CVE-2021-38165

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published
Aug 7, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-381667.8In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are placCVE-2021-381679.8Roxy-WI through 5.2.2.0 allows SQL Injection via check_login. An unauthenticated attacker can extract a valid uuid to bypass authentication.CVE-2021-381688.8Roxy-WI through 5.2.2.0 allows authenticated SQL injection via select_servers.CVE-2021-381698.8Roxy-WI through 5.2.2.0 allows command injection via /app/funct.py and /api/api_funct.py.CVE-2021-38179.8wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL CommandCVE-2021-381719.8adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a necessary step becausCVE-2021-381729.8perM 0.4.0 has a Buffer Overflow related to strncpy. (Debian initially fixed this in 0.4.0-7.)CVE-2021-381739.8Btrbk before 0.31.2 allows command execution because of the mishandling of remote hosts filtering SSH commands using ssh_filter_btrbk.sh in CVE-2021-381746.5When a user opens manipulated files received from untrusted sources in SAP 3D Visual Enterprise Viewer version - 9, the application crashes CVE-2021-381756.5SAP Analysis for Microsoft Office - version 2.8, allows an attacker with high privileges to read sensitive data over the network, and gatherCVE-2021-381768.8Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed inCVE-2021-381777.5SAP CommonCryptoLib version 8.5.38 or lower is vulnerable to null pointer dereference vulnerability when an unauthenticated attacker sends c
CVE-2021-38165: Medium severity, CVSS 5.3 | Vulnix