CVE-2021-31xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
760 records · Page 6 of 8
The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow a remote attacker to gain access to the device if the service is enabled. Telnet is disabled by default on the SINAMICS Medium Voltage Products (SINAMICS SL150: All versions, SINAMICS SM150: All versions, SINAMICS SM150i: All versions).
UpdatedA Cross-Site Scripting (XSS) vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. An authenticated attacker may inject malicious Javascript code when using Markdown editing within the application which remains persistent.
UpdatedCross Site Scripting (XSS) in Remote Clinic v2.0 via the "Chat" and "Personal Address" field on staff/register.php
UpdatedStored XSS in Remote Clinic v2.0 in /medicines due to Medicine Name Field.
UpdatedD-Link DIR-816 A2 1.10 B05 allows unauthenticated attackers to arbitrarily reset the device via a crafted tokenid parameter to /goform/form2Reboot.cgi.
UpdatedThe unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution.
UpdatedTelegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
UpdatedTelegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
UpdatedTelegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the gray_split_cubic function of their custom fork of the rlottie library. A remote attacker might be able to overwrite Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker.
UpdatedTelegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the VGradientCache::generateGradientColorTable function of their custom fork of the rlottie library. A remote attacker might be able to overwrite heap memory out-of-bounds on a victim device via a malicious animated sticker.
UpdatedTelegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
UpdatedTelegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
UpdatedTelegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's heap memory out-of-bounds on a victim device via a malicious animated sticker.
UpdatedThe unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.
UpdatedTelegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the blit function of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker.
UpdatedFile upload vulnerability in ejinshan v8+ terminal security system allows attackers to upload arbitrary files to arbitrary locations on the server.
UpdatedRedis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.
UpdatedAn integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap-based buffer overflow and cause a denial of service (DOS) via crafted metadata.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-29457. Reason: This candidate is a duplicate of CVE-2021-29457. Notes: All CVE users should reference CVE-2021-29457 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
Updated · Rejected recordAn issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the keywords parameter.
UpdatedIn LibreNMS < 21.3.0, a stored XSS vulnerability was identified in the API Access page due to insufficient sanitization of the $api->description variable. As a result, arbitrary Javascript code can get executed.
UpdatedSerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution or privilege escalation.
UpdatedThe AV1_DuplicateConfig function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
UpdatedThe gf_hinter_track_new function in GPAC 1.0.1 allows attackers to read memory via a crafted file in the MP4Box command.
UpdatedThe MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
UpdatedThe gf_isom_cenc_get_default_info_internal function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
UpdatedThe gf_isom_set_extraction_slc function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
UpdatedThe HintFile function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
UpdatedMemory leak in the stbl_GetSampleInfos function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
UpdatedBuffer overflow in the abst_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
UpdatedBuffer overflow in the tenc_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file, related invalid IV sizes.
UpdatedAn open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices from CHIYU Technology that can be exploited by sending a link that has a specially crafted URL to convince the user to click on it.
UpdatedAn authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows obtaining a privileged connection with the target device by supplying a specially malformed request and an attacker may force the remote telnet server to believe that the user has already authenticated.
UpdatedMultiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of sanitization of the input on the components man.cgi, if.cgi, dhcpc.cgi, ppp.cgi.
UpdatedA CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the parameter redirect= available on multiple CGI components.
Updatedomr-admin.py in openmptcprouter-vps-admin 0.57.3 and earlier compares the user provided password with the original password in a length dependent manner, which allows remote attackers to guess the password via a timing attack.
UpdatedAn issue found in libming v.0.4.8 allows a local attacker to execute arbitrary code via the parseSWF_IMPORTASSETS function in the parser.c file.
UpdatedAn issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function.
UpdatedSQL Injection vulnerability found in Fighting Cock Information System v.1.0 allows a remote attacker to obtain sensitive information via the edit_breed.php parameter.
UpdatedThe Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templa
UpdatedThe Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can
UpdatedAn issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd() performs incorrect memory handling while parsing crafted XML files, which leads to an out-of-bounds write of a one byte constant.
UpdatedAn issue was discovered in HCC embedded InterNiche 4.0.1. This vulnerability allows the attacker to predict a DNS query's source port in order to send forged DNS response packets that will be accepted as valid answers to the DNS client's requests (without sniffing the specific request). Data is predictable because it is based on the time of day, and has too few bits.
UpdatedAn issue was discovered in HCC embedded InterNiche 4.0.1. A potential heap buffer overflow exists in the code that parses the HTTP POST request, due to an incorrect signed integer comparison. This vulnerability requires the attacker to send a malformed HTTP packet with a negative Content-Length, which bypasses the size checks and results in a large heap overflow in the wbs_multidata buffer copy.
UpdatedAn issue was discovered in HCC embedded InterNiche 4.0.1. A potential heap buffer overflow exists in the code that parses the HTTP POST request, due to lack of size validation. This vulnerability requires the attacker to send a crafted HTTP POST request with a URI longer than 50 bytes. This leads to a heap overflow in wbs_post() via an strcpy() call.
