CVE-2021-27xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
727 records · Page 7 of 8
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded awnfibre / fibre@dm!n credentials for an ISP.
UpdatedAn issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded rootmet / m3tr0r00t credentials for an ISP.
UpdatedAn issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded gestiontelebucaramanga / t3l3buc4r4m4ng42013 credentials for an ISP.
UpdatedAn issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded adminpldt / z6dUABtl270qRxt7a2uGTiw credentials for an ISP.
UpdatedAn issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded telecomadmin / nE7jA%5m credentials for an ISP.
UpdatedAn issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / admin credentials for an ISP.
UpdatedAn issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / CUadmin credentials for an ISP.
UpdatedAn issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / lnadmin credentials for an ISP.
UpdatedAn issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded f~i!b@e#r$h%o^m*esuperadmin / s(f)u_h+g|u credentials for an ISP.
UpdatedAn issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / user1234 credentials for an ISP.
UpdatedAn issue was discovered on FiberHome HG6245D devices through RP2613. The web management is done over HTTPS, using a hardcoded private key that has 0777 permissions.
UpdatedAn issue was discovered on FiberHome HG6245D devices through RP2613. Credentials in /fhconf/umconfig.txt are obfuscated via XOR with the hardcoded *j7a(L#yZ98sSd5HfSgGjMj8;Ss;d)(*&^#@$a2s0i3g key. (The webs binary has details on how XOR is used.)
UpdatedAn issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to find passwords and authentication cookies stored in cleartext in the web.log HTTP logs.
UpdatedAn issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to extract information from the device without authentication by disabling JavaScript and visiting /info.asp.
UpdatedThe boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT.
UpdatedAn issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachab
Updatedxterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.
UpdatedSerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
UpdatedMoodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML Section" via "Header and Footer" parameter in /admin/settings.php. This vulnerability is leading an attacker to steal admin and all user account cookies by storing the malicious XSS payload in Header and Footer. NOTE: this is disputed by the vendor because the
UpdatedOnline Reviewer System 1.0 contains a SQL injection vulnerability through authentication bypass, which may lead to a reverse shell upload.
UpdatedCASAP Automated Enrollment System version 1.0 contains a cross-site scripting (XSS) vulnerability through the Students > Edit > ROUTE parameter.
UpdatedSQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0 allows an authenticated patient user to dump the database credentials via a SQL injection attack.
UpdatedAn issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally.
UpdatedAn issue was discovered in file profile.go in function MemProf in beego through 2.0.2, allows attackers to launch symlink attacks locally.
UpdatedAn issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/addassignment route, a very long text entry for the"'s_ip" and "s_mac" fields could lead to a Stack-Based Buffer Overflow and overwrite the return address.
UpdatedAn issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/addRouting route. This could lead to Command Injection via Shell Metacharacters.
UpdatedLightCMS v1.3.5 contains a remote code execution vulnerability in /app/Http/Controllers/Admin/NEditorController.php during the downloading of external images.
UpdatedAccellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.
UpdatedAccellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
UpdatedAccellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.
UpdatedAccellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.
UpdatedIn SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node Attestor improperly normalizes the path provided through the agent ID templating feature, which may allow the issuance of an arbitrary SPIFFE ID within the same trust domain, if the attacker controls the value of an EC2 tag prior to attestation, and the attestor is configured for agent ID templating where the tag
UpdatedIn SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to distribute. Proper controls are in place to require that the caller presents a valid agent certificate t
Updated- CVE-2021-27097: The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT. 7.8 High
The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT.
Updated NTFS Elevation of Privilege Vulnerability
UpdatedWindows Media Video Decoder Remote Code Execution Vulnerability
Updated- CVE-2021-27094: Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability 4.4 Medium
Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability
Updated Windows Kernel Information Disclosure Vulnerability
UpdatedAzure AD Web Sign-in Security Feature Bypass Vulnerability
UpdatedRPC Endpoint Mapper Service Elevation of Privilege Vulnerability
UpdatedWindows Secure Kernel Mode Elevation of Privilege Vulnerability
UpdatedMicrosoft Internet Messaging API Remote Code Execution Vulnerability
UpdatedWindows Event Tracing Elevation of Privilege Vulnerability
UpdatedWindows Services and Controller App Elevation of Privilege Vulnerability
UpdatedInternet Explorer Remote Code Execution Vulnerability
UpdatedVisual Studio Code Java Extension Pack Remote Code Execution Vulnerability
UpdatedRemote Development Extension for Visual Studio Code Remote Code Execution Vulnerability
Updated- CVE-2021-27082: Quantum Development Kit for Visual Studio Code Remote Code Execution Vulnerability 7.8 High
Quantum Development Kit for Visual Studio Code Remote Code Execution Vulnerability
Updated Visual Studio Code ESLint Extension Remote Code Execution Vulnerability
UpdatedAzure Sphere Unsigned Code Execution Vulnerability
UpdatedWindows Media Photo Codec Information Disclosure Vulnerability
UpdatedMicrosoft Exchange Server Remote Code Execution Vulnerability
UpdatedWindows Win32k Elevation of Privilege Vulnerability
UpdatedMicrosoft SharePoint Server Remote Code Execution Vulnerability
