CVE Vulnerability Database
Search and browse 394,627 CVE records with CVSS scores, EPSS exploit predictions, CISA KEV status and whether the Vulnix engine has a detection for them.
20,149 records from 2021Clear filters
- CVE-2021-45907High 7.8Dec 28, 2021An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a for loop. An attacker has little influence over the data written to the stack, making it unlikely that the flow of control can be subverted.
- CVE-2021-45906Medium 5.4Dec 27, 2021OpenWrt 21.02.1 allows XSS via the NAT Rules Name screen.
- CVE-2021-45905Medium 5.4Dec 27, 2021OpenWrt 21.02.1 allows XSS via the Traffic Rules Name screen.
- CVE-2021-45904Medium 5.4Dec 27, 2021OpenWrt 21.02.1 allows XSS via the Port Forwards Add Name screen.
- CVE-2020-21238Critical 9.8Dec 27, 2021An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.
- CVE-2020-21237Critical 9.8Dec 27, 2021An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks.
- CVE-2020-21236High 8.8Dec 27, 2021A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a user's session cookie.
- CVE-2021-45896High 8.8Dec 27, 2021Nokia FastMile 3TG00118ABAD52 devices allow privilege escalation by an authenticated user via is_ctc_admin=1 to login_web_app.cgi and use of Import Config File.
- CVE-2021-45884High 7.5Dec 27, 2021In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requests are issued outside of the proxying extension using the system's DNS settings, resulting in information disclosure. NOTE: this issue exists because of an incomplete fix for CVE-2021-21323 and CVE-2021-22916.
- CVE-2021-43858High 8.8Dec 27, 2021MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users.
- CVE-2021-45895Medium 6.1Dec 27, 2021Netgen Tags Bundle 3.4.x before 3.4.11 and 4.0.x before 4.0.15 allows XSS in the Tags Admin interface.
- CVE-2020-20948High 7.5Dec 27, 2021An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable.
- CVE-2020-20946Medium 5.4Dec 27, 2021Qibosoft v7 contains a stored cross-site scripting (XSS) vulnerability in the component /admin/index.php?lfj=friendlink&action=add.
- CVE-2020-20945High 8.8Dec 27, 2021A Cross-Site Request Forgery (CSRF) in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to arbitrarily add administrator accounts.
- CVE-2020-20944Critical 9.1Dec 27, 2021An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files.
- CVE-2020-20943Medium 4.3Dec 27, 2021A Cross-Site Request Forgery (CSRF) in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arbitrarily publishing new articles via a crafted URL.
- CVE-2021-45890Critical 9.8Dec 27, 2021basic/BasicAuthProvider.java in AuthGuard before 0.9.0 allows authentication via an inactive identifier.
- CVE-2021-4161High 7.5Dec 27, 2021The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. This could give an attacker admin rights through the HTTP web server.
- CVE-2021-43857High 8.8Dec 27, 2021Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8.
- CVE-2021-43552Medium 5.5Dec 27, 2021The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from the Patient Information Center iX (PIC iX) Versions B.02, C.02, and C.03.
- CVE-2021-43550Medium 6.5Dec 27, 2021The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information, which affects the communications between Patient Information Center iX (PIC iX) Versions C.02 and C.03 and Efficia CM Series Revisions A.01 to C.0x and 4.0.
- CVE-2021-43548Medium 6.5Dec 27, 2021Patient Information Center iX (PIC iX) Versions C.02 and C.03 receives input or data, but does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly.
- CVE-2021-35232Medium 6.1Dec 27, 2021Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host machine allows to execute arbitrary HQL queries against the database and leverage the vulnerability to steal the password hashes of the users or insert arbitrary data into the database.
- CVE-2021-33017High 8.8Dec 27, 2021The standard access path of the IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) requires authentication, but the product has an alternate path or channel that does not require authentication.
- CVE-2021-32993High 8.8Dec 27, 2021IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.