CVE List - 2021 / February
Showing 1201 - 1300 of 1455 CVEs for February 2021 (Page 13 of 15)
| CVE ID | Date | Title |
|---|---|---|
| CVE-2021-3252 | 2021-02-23 | KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from the local server during the KACO XP100U authentication... |
| CVE-2021-27550 | 2021-02-23 | Polaris Office v9.102.66 is affected by a divide-by-zero error in PolarisOffice.exe and EngineDLL.dll that may cause a local denial of service. To exploit the vulnerability, someone must open a crafted... |
| CVE-2020-28429 | 2021-02-23 | Command Injection |
| CVE-2020-4953 | 2021-02-23 | IBM Planning Analytics 2.0 could allow a remote authenticated attacker to obtain information about an organization's internal structure by exposing sensitive information in HTTP repsonses. IBM X-Force ID: 192029. |
| CVE-2021-25630 | 2021-02-23 | "loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. Before doing anything else "loolforkit" checks, if it was invoked by the "lool"... |
| CVE-2020-7847 | 2021-02-23 | The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain remote code execution. This issue affects: pTIME NAS 1.4.36. |
| CVE-2021-22113 | 2021-02-23 | Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs.... |
| CVE-2020-25161 | 2021-02-23 | The WADashboard component of WebAccess/SCADA Versions 9.0 and prior may allow an attacker to control or influence a path used in an operation on the filesystem and remotely execute code... |
| CVE-2020-16243 | 2021-02-23 | Multiple buffer overflow vulnerabilities exist when LeviStudioU (Version 2019-09-21 and prior) processes project files. Opening a specially crafted project file could allow an attacker to exploit and execute code under... |
| CVE-2021-20230 | 2021-02-23 | A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker... |
| CVE-2021-20226 | 2021-02-23 | A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the system The... |
| CVE-2020-26609 | 2021-02-23 | fastadmin V1.0.0.20200506_beta contains a cross-site scripting (XSS) vulnerability which may allow an attacker to obtain administrator credentials to log in to the background. |
| CVE-2021-26685 | 2021-02-23 | A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface API of ClearPass could... |
| CVE-2021-27579 | 2021-02-23 | Snow Inventory Agent through 6.7.0 on Windows uses CPUID to report on processor types and versions that may be deployed and in use across an IT environment. A privilege-escalation vulnerability... |
| CVE-2021-26686 | 2021-02-23 | A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface API of ClearPass could... |
| CVE-2021-26683 | 2021-02-23 | A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass web-based management interface allows remote authenticated... |
| CVE-2021-26681 | 2021-02-23 | A remote authenticated command Injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass CLI could allow remote authenticated users... |
| CVE-2021-26682 | 2021-02-23 | A remote reflected cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the guest portal interface of ClearPass could... |
| CVE-2021-20220 | 2021-02-23 | A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting... |
| CVE-2021-26684 | 2021-02-23 | A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass web-based management interface allows remote authenticated... |
| CVE-2021-20229 | 2021-02-23 | A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns... |
| CVE-2021-26926 | 2021-02-23 | A flaw was found in jasper before 2.0.25. An out of bounds read issue was found in jp2_decode function whic may lead to disclosure of information or program crash. |
| CVE-2021-20198 | 2021-02-23 | A flaw was found in the OpenShift Installer before version v0.9.0-master.0.20210125200451-95101da940b0. During installation of OpenShift Container Platform 4 clusters, bootstrap nodes are provisioned with anonymous authentication enabled on kubelet port... |
| CVE-2021-22651 | 2021-02-23 | When loading a specially crafted file, Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR... |
| CVE-2021-26678 | 2021-02-23 | A remote unauthenticated stored cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface of ClearPass... |
| CVE-2021-27582 | 2021-02-23 | org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment (aka Autobinding) vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during... |
| CVE-2021-26680 | 2021-02-23 | A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass web-based management interface allows remote authenticated... |
| CVE-2021-26679 | 2021-02-23 | A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass web-based management interface allows remote authenticated... |
| CVE-2021-26677 | 2021-02-23 | A local authenticated escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in ClearPass OnGuard could allow local authenticated users... |
| CVE-2020-7120 | 2021-02-23 | A local authenticated buffer overflow vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in ClearPass OnGuard could allow local authenticated users to... |
| CVE-2020-28587 | 2021-02-23 | A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size... |