UpdatedAzure Virtual Machine Information Disclosure Vulnerability
UpdatedAzure Sphere Unsigned Code Execution Vulnerability
UpdatedWin32k Elevation of Privilege Vulnerability
UpdatedWindows 10 Update Assistant Elevation of Privilege Vulnerability
UpdatedVisual Studio Remote Code Execution Vulnerability
Updated- CVE-2021-27067: Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability 6.5 Medium
Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability
Updated Windows Admin Center Security Feature Bypass Vulnerability
UpdatedMicrosoft Exchange Server Remote Code Execution Vulnerability
UpdatedVisual Studio Installer Elevation of Privilege Vulnerability
UpdatedWindows DNS Server Denial of Service Vulnerability
UpdatedHEVC Video Extensions Remote Code Execution Vulnerability
UpdatedHEVC Video Extensions Remote Code Execution Vulnerability
UpdatedVisual Studio Code Remote Code Execution Vulnerability
UpdatedMicrosoft Office Remote Code Execution Vulnerability
UpdatedMicrosoft Office ClickToRun Remote Code Execution Vulnerability
UpdatedMicrosoft Office Remote Code Execution Vulnerability
UpdatedMicrosoft PowerPoint Remote Code Execution Vulnerability
UpdatedMicrosoft Visio Security Feature Bypass Vulnerability
UpdatedMicrosoft Excel Remote Code Execution Vulnerability
UpdatedMicrosoft Excel Remote Code Execution Vulnerability
UpdatedMicrosoft SharePoint Server Information Disclosure Vulnerability
UpdatedHEVC Video Extensions Remote Code Execution Vulnerability
UpdatedHEVC Video Extensions Remote Code Execution Vulnerability
UpdatedHEVC Video Extensions Remote Code Execution Vulnerability
UpdatedHEVC Video Extensions Remote Code Execution Vulnerability
UpdatedHEVC Video Extensions Remote Code Execution Vulnerability
UpdatedA Memory Corruption vulnerability for PDF files in Autodesk Navisworks 2019, 2020, 2021, 2022 may lead to code execution through maliciously crafted DLL files.
UpdatedA maliciously crafted PDF file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boundaries when parsing the PDF file. This vulnerability can be exploited to execute arbitrary code.
UpdatedA Out-Of-Bounds Read/Write Vulnerability in Autodesk FBX Review version 1.4.0 may lead to remote code execution through maliciously crafted DLL files or information disclosure.
UpdatedAn Arbitrary Address Write issue in the Autodesk DWG application can allow a malicious user to leverage the application to write in unexpected paths. In order to exploit this the attacker would need the victim to enable full page heap in the application.
UpdatedA maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. The vulnerability exists because the application fails to handle a crafted DWG file, which causes an unhandled exception. An attacker can leverage this vulnerability to execute arbitrary code.
UpdatedA maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. This vulnerability can be exploited to execute arbitrary code
UpdatedA maliciously crafted DWG file can be forced to read beyond allocated boundaries when parsing the DWG file. This vulnerability can be exploited to execute arbitrary code.
UpdatedA maliciously crafted TIFF and PCX file can be forced to read and write beyond allocated boundaries when parsing the TIFF and PCX file for based overflow. This vulnerability can be exploited to execute arbitrary code.
UpdatedA Type Confusion vulnerability in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can occur when processing a maliciously crafted PDF file. A malicious actor can leverage this to execute arbitrary code.
UpdatedA maliciously crafted PNG, PDF or DWF file in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can be used to attempt to free an object that has already been freed while parsing them. This vulnerability may be exploited by remote malicious actors to execute arbitrary code.
UpdatedA maliciously crafted PCX, PICT, RCL, TIF, BMP, PSD or TIFF file can be used to write beyond the allocated buffer while parsing PCX, PDF, PICT, RCL, BMP, PSD or TIFF files. This vulnerability can be exploited to execute arbitrary code
UpdatedA maliciously crafted TIFF, TIF, PICT, TGA, or DWF files in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can be forced to read beyond allocated boundaries when parsing the TIFF, PICT, TGA or DWF files. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
UpdatedA heap-based buffer overflow could occur while parsing PICT, PCX, RCL or TIFF files in Autodesk Design Review 2018, 2017, 2013, 2012, 2011. This vulnerability can be exploited to execute arbitrary code.
UpdatedA maliciously crafted PDF file, when opened by a user in Autodesk Design Review, can trigger a Double Free vulnerability in the Autodesk Design Review application. A malicious actor may leverage this vulnerability to cause memory corruption and execute arbitrary code in the context of the current process.
UpdatedAutodesk Licensing Installer was found to be vulnerable to privilege escalation issues. A malicious user with limited privileges could run any number of tools on a system to identify services that are configured with weak permissions and are running under elevated privileges. These weak permissions could allow all users on the operating system to modify the service configuration and take ownership
UpdatedA user may be tricked into opening a malicious FBX file which may exploit a use-after-free vulnerability in FBX's Review causing the application to reference a memory location controlled by an unauthorized third party, thereby running arbitrary code on the system.
UpdatedA user may be tricked into opening a malicious FBX file which may exploit a Directory Traversal Remote Code Execution vulnerability in FBX’s Review causing it to run arbitrary code on the system.
UpdatedThe user may be tricked into opening a malicious FBX file which may exploit a Null Pointer Dereference vulnerability in FBX's Review version 1.5.0 and prior causing the application to crash leading to a denial of service.
UpdatedA Memory Corruption Vulnerability in Autodesk FBX Review version 1.5.0 and prior may lead to remote code execution through maliciously crafted DLL files.
UpdatedAn Out-Of-Bounds Read Vulnerability in Autodesk FBX Review version 1.5.0 and prior may lead to code execution through maliciously crafted DLL files or information disclosure.
Updated