1.0.29 allow remote authenticated users to e… |
CVE-2021-43057 | High | 7.8 | 2021-10-28 | An issue was discovered in the Linux kernel before 5.14.8. A use-after-free in selinux_ptrace_traceme (aka the SELinux handler for PTRACE_TRACEME) could be use… |
CVE-2021-43056 | Medium | 5.5 | 2021-10-28 | An issue was discovered in the Linux kernel for powerpc before 5.14.15. It allows a malicious KVM guest to crash the host, when the host is running on Power8… |
CVE-2021-3906 | Medium | 6.5 | 2021-10-27 | bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type |
CVE-2021-3904 | Medium | 5.4 | 2021-10-27 | grav is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-41191 | High | 7.5 | 2021-10-27 | Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have someone's API URL to… |
CVE-2021-3903 | High | 7.8 | 2021-10-27 | vim is vulnerable to Heap-based Buffer Overflow |
CVE-2021-3901 | High | 8.8 | 2021-10-27 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-25219 | Medium | 5.3 | 2021-10-27 | In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as rele… |
CVE-2021-1117 | Medium | 4.7 | 2021-10-27 | Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where an attacker through specific configuration and with l… |
CVE-2021-1116 | Medium | 5.5 | 2021-10-27 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a NULL pointer dereference in the kernel, created… |
CVE-2021-1115 | Medium | 6.5 | 2021-10-27 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for private IOCTLs, where an attacker with local… |
CVE-2021-40125 | Medium | 5.3 | 2021-10-27 | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat De… |
CVE-2021-40118 | High | 8.6 | 2021-10-27 | A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2021-40117 | High | 8.6 | 2021-10-27 | A vulnerability in SSL/TLS message handler for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow a… |
CVE-2021-40116 | High | 8.6 | 2021-10-27 | Multiple Cisco products are affected by a vulnerability in Snort rules that could allow an unauthenticated, remote attacker to cause a denial of service (DoS)… |
CVE-2021-40114 | Medium | 6.8 | 2021-10-27 | Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remot… |
CVE-2021-34794 | Medium | 5.3 | 2021-10-27 | A vulnerability in the Simple Network Management Protocol version 3 (SNMPv3) access control functionality of Cisco Adaptive Security Appliance (ASA) Software a… |
CVE-2021-34793 | High | 8.6 | 2021-10-27 | A vulnerability in the TCP Normalizer of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software operating in transparent… |
CVE-2021-34792 | High | 8.6 | 2021-10-27 | A vulnerability in the memory management of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthe… |
CVE-2021-34791 | Medium | 4.7 | 2021-10-27 | Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) So… |
CVE-2021-34790 | Medium | 4.7 | 2021-10-27 | Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) So… |
CVE-2021-34787 | Medium | 5.3 | 2021-10-27 | A vulnerability in the identity-based firewall (IDFW) rule processing feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat De… |
CVE-2021-34783 | High | 8.6 | 2021-10-27 | A vulnerability in the software-based SSL/TLS message handler of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software c… |
CVE-2021-34781 | High | 8.6 | 2021-10-27 | A vulnerability in the processing of SSH connections for multi-instance deployments of Cisco Firepower Threat Defense (FTD) Software could allow an unauthentic… |
CVE-2021-34764 | Medium | 4.8 | 2021-10-27 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an attacker to execute a cross-s… |
CVE-2021-34763 | Medium | 4.8 | 2021-10-27 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an attacker to execute a cross-s… |
CVE-2021-34762 | High | 8.1 | 2021-10-27 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perf… |
CVE-2021-34761 | Medium | 4.4 | 2021-10-27 | A vulnerability in Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to overwrite or append arbitrary data to system f… |
CVE-2021-34756 | Medium | 6.7 | 2021-10-27 | Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands… |
CVE-2021-34755 | Medium | 6.7 | 2021-10-27 | Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands… |
