CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2021(Bypass)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2021-45814 89 Sql Bypass 2021-12-28 2022-01-07
7.5
None Remote Low Not required Partial Partial Partial
Nettmp NNT 5.1 is affected by a SQL injection vulnerability. An attacker can bypass authentication and access the panel with an administrative account.
2 CVE-2021-45708 668 Bypass +Info 2021-12-27 2022-01-10
5.0
None Remote Low Not required Partial None None
An issue was discovered in the abomonation crate through 2021-10-17 for Rust. Because transmute operations are insufficiently constrained, there can be an information leak or ASLR bypass.
3 CVE-2021-45695 Exec Code Bypass 2021-12-27 2022-01-06
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in the mopa crate through 2021-06-01 for Rust. It incorrectly relies on Trait memory layout, possibly leading to future occurrences of arbitrary code execution or ASLR bypass.
4 CVE-2021-45511 287 Bypass 2021-12-26 2022-01-06
10.0
None Remote Low Not required Complete Complete Complete
Certain NETGEAR devices are affected by authentication bypass. This affects AC2100 before 2021-08-27, AC2400 before 2021-08-27, AC2600 before 2021-08-27, D7000 before 2021-08-27, R6220 before 2021-08-27, R6230 before 2021-08-27, R6260 before 2021-08-27, R6330 before 2021-08-27, R6350 before 2021-08-27, R6700v2 before 2021-08-27, R6800 before 2021-08-27, R6850 before 2021-08-27, R6900v2 before 2021-08-27, R7200 before 2021-08-27, R7350 before 2021-08-27, R7400 before 2021-08-27, and R7450 before 2021-08-27.
5 CVE-2021-45510 287 Bypass 2021-12-26 2022-01-05
5.8
None Local Network Low Not required Partial Partial Partial
NETGEAR XR1000 devices before 1.0.0.58 are affected by authentication bypass.
6 CVE-2021-45509 287 Bypass 2021-12-26 2022-01-05
7.5
None Remote Low Not required Partial Partial Partial
Certain NETGEAR devices are affected by authentication bypass. This affects CBR40 before 2.5.0.24, RBK752 before 3.2.17.12, RBR750 before 3.2.17.12, RBS750 before 3.2.17.12, RBK852 before 3.2.17.12, RBR850 before 3.2.17.12, and RBS850 before 3.2.17.12.
7 CVE-2021-45508 287 Bypass 2021-12-26 2022-01-05
7.5
None Remote Low Not required Partial Partial Partial
Certain NETGEAR devices are affected by authentication bypass. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, RBK752 before 3.2.17.12, RBR750 before 3.2.17.12, RBS750 before 3.2.17.12, RBK852 before 3.2.17.12, and RBR850 before 3.2.17.12.
8 CVE-2021-45507 287 Bypass 2021-12-26 2022-01-05
7.5
None Remote Low Not required Partial Partial Partial
Certain NETGEAR devices are affected by authentication bypass. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, RBW30 before 2.6.2.2, RBK752 before 3.2.17.12, RBR750 before 3.2.17.12, RBS750 before 3.2.17.12, RBK852 before 3.2.17.12, RBR850 before 3.2.17.12, RBS850 before 3.2.17.12, and RBS40V before 2.6.2.8.
9 CVE-2021-45506 287 Bypass 2021-12-26 2022-01-05
5.8
None Local Network Low Not required Partial Partial Partial
Certain NETGEAR devices are affected by authentication bypass. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17.12, RBR750 before 3.2.17.12, RBS750 before 3.2.17.12, RBK852 before 3.2.17.12, RBR850 before 3.2.17.12, and RBS850 before 3.2.17.12.
10 CVE-2021-45505 287 Bypass 2021-12-26 2022-01-05
5.8
None Local Network Low Not required Partial Partial Partial
Certain NETGEAR devices are affected by authentication bypass. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17.12, RBR750 before 3.2.17.12, RBS750 before 3.2.17.12, RBK852 before 3.2.17.12, RBR850 before 3.2.17.12, and RBS850 before 3.2.17.12.
