CVE-2021-42563

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

There is an Unquoted Service Path in NI Service Locator (nisvcloc.exe) in versions prior to 18.0 on Windows. This may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

No affected versions have been published.

Timeline

Published: Nov 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-425645.4An open redirect through HTML injection in confidential messages in Cryptshare before 5.1.0 allows remote attackers (with permission to prov CVE-2021-425656.1myfactory.FMS before 7.1-912 allows XSS via the UID parameter.CVE-2021-425666.1myfactory.FMS before 7.1-912 allows XSS via the Error parameter.CVE-2021-425676.1Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.CVE-2021-425684.3Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged a CVE-2021-42576.1A vulnerability was found in ctrlo lenio. It has been declared as problematic. This vulnerability affects unknown code of the file views/tas CVE-2021-425748.3An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of charac CVE-2021-425759.8The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.CVE-2021-425769.8The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated CVE-2021-425777.5An issue was discovered in Softing OPC UA C++ SDK before 5.70. A malformed OPC/UA message abort packet makes the client crash with a NULL po CVE-2021-42587.5A vulnerability was found in whohas. It has been rated as problematic. This issue affects some unknown processing of the component Package I CVE-2021-425809.8Sourcecodester Online Learning System 2.0 is vunlerable to sql injection authentication bypass in admin login file (/admin/login.php) and au