CVE-2021-34754 | Medium | 5.8 | 2021-10-27 | Multiple vulnerabilities in the payload inspection for Ethernet Industrial Protocol (ENIP) traffic for Cisco Firepower Threat Defense (FTD) Software could allo… |
CVE-2021-3900 | Medium | 6.5 | 2021-10-27 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-37808 | Medium | 5.9 | 2021-10-27 | SQL Injection vulnerabilities exist in https://phpgurukul.com News Portal Project 3.1 via the (1) category, (2) subcategory, (3) sucatdescription, and (4) user… |
CVE-2021-37807 | High | 7.5 | 2021-10-27 | An SQL Injection vulneraility exists in https://phpgurukul.com Online Shopping Portal 3.1 via the email parameter on the /check_availability.php endpoint that… |
CVE-2021-37806 | Medium | 5.9 | 2021-10-27 | An SQL Injection vulnerability exists in https://phpgurukul.com Vehicle Parking Management System affected version 1.0. The system is vulnerable to time-based… |
CVE-2021-37805 | Medium | 5.4 | 2021-10-27 | A Stored Cross Site Scripting (XSS) vunerability exists in Sourcecodeste Vehicle Parking Management System affected version 1.0 is via the add-vehicle.php endp… |
CVE-2021-37803 | High | 8.1 | 2021-10-27 | An SQL Injection vulnerability exists in Sourcecodester Online Covid Vaccination Scheduler System 1.0 via the username in lognin.php . |
CVE-2021-29868 | Medium | 5.5 | 2021-10-27 | IBM i2 iBase 8.9.13 and 9.0.0 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 206213. |
CVE-2021-29844 | High | 8.8 | 2021-10-27 | IBM Jazz Team Server products is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from… |
CVE-2021-29786 | Medium | 6.5 | 2021-10-27 | IBM Jazz Team Server products stores user credentials in clear text which can be read by an authenticated user. IBM X-Force ID: 203172. |
CVE-2021-29774 | High | 7.5 | 2021-10-27 | IBM Jazz Team Server products could allow an authenticated user to obtain elevated privileges under certain configurations. IBM X-Force ID: 203025. |
CVE-2021-29713 | Medium | 5.4 | 2021-10-27 | IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alt… |
CVE-2021-29673 | Medium | 5.4 | 2021-10-27 | IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alt… |
CVE-2021-20526 | Medium | 5.3 | 2021-10-27 | IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker cou… |
CVE-2021-38379 | Medium | 5.5 | 2021-10-27 | The Hub in CFEngine Enterprise 3.6.7 through 3.18.0 has Insecure Permissions that allow local Information Disclosure. |
CVE-2021-37221 | High | 8.8 | 2021-10-27 | A file upload vulnerability exists in Sourcecodester Customer Relationship Management System 1.0 via the account update option & customer create option, which… |
CVE-2021-36756 | Medium | 6.5 | 2021-10-27 | CFEngine Enterprise 3.15.0 through 3.15.4 has Missing SSL Certificate Validation. |
CVE-2021-22101 | High | 7.5 | 2021-10-27 | Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated attackers to cause d… |
CVE-2021-41619 | High | 7.2 | 2021-10-27 | An issue was discovered in Gradle Enterprise before 2021.1.2. There is potential remote code execution via the application startup configuration. The installat… |
CVE-2021-41590 | Medium | 5.3 | 2021-10-27 | In Gradle Enterprise through 2021.3, probing of the server-side network environment can occur via an SMTP configuration test. The installation configuration us… |
CVE-2021-41589 | Critical | 9.8 | 2021-10-27 | In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code execution when running the… |
CVE-2021-41872 | High | 7.5 | 2021-10-27 | Skyworth Digital Technology Penguin Aurora Box 41502 has a denial of service vulnerability, which can be exploited by attackers to cause a denial of service. |
CVE-2021-34580 | High | 7.5 | 2021-10-27 | In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted… |
CVE-2021-38450 | Critical | 9.9 | 2021-10-27 | The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller… |
CVE-2021-37131 | Medium | 6.8 | 2021-10-27 | There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit this vulnerability t… |
CVE-2021-37130 | High | 7.5 | 2021-10-27 | There is a path traversal vulnerability in Huawei FusionCube 6.0.2.The vulnerability is due to that the software uses external input to construct a pathname th… |
CVE-2021-37129 | High | 7.5 | 2021-10-27 | There is an out of bounds write vulnerability in some Huawei products. The vulnerability is caused by a function of a module that does not properly verify inpu… |