11 CVE-2021-45504 287 Bypass 2021-12-26 2022-01-05
7.5
None Remote Low Not required Partial Partial Partial
Certain NETGEAR devices are affected by authentication bypass. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, RBR852 before 3.2.17.12, RBR850 before 3.2.17.12, and RBS850 before 3.2.17.12.
12 CVE-2021-45503 287 Bypass 2021-12-26 2022-01-05
5.8
None Local Network Low Not required Partial Partial Partial
Certain NETGEAR devices are affected by authentication bypass. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17.12, RBR750 before 3.2.17.12, RBS750 before 3.2.17.12, RBK852 before 3.2.17.12, RBR850 before 3.2.17.12, and RBS850 before 3.2.17.12.
13 CVE-2021-45502 287 Bypass 2021-12-26 2022-01-05
5.8
None Local Network Low Not required Partial Partial Partial
Certain NETGEAR devices are affected by authentication bypass. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17.12, RBK752 before 3.2.17.12, RBR750 before 3.2.17.12, RBS750 before 3.2.17.12, RBK852 before 3.2.17.12, RBR850 before 3.2.17.12, and RBS850 before 3.2.17.12.
14 CVE-2021-45501 287 Bypass 2021-12-26 2022-01-06
10.0
None Remote Low Not required Complete Complete Complete
Certain NETGEAR devices are affected by authentication bypass. This affects AC2400 before 1.1.0.84, AC2600 before 1.1.0.84, D7000 before 1.0.1.82, R6020 before 1.0.0.52, R6080 before 1.0.0.52, R6120 before 1.0.0.80, R6220 before 1.1.0.110, R6230 before 1.1.0.110, R6260 before 1.1.0.84, R6330 before 1.1.0.84, R6350 before 1.1.0.84, R6700v2 before 1.1.0.84, R6800 before 1.1.0.84, R6850 before 1.1.0.84, R6900v2 before 1.1.0.84, R7200 before 1.1.0.84, R7350 before 1.1.0.84, R7400 before 1.1.0.84, and R7450 before 1.1.0.84.
15 CVE-2021-45500 287 Bypass 2021-12-26 2022-01-05
5.8
None Local Network Low Not required Partial Partial Partial
Certain NETGEAR devices are affected by authentication bypass. This affects R7000P before 1.3.3.140 and R8000 before 1.0.4.68.
16 CVE-2021-45499 287 Bypass 2021-12-26 2022-01-05
6.5
None Remote Low ??? Partial Partial Partial
Certain NETGEAR devices are affected by authentication bypass. This affects R6900P before 1.3.3.140, R7000P before 1.3.3.140, R7900P before 1.4.2.84, R7960P before 1.4.2.84, R8000P before 1.4.2.84, RAX75 before 1.0.3.106, and RAX80 before 1.0.3.106.
17 CVE-2021-45498 287 Bypass 2021-12-26 2022-01-04
10.0
None Remote Low Not required Complete Complete Complete
NETGEAR R6700v2 devices before 1.2.0.88 are affected by authentication bypass.
18 CVE-2021-45497 287 Bypass 2021-12-26 2022-01-04
10.0
None Remote Low Not required Complete Complete Complete
NETGEAR D7000 devices before 1.0.1.82 are affected by authentication bypass.
19 CVE-2021-45496 287 Bypass 2021-12-26 2022-01-04
10.0
None Remote Low Not required Complete Complete Complete
NETGEAR D7000 devices before 1.0.1.82 are affected by authentication bypass.
20 CVE-2021-45495 287 Bypass 2021-12-26 2022-01-04
10.0
None Remote Low Not required Complete Complete Complete
NETGEAR D7000 devices before 1.0.1.68 are affected by authentication bypass.
21 CVE-2021-45451 327 Bypass 2021-12-21 2022-01-04
5.0
None Remote Low Not required Partial None None
In Mbed TLS before 3.1.0, psa_aead_generate_nonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application.
22 CVE-2021-45450 327 Bypass 2021-12-21 2022-01-04
5.0
None Remote Low Not required Partial None None
In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application.
23 CVE-2021-45339 269 +Priv Bypass 2021-12-27 2022-01-10
7.2
None Local Low Not required Complete Complete Complete
Privilege escalation vulnerability in Avast Antivirus prior to 20.4 allows a local user to gain elevated privileges by "hollowing" trusted process which could lead to the bypassing of Avast self-defense.