| CVE-2021-22882 | 2021-02-23 | UniFi Protect before v1.17.1 allows an attacker to use spoofed cameras to perform a denial-of-service attack that may cause the UniFi Protect controller to crash. |
| CVE-2020-8297 | 2021-02-23 | Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference (IDOR) vulnerability that permits users with a duplicate user identifier to access deck data of a previous deleted user. |
| CVE-2020-27782 | 2021-02-23 | A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in... |
| CVE-2021-20247 | 2021-02-23 | A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use... |
| CVE-2021-22112 | 2021-02-23 | Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than... |
| CVE-2021-27583 | 2021-02-23 | In Directus 8.x through 8.8.1, an attacker can discover whether a user is present in the database through the password reset feature. NOTE: This vulnerability only affects products that are... |
| CVE-2021-26593 | 2021-02-23 | In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/{id}. For each call, they get in response a lot of information about... |
| CVE-2021-26594 | 2021-02-23 | In Directus 8.x through 8.8.1, an attacker can switch to the administrator role (via the PATCH method) without any control by the back end. NOTE: This vulnerability only affects products... |
| CVE-2021-26595 | 2021-02-23 | In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of the... |
| CVE-2021-26927 | 2021-02-23 | A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service. |
| CVE-2021-3405 | 2021-02-23 | A flaw was found in libebml before 1.4.2. A heap overflow bug exists in the implementation of EbmlString::ReadData and EbmlUnicodeString::ReadData in libebml. |
| CVE-2021-20182 | 2021-02-23 | A privilege escalation flaw was found in openshift4/ose-docker-builder. The build container runs with high privileges using a chrooted environment instead of runc. If an attacker can gain access to this... |
| CVE-2021-3407 | 2021-02-23 | A flaw was found in mupdf 1.18.0. Double free of object during linearization may lead to memory corruption and other potential consequences. |
| CVE-2021-3410 | 2021-02-23 | A flaw was found in libcaca v0.99.beta19. A buffer overflow issue in caca_resize function in libcaca/caca/canvas.c may lead to local execution of arbitrary code in the user context. |
| CVE-2021-20252 | 2021-02-23 | A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested date ranges in certain queries allowing a malicious... |
| CVE-2021-20256 | 2021-02-23 | A flaw was found in Red Hat Satellite. The BMC interface exposes the password through the API to an authenticated local attacker with view_hosts permission. The highest threat from this... |
| CVE-2021-20194 | 2021-02-23 | There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y , CONFIG_HARDENED_USERCOPY not set, and... |
| CVE-2021-21323 | 2021-02-23 | Regression in DNS leakage from Tor windows |
| CVE-2020-11987 | 2021-02-24 | Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause... |
| CVE-2021-27645 | 2021-02-24 | The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free,... |
| CVE-2021-20656 | 2021-02-24 | Exposure of information through directory listing in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to obtain the information inside the system, such as directories and/or file configurations... |
| CVE-2021-20657 | 2021-02-24 | Improper access control vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to obtain and/or alter the setting information without the access privilege via unspecified vectors. |
| CVE-2021-20658 | 2021-02-24 | SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to execute arbitrary OS commands with the web server privilege via unspecified vectors. |
| CVE-2021-20659 | 2021-02-24 | SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to upload arbitrary files via unspecified vectors. If the file is PHP script, an attacker may execute arbitrary code. |
| CVE-2021-20660 | 2021-02-24 | Cross-site scripting vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to inject an arbitrary script via unspecified vectors. |
| CVE-2021-20661 | 2021-02-24 | Directory traversal vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors. |
| CVE-2021-20662 | 2021-02-24 | Missing authentication for critical function in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to alter the setting information without the access privileges via unspecified vectors. |
| CVE-2020-12702 | 2021-02-24 | Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application V4.9.2 and earlier, iOS application V4.9.1 and earlier) allows physically proximate attackers to eavesdrop on Wi-Fi... |
| CVE-2021-3355 | 2021-02-24 | A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/SensitiveWords. |
| CVE-2021-21616 | 2021-02-24 | Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
| CVE-2021-21617 | 2021-02-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Configuration Slicing Plugin 1.51 and earlier allows attackers to apply different slice configurations. |
