2021 CVEs (page 99)
Page 99 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-42343 | Critical | 9.8 | 2021-10-26 | An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or… |
CVE-2021-40345 | High | 7.2 | 2021-10-26 | An issue was discovered in Nagios XI 5.8.5. In the Manage Dashlets section of the Admin panel, an administrator can upload ZIP files. A command injection (with… |
CVE-2021-40344 | High | 7.2 | 2021-10-26 | An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as l… |
CVE-2021-40343 | High | 7.8 | 2021-10-26 | An issue was discovered in Nagios XI 5.8.5. Insecure file permissions on the nagios_unbundler.py file allow the nagios user to elevate their privileges to the… |
CVE-2021-34596 | Medium | 6.5 | 2021-10-26 | A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resul… |
CVE-2021-34595 | High | 8.1 | 2021-10-26 | A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions… |
CVE-2021-34593 | High | 7.5 | 2021-10-26 | In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-ser… |
CVE-2021-34586 | High | 7.5 | 2021-10-26 | In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a… |
CVE-2021-34585 | High | 7.5 | 2021-10-26 | In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all condit… |
CVE-2021-34584 | Critical | 9.1 | 2021-10-26 | Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2… |
CVE-2021-34583 | High | 7.5 | 2021-10-26 | Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2… |
CVE-2021-20837 | Critical | 9.8 | 2021-10-26 | Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (… |
CVE-2021-41308 | Medium | 6.5 | 2021-10-26 | Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings via… |
CVE-2021-41307 | High | 7.5 | 2021-10-26 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and private filters via… |
CVE-2021-41306 | High | 7.5 | 2021-10-26 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an Insecure Direct Obj… |
CVE-2021-41305 | High | 7.5 | 2021-10-26 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filters via an Insecure D… |
CVE-2021-41304 | Medium | 6.1 | 2021-10-26 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (… |
CVE-2021-41179 | Medium | 6.5 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication w… |
CVE-2021-41178 | High | 8.8 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker… |
CVE-2021-41177 | High | 8.1 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database ba… |
CVE-2021-41145 | High | 8.6 | 2021-10-25 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2021-41105 | High | 7.5 | 2021-10-25 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2021-39225 | High | 8.1 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authe… |
CVE-2021-39224 | Low | 3.5 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version 1.1.1 returned verbatim exception messa… |
CVE-2021-39223 | Medium | 4.8 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Richdocuments application prior to versions 3.8.6 and 4.2.3 returned verbatim exc… |
CVE-2021-38260 | High | 7.8 | 2021-10-25 | NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB_HostParseDeviceConfigurationDescriptor(). |
CVE-2021-38258 | High | 7.8 | 2021-10-25 | NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB_HostProcessCallback(). |
CVE-2021-39221 | Medium | 6.4 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to a stored Cross-Site… |
CVE-2021-39220 | Low | 3.5 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render im… |
CVE-2021-41176 | Medium | 4.3 | 2021-10-25 | Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a… |
CVE-2021-34864 | High | 8.8 | 2021-10-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain t… |
CVE-2021-34863 | High | 8.8 | 2021-10-25 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication i… |
CVE-2021-34862 | High | 8.8 | 2021-10-25 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication i… |
CVE-2021-34861 | High | 8.8 | 2021-10-25 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication i… |
CVE-2021-34860 | Medium | 6.5 | 2021-10-25 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 1.01rc001 routers. Authenti… |
CVE-2021-34859 | High | 8.8 | 2021-10-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0. User interaction is required to exploit… |
CVE-2021-34857 | High | 8.8 | 2021-10-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain t… |
CVE-2021-34856 | High | 8.8 | 2021-10-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain t… |
CVE-2021-34855 | Medium | 6.5 | 2021-10-25 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must fir… |
CVE-2021-34854 | High | 7.8 | 2021-10-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain t… |
CVE-2021-37624 | High | 7.5 | 2021-10-25 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2021-21319 | Medium | 6.8 | 2021-10-25 | Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored… |
CVE-2021-41035 | Critical | 9.8 | 2021-10-25 | In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. |
CVE-2021-24885 | Medium | 6.1 | 2021-10-25 | The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Reflected Cross-Site S… |
CVE-2021-24884 | Critical | 9.6 | 2021-10-25 | The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.This could allow an u… |
CVE-2021-24785 | Medium | 4.8 | 2021-10-25 | The Great Quotes WordPress plugin through 1.0.0 does not sanitise and escape the Quote and Author fields of its Quotes, which could allow high privilege users… |
CVE-2021-24779 | Medium | 6.5 | 2021-10-25 | The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checks, as a… |
CVE-2021-24774 | High | 7.2 | 2021-10-25 | The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement… |
CVE-2021-24769 | High | 7.2 | 2021-10-25 | The Permalink Manager Lite WordPress plugin before 2.2.13.1 does not validate and escape the orderby parameter before using it in a SQL statement in the Permal… |
CVE-2021-24744 | Medium | 4.8 | 2021-10-25 | The WordPress Contact Forms by Cimatti WordPress plugin before 1.4.12 does not sanitise and escape the Form Title before outputting it in some admin pages. whi… |
CVE-2021-24699 | Medium | 5.4 | 2021-10-25 | The Easy Media Download WordPress plugin before 1.1.7 does not escape the text argument of its shortcode, which could allow users with a role as low as Contrib… |
CVE-2021-24662 | High | 7.2 | 2021-10-25 | The Game Server Status WordPress plugin through 1.0 does not validate or escape the server_id parameter before using it in SQL statement, leading to an Authent… |
