2021 CVE Vulnerabilities
23,481 CVEs published in 2021.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2021-36887 | HIGH | 8.8 | 0.5% | Dec 20, 2021 | Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – C... |
| CVE-2021-35248 | MEDIUM | 4.3 | 0.9% | Dec 20, 2021 | It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate user... |
| CVE-2021-35244 | HIGH | 7.2 | 5.8% | Dec 20, 2021 | The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management ri... |
| CVE-2021-35234 | HIGH | 8.8 | 2.8% | Dec 20, 2021 | Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged esca... |
| CVE-2021-22057 | HIGH | 8.8 | 1.1% | Dec 20, 2021 | VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 contain an authentication bypass vulnerability. A malicious acto... |
| CVE-2021-22056 | HIGH | 7.5 | 1.6% | Dec 20, 2021 | VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vul... |
| CVE-2021-43441 | MEDIUM | 5.3 | 1.2% | Dec 20, 2021 | An HTML Injection Vulnerability in iOrder 1.0 allows the remote attacker to execute Malicious HTML codes via the signup ... |
| CVE-2021-43440 | MEDIUM | 6.1 | 1.4% | Dec 20, 2021 | Multiple Stored XSS Vulnerabilities in the Source Code of iOrder 1.0 allow remote attackers to execute arbitrary code vi... |
| CVE-2021-43439 | CRITICAL | 9.8 | 3.4% | Dec 20, 2021 | RCE in Add Review Function in iResturant 1.0 Allows remote attacker to execute commands remotely |
| CVE-2021-43438 | MEDIUM | 5.4 | 0.7% | Dec 20, 2021 | Stored XSS in Signup Form in iResturant 1.0 Allows Remote Attacker to Inject Arbitrary code via NAME and ADDRESS field |
| CVE-2021-43437 | HIGH | 8.8 | 1.2% | Dec 20, 2021 | In sourcecodetester Engineers Online Portal as of 10-21-21, an attacker can manipulate the Host header as seen by the we... |
| CVE-2021-44525 | CRITICAL | 9.8 | 3.4% | Dec 20, 2021 | Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a fi... |
| CVE-2021-44676 | CRITICAL | 9.8 | 4.4% | Dec 20, 2021 | Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements (e.g., access control detail... |
| CVE-2021-44675 | CRITICAL | 9.8 | 6.5% | Dec 20, 2021 | Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution du... |
| CVE-2021-44916 | MEDIUM | 6.1 | 3.7% | Dec 20, 2021 | Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. If a bad... |
| CVE-2021-44790 | CRITICAL | 9.8 | 97.1% | Dec 20, 2021 | A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from ... |
| CVE-2021-44224 | HIGH | 8.2 | 82.3% | Dec 20, 2021 | A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference... |
| CVE-2021-41561 | HIGH | 7.5 | 3.1% | Dec 20, 2021 | Improper Input Validation vulnerability in Parquet-MR of Apache Parquet allows an attacker to DoS by malicious Parquet f... |
| CVE-2021-44858 | HIGH | 7.5 | 1.3% | Dec 20, 2021 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to us... |
| CVE-2021-44554 | MEDIUM | 5.3 | 1.0% | Dec 20, 2021 | Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /... |
| CVE-2021-44263 | MEDIUM | 5.4 | 0.6% | Dec 20, 2021 | Gurock TestRail before 7.2.4 mishandles HTML escaping. |
| CVE-2021-42913 | HIGH | 7.5 | 1.8% | Dec 20, 2021 | The SyncThru Web Service on Samsung SCX-6x55X printers allows an attacker to gain access to a list of SMB users and clea... |
| CVE-2021-44732 | CRITICAL | 9.8 | 2.6% | Dec 20, 2021 | Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_sessi... |
| CVE-2021-44164 | CRITICAL | 9.8 | 2.1% | Dec 20, 2021 | Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allo... |
| CVE-2021-44163 | MEDIUM | 6.1 | 0.8% | Dec 20, 2021 | Chain Sea ai chatbot backend has improper filtering of special characters in URL parameters, which allows a remote attac... |
Check if your code is affected by 2021 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now