| CVE-2021-21618 | 2021-02-24 | Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure... |
| CVE-2021-21619 | 2021-02-24 | Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers who are able to control the... |
| CVE-2021-21620 | 2021-02-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims. |
| CVE-2021-21621 | 2021-02-24 | Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user (basic authentication details only)" information, which can include the session ID of... |
| CVE-2021-21622 | 2021-02-24 | Jenkins Artifact Repository Parameter Plugin 1.0.0 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
| CVE-2020-7846 | 2021-02-24 | Helpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key. It finally leads to a file download and execution via access to crafted web... |
| CVE-2020-28599 | 2021-02-24 | A stack-based buffer overflow vulnerability exists in the import_stl.cc:import_stl() functionality of Openscad openscad-2020.12-RC2. A specially crafted STL file can lead to code execution. An attacker can provide a malicious file... |
| CVE-2021-22667 | 2021-02-24 | BB-ESWGP506-2SFP-T versions 1.01.09 and prior is vulnerable due to the use of hard-coded credentials, which may allow an attacker to gain unauthorized access and permit the execution of arbitrary code... |
| CVE-2020-7836 | 2021-02-24 | VOICEYE WSActiveBridgeES versions prior to 2.1.0.3 contains a stack-based buffer overflow vulnerability caused by improper bound checking parameter given by attack. It finally leads to a stack-based buffer overflow via... |
| CVE-2020-27224 | 2021-02-24 | In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code. |
| CVE-2021-21973 | 2021-02-24 | The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to... |
| CVE-2021-21972 | 2021-02-24 | The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute... |
| CVE-2021-21974 | 2021-02-24 | OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who... |
| CVE-2020-11988 | 2021-02-24 | Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this... |
| CVE-2020-4931 | 2021-02-24 | IBM MQ 9.1 LTS, 9.2 LTS, and 9.1 CD AMQP Channels could allow an authenticated user to cause a denial of service due to an issue processing messages. IBM X-Force... |
| CVE-2021-1227 | 2021-02-24 | Cisco NX-OS Software NX-API Cross-Site Request Forgery Vulnerability |
| CVE-2021-1229 | 2021-02-24 | Cisco NX-OS Software ICMP Version 6 Memory Leak Denial of Service Vulnerability |
| CVE-2021-1228 | 2021-02-24 | Cisco Nexus 9000 Series Fabric Switches ACI Mode Fabric Infrastructure VLAN Unauthorized Access Vulnerability |
| CVE-2021-1230 | 2021-02-24 | Cisco Nexus 9000 Series Fabric Switches ACI Mode BGP Route Installation Denial of Service Vulnerability |
| CVE-2021-1231 | 2021-02-24 | Cisco Nexus 9000 Series Fabric Switches ACI Mode Link Layer Discovery Protocol Port Denial of Service Vulnerability |
| CVE-2021-1361 | 2021-02-24 | Cisco NX-OS Software Unauthenticated Arbitrary File Actions Vulnerability |
| CVE-2021-1367 | 2021-02-24 | Cisco NX-OS Software Protocol Independent Multicast Denial of Service Vulnerability |
| CVE-2021-1368 | 2021-02-24 | Cisco FXOS and NX-OS Software Unidirectional Link Detection Denial of Service and Arbitrary Code Execution Vulnerability |
| CVE-2021-1387 | 2021-02-24 | Cisco NX-OS Software IPv6 Netstack Denial of Service Vulnerability |
| CVE-2021-1388 | 2021-02-24 | Cisco ACI Multi-Site Orchestrator Application Services Engine Deployment Authentication Bypass Vulnerability |
| CVE-2021-1393 | 2021-02-24 | Cisco Application Services Engine Unauthorized Access Vulnerabilities |
| CVE-2021-1396 | 2021-02-24 | Cisco Application Services Engine Unauthorized Access Vulnerabilities |
| CVE-2021-1450 | 2021-02-24 | Cisco AnyConnect Secure Mobility Client Denial of Service Vulnerability |
| CVE-2021-27670 | 2021-02-25 | Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter. |
| CVE-2021-27671 | 2021-02-25 | An issue was discovered in the comrak crate before 0.9.1 for Rust. XSS can occur because the protection mechanism for data: and javascript: URIs is case-sensitive, allowing (for example) Data:... |
| CVE-2020-36254 | 2021-02-25 | scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685. |
| CVE-2020-8032 | 2021-02-25 | Local privilege escalation to root due to insecure tmp file usage |
| CVE-2021-21064 | 2021-02-25 | Magento UPWARD-php Path traversal vulnerability via UPWARD Connector |
| CVE-2021-21065 | 2021-02-25 | Adobe Bridge Font Parsing Out-Of-Bounds Write Arbitrary Code Execution Vulnerability |
| CVE-2021-21066 | 2021-02-25 | Adobe Bridge Font Parsing Out-Of-Bounds Write Arbitrary Code Execution Vulnerability |
| CVE-2021-3273 | 2021-02-25 | Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admin user account in Nagios XI's web system. |
| CVE-2021-3124 | 2021-02-25 | Stored cross-site scripting (XSS) in form field in robust.systems product Custom Global Variables v 1.0.5 allows a remote attacker to inject arbitrary code via the vars[0][name] field. |
| CVE-2021-27330 | 2021-02-25 | Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such... |