UpdatedSES Evolution before 2.1.0 allows deleting some resources not currently in use by any security policy by leveraging access to a computer having the administration console installed.
UpdatedSES Evolution before 2.1.0 allows duplicating an existing security policy by leveraging access of a user having read-only access to security policies.
UpdatedSES Evolution before 2.1.0 allows reading some parts of a security policy by leveraging access to a computer having the administration console installed.
UpdatedSES Evolution before 2.1.0 allows updating some parts of a security policy by leveraging access to a computer having the administration console installed.
UpdatedSES Evolution before 2.1.0 allows deleting some parts of a security policy by leveraging access to a computer having the administration console installed.
UpdatedSES Evolution before 2.1.0 allows modifying security policies by leveraging access of a user having read-only access to security policies.
UpdatedIn SolarWinds DameWare Mini Remote Control Server 12.0.1.200, insecure file permissions allow file deletion as SYSTEM.
UpdatedSiren Investigate before 11.1.1 contains a server side request forgery (SSRF) defect in the built-in image proxy route (which is enabled by default). An attacker with access to the Investigate installation can specify an arbitrary URL in the parameters of the image proxy route and fetch external URLs as the Investigate process on the host.
UpdatedSchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as SlurmUser because use of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling.
UpdatedVisual Studio Code Remote Code Execution Vulnerability
Updated- CVE-2021-31213: Visual Studio Code Remote Containers Extension Remote Code Execution Vulnerability 7.8 High
Visual Studio Code Remote Containers Extension Remote Code Execution Vulnerability
Updated Visual Studio Code Remote Code Execution Vulnerability
UpdatedMicrosoft Exchange Server Spoofing Vulnerability
UpdatedWindows Container Manager Service Elevation of Privilege Vulnerability
UpdatedMicrosoft Exchange Server Security Feature Bypass Vulnerability
UpdatedMicrosoft Exchange Server Remote Code Execution Vulnerability
UpdatedWindows SMB Client Security Feature Bypass Vulnerability
Updated.NET and Visual Studio Elevation of Privilege Vulnerability
Updated- CVE-2021-31201: Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability 5.2 Medium
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability
Updated Common Utilities Remote Code Execution Vulnerability
Updated- CVE-2021-31199: Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability 5.2 Medium
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability
Updated Microsoft Exchange Server Remote Code Execution Vulnerability
UpdatedMicrosoft Exchange Server Remote Code Execution Vulnerability
UpdatedMicrosoft Exchange Server Remote Code Execution Vulnerability
UpdatedOLE Automation Remote Code Execution Vulnerability
UpdatedWindows SSDP Service Elevation of Privilege Vulnerability
UpdatedWindows Media Foundation Core Remote Code Execution Vulnerability
Updated- CVE-2021-31191: Windows Projected File System FS Filter Driver Information Disclosure Vulnerability 5.5 Medium
Windows Projected File System FS Filter Driver Information Disclosure Vulnerability
Updated - CVE-2021-31190: Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability 7.8 High
Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability
Updated Windows Graphics Component Elevation of Privilege Vulnerability
UpdatedWindows WalletService Elevation of Privilege Vulnerability
UpdatedWindows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
UpdatedWindows Desktop Bridge Denial of Service Vulnerability
UpdatedMicrosoft Windows Infrared Data Association (IrDA) Information Disclosure Vulnerability
UpdatedWindows TCP/IP Driver Denial of Service Vulnerability
UpdatedMicrosoft Bluetooth Driver Spoofing Vulnerability
UpdatedMicrosoft SharePoint Remote Code Execution Vulnerability
UpdatedMicrosoft Office Graphics Remote Code Execution Vulnerability
UpdatedMicrosoft Office Remote Code Execution Vulnerability
UpdatedMicrosoft Office Information Disclosure Vulnerability
UpdatedMicrosoft Office Remote Code Execution Vulnerability
UpdatedMicrosoft Office Remote Code Execution Vulnerability
UpdatedMicrosoft Office Remote Code Execution Vulnerability
UpdatedMicrosoft Excel Information Disclosure Vulnerability
UpdatedMicrosoft SharePoint Server Information Disclosure Vulnerability
UpdatedMicrosoft SharePoint Server Spoofing Vulnerability
UpdatedMicrosoft SharePoint Information Disclosure Vulnerability
UpdatedWindows Graphics Component Elevation of Privilege Vulnerability
UpdatedWindows Container Manager Service Elevation of Privilege Vulnerability
UpdatedWindows Container Manager Service Elevation of Privilege Vulnerability
UpdatedWindows Container Manager Service Elevation of Privilege Vulnerability
UpdatedHTTP Protocol Stack Remote Code Execution Vulnerability
UpdatedWindows Container Manager Service Elevation of Privilege Vulnerability
UpdatedApache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements.
UpdatedIn the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics.
Updated