24 CVE-2021-45232 306 Bypass 2021-12-27 2022-01-07
7.5
None Remote Low Not required Partial Partial Partial
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.
25 CVE-2021-45098 Bypass 2021-12-16 2022-01-04
5.0
None Remote Low Not required None Partial None
An issue was discovered in Suricata before 6.0.4. It is possible to bypass/evade any HTTP-based signature by faking an RST TCP packet with random TCP options of the md5header from the client side. After the three-way handshake, it's possible to inject an RST ACK with a random TCP md5header option. Then, the client can send an HTTP GET request with a forbidden URL. The server will ignore the RST ACK and send the response HTTP packet for the client's request. These packets will not trigger a Suricata reject action.
26 CVE-2021-44966 89 Sql Bypass 2021-12-13 2021-12-17
10.0
None Remote Low Not required Complete Complete Complete
SQL injection bypass authentication vulnerability in PHPGURUKUL Employee Record Management System 1.2 via index.php. An attacker can log in as an admin account of this system and can destroy, change or manipulate all sensitive information on the system.
27 CVE-2021-44699 125 Bypass 2021-12-20 2021-12-23
4.3
None Remote Medium Not required Partial None None
Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious MP4 file.
28 CVE-2021-44698 125 Bypass 2021-12-20 2021-12-23
4.3
None Remote Medium Not required Partial None None
Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious MP4 file.
29 CVE-2021-44697 125 Bypass 2021-12-20 2021-12-23
4.3
None Remote Medium Not required Partial None None
Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious MOV file.
30 CVE-2021-44675 287 Exec Code Bypass 2021-12-20 2022-01-03
7.5
None Remote Low Not required Partial Partial Partial
Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authentication is not required.
31 CVE-2021-44655 89 Sql Bypass 2021-12-15 2022-03-29
7.5
None Remote Low Not required Partial Partial Partial
Online Pre-owned/Used Car Showroom Management System 1.0 contains a SQL injection authentication bypass vulnerability. Admin panel authentication can be bypassed due to SQL injection vulnerability in the login form allowing attacker to get admin access on the application.
32 CVE-2021-44653 89 Sql Bypass 2021-12-15 2022-03-29
7.5
None Remote Low Not required Partial Partial Partial
Online Magazine Management System 1.0 contains a SQL injection authentication bypass vulnerability. The Admin panel authentication can be bypassed due to SQL injection vulnerability in the login form allowing attacker to gain access as admin to the application.
33 CVE-2021-44526 287 Bypass 2021-12-23 2022-01-06
6.8
None Remote Medium Not required Partial Partial Partial
Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations.
34 CVE-2021-44525 668 Bypass 2021-12-20 2022-01-04
7.5
None Remote Low Not required Partial Partial Partial
Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which authentication is not required.
35 CVE-2021-44515 287 Exec Code Bypass 2021-12-12 2021-12-16
10.0
None Remote Low Not required Complete Complete Complete
Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.
36 CVE-2021-44420 287 Bypass 2021-12-08 2022-02-22
7.5
None Remote Low Not required Partial Partial Partial
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
37 CVE-2021-44225 668 Bypass 2021-11-26 2022-03-31
5.5
None Remote Low ??? Partial Partial None
In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable (writable) property
38 CVE-2021-44187 125 Bypass 2021-12-07 2022-01-21
4.3
None Remote Medium Not required Partial None None
Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious SGI file.
39 CVE-2021-44186 125 Bypass 2021-12-07 2022-01-21
4.3
None Remote Medium Not required Partial None None
Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious SGI file.
40 CVE-2021-44185 125 Bypass 2021-12-07 2022-01-21
4.3
None Remote Medium Not required Partial None None
Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious RGB file.
41 CVE-2021-44183 125 Bypass 2021-12-20 2021-12-22
4.3
None Remote Medium Not required Partial None None
Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file.
42 CVE-2021-44182 125 Bypass 2021-12-20 2021-12-22
4.3
None Remote Medium Not required Partial None None
Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious SVG file.
