CVE-2021-42557

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Jeedom through 4.1.19, a bug allows a remote attacker to bypass API access and retrieve users credentials.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Nov 1, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-425586.1An issue was discovered in CALDERA 2.8.1. It contains multiple reflected, stored, and self XSS vulnerabilities that may be exploited by authCVE-2021-425598.8An issue was discovered in CALDERA 2.8.1. It contains multiple startup "requirements" that execute commands when starting the server. BecausCVE-2021-42566.1A vulnerability was found in ctrlo lenio. It has been classified as problematic. This affects an unknown part of the file views/index.tt. ThCVE-2021-425608.8An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when generating a PDF document. These CVE-2021-425618.8An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name parameter to a python "os.system" funCVE-2021-425628.1An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-admin users having access to readCVE-2021-425637.8There is an Unquoted Service Path in NI Service Locator (nisvcloc.exe) in versions prior to 18.0 on Windows. This may allow an authorized loCVE-2021-425645.4An open redirect through HTML injection in confidential messages in Cryptshare before 5.1.0 allows remote attackers (with permission to provCVE-2021-425656.1myfactory.FMS before 7.1-912 allows XSS via the UID parameter.CVE-2021-425666.1myfactory.FMS before 7.1-912 allows XSS via the Error parameter.CVE-2021-425676.1Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.CVE-2021-425684.3Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged a
CVE-2021-42557: High severity, CVSS 7.5 | Vulnix