CVE-2021-24653 | Medium | 4.8 | 2021-10-25 | The Cookie Bar WordPress plugin before 1.8.9 doesn't properly sanitise the Cookie Bar Message setting, which could allow high privilege users to perform Cross-… |
CVE-2021-24608 | Medium | 4.8 | 2021-10-25 | The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allow… |
CVE-2021-24544 | Medium | 5.4 | 2021-10-25 | The Responsive WordPress Slider WordPress plugin through 2.2.0 does not sanitise and escape some of the Slider options, allowing Cross-Site Scripting payloads… |
CVE-2021-24543 | Medium | 6.1 | 2021-10-25 | The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and… |
CVE-2021-24515 | Medium | 4.8 | 2021-10-25 | The Video Gallery WordPress plugin before 1.1.5 does not escape the Title and Description of the videos in a gallery before outputting them in attributes, lead… |
CVE-2021-24514 | Medium | 4.8 | 2021-10-25 | The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site… |
CVE-2021-24489 | Medium | 4.8 | 2021-10-25 | The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated S… |
CVE-2021-24487 | High | 8.8 | 2021-10-25 | The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also… |
CVE-2021-24485 | Medium | 4.8 | 2021-10-25 | The Special Text Boxes WordPress plugin before 5.9.110 does not sanitise or escape some of its settings, which could allow high privilege users to perform Cros… |
CVE-2021-24414 | Medium | 5.4 | 2021-10-25 | The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as… |
CVE-2021-24381 | Medium | 4.8 | 2021-10-25 | The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow hi… |
CVE-2021-0941 | Medium | 6.7 | 2021-10-25 | In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with Syste… |
CVE-2021-0940 | Medium | 6.7 | 2021-10-25 | In TBD of TBD, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege in the kernel with System exec… |
CVE-2021-0939 | Medium | 4.4 | 2021-10-25 | In set_default_passthru_cfg of passthru.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosur… |
CVE-2021-0938 | Medium | 5.5 | 2021-10-25 | In memzero_explicit of compiler-clang.h, there is a possible bypass of defense in depth due to uninitialized data. This could lead to local information disclos… |
CVE-2021-0936 | High | 7.8 | 2021-10-25 | In acc_read of f_accessory.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additiona… |
CVE-2021-0935 | Medium | 6.7 | 2021-10-25 | In ip6_xmit of ip6_output.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System exec… |
CVE-2021-0663 | Medium | 6.7 | 2021-10-25 | In audio DSP, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution… |
CVE-2021-0662 | Medium | 6.7 | 2021-10-25 | In audio DSP, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution… |
CVE-2021-0661 | Medium | 6.7 | 2021-10-25 | In audio DSP, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution… |
CVE-2021-0634 | Medium | 6.7 | 2021-10-25 | In display driver, there is a possible memory corruption due to uninitialized data. This could lead to local escalation of privilege with System execution priv… |
CVE-2021-0633 | Medium | 6.7 | 2021-10-25 | In display driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execu… |
CVE-2021-0632 | Medium | 6.5 | 2021-10-25 | In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a proximal attacker u… |
CVE-2021-0631 | High | 7.5 | 2021-10-25 | In wifi driver, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no additional execution privil… |
CVE-2021-0630 | High | 7.5 | 2021-10-25 | In wifi driver, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no additional execution privil… |
CVE-2021-0625 | Medium | 6.7 | 2021-10-25 | In ccu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2021-0618 | Medium | 5.5 | 2021-10-25 | In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional exec… |
CVE-2021-0617 | Medium | 5.5 | 2021-10-25 | In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional exec… |
CVE-2021-0616 | Medium | 5.5 | 2021-10-25 | In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional exec… |
CVE-2021-0615 | Medium | 5.5 | 2021-10-25 | In flv extractor, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with no additional executi… |
CVE-2021-0614 | Medium | 5.5 | 2021-10-25 | In asf extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional e… |
CVE-2021-0613 | Medium | 5.5 | 2021-10-25 | In asf extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional e… |
CVE-2021-0414 | Medium | 5.5 | 2021-10-25 | In flv extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional exec… |
CVE-2021-0413 | Medium | 5.5 | 2021-10-25 | In flv extractor, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional exec… |
CVE-2021-0412 | Medium | 5.5 | 2021-10-25 | In flv extractor, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional exec… |
CVE-2021-0411 | Medium | 5.5 | 2021-10-25 | In flv extractor, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with no additional executi… |
CVE-2021-0410 | Medium | 5.5 | 2021-10-25 | In flv extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional e… |
CVE-2021-0409 | Medium | 5.5 | 2021-10-25 | In flv extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional e… |
CVE-2021-40865 | Critical | 9.8 | 2021-10-25 | An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apac… |
CVE-2021-38294 | Critical | 9.8 | 2021-10-25 | A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specia… |
CVE-2021-35231 | Medium | 6.7 | 2021-10-25 | As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escalated privileges b… |
CVE-2021-25977 | Medium | 5.4 | 2021-10-25 | In PiranhaCMS, versions 7.0.0 to 9.1.1 are vulnerable to stored XSS due to the page title improperly sanitized. By creating a page with a specially crafted pag… |
CVE-2021-40527 | High | 8.6 | 2021-10-25 | Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and including version 1.7.22 allows a remote… |
CVE-2021-40526 | Medium | 4.8 | 2021-10-25 | Incorrect calculation of buffer size vulnerability in Peleton TTR01 up to and including PTV55G allows a remote attacker to trigger a Denial of Service attack t… |
CVE-2021-40371 | Critical | 9.8 | 2021-10-25 | Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution, as demonstrated by ..\\ in a scriptName… |
CVE-2021-21703 | High | 7.8 | 2021-10-25 | In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as… |
CVE-2021-42258 | Critical | 9.8 | 2021-10-22 | BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2… |
CVE-2021-42840 | High | 8.8 | 2021-10-22 | SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover… |