43 CVE-2021-44164 434 Exec Code Bypass 2021-12-20 2021-12-27
7.5
None Remote Low Not required Partial Partial Partial
Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker to by-pass file type validation, upload malicious script and execute arbitrary code without authentication, in order to take control of the system or terminate service.
44 CVE-2021-44149 863 Bypass 2021-12-07 2021-12-14
4.6
None Local Low Not required Partial Partial Partial
An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a v cycle.
45 CVE-2021-44093 434 Exec Code Bypass 2021-11-28 2021-11-29
7.5
None Remote Low Not required Partial Partial Partial
A Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar function, could bypass the original limit, upload the JSP file to get a WebShell
46 CVE-2021-44033 307 Bypass 2021-11-19 2021-11-23
4.6
None Local Low Not required Partial Partial Partial
In Ionic Identity Vault before 5.0.5, the protection mechanism for invalid unlock attempts can be bypassed.
47 CVE-2021-43979 755 Bypass 2021-11-17 2021-11-22
5.0
None Remote Low Not required None Partial None
** DISPUTED ** Styra Open Policy Agent (OPA) Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control. The data replication mechanism allows policies to access the Kubernetes cluster state. During data replication, OPA/Gatekeeper does not wait for the replication to finish before processing a request, which might cause inconsistencies between the replicated resources in OPA/Gatekeeper and the resources actually present in the cluster. Inconsistency can later be reflected in a policy bypass. NOTE: the vendor disagrees that this is a vulnerability, because Kubernetes states are only eventually consistent.
48 CVE-2021-43931 287 Bypass 2021-12-06 2021-12-07
7.5
None Remote Low Not required Partial Partial Partial
The authentication algorithm of the WebHMI portal is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
49 CVE-2021-43809 88 Exec Code Bypass 2021-12-08 2021-12-13
9.3
None Remote Medium Not required Complete Complete Complete
`Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless `Gemfile`'s, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the `Gemfile` itself. However, if the `Gemfile` includes `gem` entries that use the `git` option with invalid, but seemingly harmless, values with a leading dash, this can be false. To handle dependencies that come from a Git repository instead of a registry, Bundler uses various commands, such as `git clone`. These commands are being constructed using user input (e.g. the repository URL). When building the commands, Bundler versions before 2.2.33 correctly avoid Command Injection vulnerabilities by passing an array of arguments instead of a command string. However, there is the possibility that a user input starts with a dash (`-`) and is therefore treated as an optional argument instead of a positional one. This can lead to Code Execution because some of the commands have options that can be leveraged to run arbitrary executables. Since this value comes from the `Gemfile` file, it can contain any character, including a leading dash. To exploit this vulnerability, an attacker has to craft a directory containing a `Gemfile` file that declares a dependency that is located in a Git repository. This dependency has to have a Git URL in the form of `-u./payload`. This URL will be used to construct a Git clone command but will be interpreted as the upload-pack argument. Then this directory needs to be shared with the victim, who then needs to run a command that evaluates the Gemfile, such as `bundle lock`, inside. This vulnerability can lead to Arbitrary Code Execution, which could potentially lead to the takeover of the system. However, the exploitability is very low, because it requires a lot of user interaction. Bundler 2.2.33 has patched this problem by inserting `--` as an argument before any positional arguments to those Git commands that were affected by this issue. Regardless of whether users can upgrade or not, they should review any untrustred `Gemfile`'s before running any `bundler` commands that may read them, since they can contain arbitrary ruby code.
50 CVE-2021-43807 290 Bypass CSRF 2021-12-14 2021-12-20
4.3
None Remote Medium Not required None Partial None
Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast versions prior to 9.10 allow HTTP method spoofing, allowing to change the assumed HTTP method via URL parameter. This allows attackers to turn HTTP GET requests into PUT requests or an HTTP form to send DELETE requests. This bypasses restrictions otherwise put on these types of requests and aids in cross-site request forgery (CSRF) attacks, which would otherwise not be possible. The vulnerability allows attackers to craft links or forms which may change the server state. This issue is fixed in Opencast 9.10 and 10.0. You can mitigate the problem by setting the `SameSite=Strict` attribute for your cookies. If this is a viable option for you depends on your integrations. We strongly recommend updating in any case.
Total number of vulnerabilities : 880   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.