CVE-2021-37127 | High | 7.2 | 2021-10-27 | There is a signature management vulnerability in some huawei products. An attacker can forge signature and bypass the signature check. During firmware update p… |
CVE-2021-37124 | Medium | 6.5 | 2021-10-27 | There is a path traversal vulnerability in Huawei PC product. Because the product does not filter path with special characters,attackers can construct a file p… |
CVE-2021-37122 | Medium | 6.5 | 2021-10-27 | There is a use-after-free (UAF) vulnerability in Huawei products. An attacker may craft specific packets to exploit this vulnerability. Successful exploitation… |
CVE-2021-35236 | Low | 3.1 | 2021-10-27 | The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie… |
CVE-2021-35235 | Medium | 5.3 | 2021-10-27 | The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web applications, if conf… |
CVE-2021-35233 | Medium | 5.3 | 2021-10-27 | The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the w… |
CVE-2021-32951 | Medium | 5.3 | 2021-10-27 | WebAccess/NMS (Versions prior to v3.0.3_Build6299) has an improper authentication vulnerability, which may allow unauthorized users to view resources monitored… |
CVE-2021-26610 | High | 7.2 | 2021-10-27 | The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an… |
CVE-2021-41866 | Medium | 5.4 | 2021-10-26 | MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly. |
CVE-2021-23877 | Medium | 6.7 | 2021-10-26 | Privilege escalation vulnerability in the Windows trial installer of McAfee Total Protection (MTP) prior to 16.0.34_x may allow a local user to run arbitrary c… |
CVE-2021-35499 | High | 8.0 | 2021-10-26 | The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting (XSS) vulnerabilities that allow a lo… |
CVE-2021-41188 | Medium | 5.7 | 2021-10-26 | Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two… |
CVE-2021-41185 | High | 8.8 | 2021-10-26 | Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with access to endpoints to download files ou… |
CVE-2021-41184 | Medium | 6.5 | 2021-10-26 | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrust… |
CVE-2021-41183 | Medium | 6.5 | 2021-10-26 | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from… |
CVE-2021-41182 | Medium | 6.5 | 2021-10-26 | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from un… |
CVE-2021-41175 | High | 7.3 | 2021-10-26 | Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS. Prior to version… |
CVE-2021-41173 | Medium | 5.7 | 2021-10-26 | Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node is susceptible to crash when processing… |
CVE-2021-41172 | Medium | 6.4 | 2021-10-26 | AS_Redis is an AntSword plugin for Redis. The Redis Manage plugin for AntSword prior to version 0.5 is vulnerable to Self-XSS due to due to insufficient input… |
CVE-2021-41158 | Medium | 5.8 | 2021-10-26 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2021-41157 | Medium | 5.3 | 2021-10-26 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2021-37364 | High | 7.8 | 2021-10-26 | OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify permission to openclinic folders/files. A l… |
CVE-2021-37363 | High | 7.8 | 2021-10-26 | An Insecure Permissions issue exists in Gestionale Open 11.00.00. A low privilege account is able to rename the mysqld.exe file located in bin folder and repla… |
CVE-2021-41078 | High | 7.8 | 2021-10-26 | Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file. |
CVE-2021-37372 | High | 8.8 | 2021-10-26 | Online Student Admission System 1.0 is affected by an insecure file upload vulnerability. A low privileged user can upload malicious PHP files by updating thei… |
CVE-2021-37371 | Critical | 9.8 | 2021-10-26 | Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass vulnerability in /admin/login.php. |
CVE-2021-26609 | High | 7.5 | 2021-10-26 | A vulnerability was found in Mangboard(WordPress plugin). A SQL-Injection vulnerability was found in order_type parameter. The order_type parameter makes a SQL… |
CVE-2021-26607 | High | 8.1 | 2021-10-26 | An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary command on affected systems. |
CVE-2021-41873 | Critical | 10.0 | 2021-10-26 | Penguin Aurora TV Box 41502 is a high-end network HD set-top box produced by Tencent Video and Skyworth Digital. An unauthorized access vulnerability exists in… |