VIR Vulnerability Intelligence Relay

CVEs from 2021

5,047 normalized CVEs published or assigned in this year.

Total
5,047
critical
critical 273
high
high 972
medium
medium 1,144
low
low 135
% Critical
5.4%
% with KEV
4.2%
% with exploit
4.2%

Top vendors

Top products

  • office 13
  • 365_apps 6
  • office_long_term_servicing_channel 6
  • library_automation_system 5
  • single_connect 4
  • http_server 3
  • solidfire 2
  • student_information_management_system 2

Top packages

Severitycriticalhighmediumlowunknown
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2021-29427 high — 8.0 — In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning. Repository content filtering is a security control Gra… archsusedebian
CVE-2021-21229 high — 8.0 — Incorrect security UI in downloads in Google Chrome on Android prior to 90.0.4430.93 allowed a remote attacker to perform domain spoofing via a crafted HTML page. archdebian
CVE-2021-21114 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21170 high — 8.0 — Incorrect security UI in Loader in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted … archdebian
CVE-2021-21228 high — 8.0 — Insufficient policy enforcement in extensions in Google Chrome prior to 90.0.4430.93 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a … archdebian
CVE-2021-21182 high — 8.0 — Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafte… archdebian
CVE-2021-39887 high — 8.0 — multiple issues in gitlab arch
CVE-2021-32917 high — 8.0 — An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use … archdebian
CVE-2021-39879 high — 8.0 — multiple issues in gitlab arch
CVE-2021-2282 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows unauth… archdebian
CVE-2021-28457 high — 8.0 — arbitrary code execution in code arch
CVE-2021-22237 high — 8.0 — multiple issues in gitlab arch
CVE-2021-22915 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-21178 high — 8.0 — Inappropriate implementation in Compositing in Google Chrome on Linux and Windows prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML pag… archdebian
CVE-2021-2442 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.24. Easily exploitable vulnerability allows high p… archdebian
CVE-2021-2130 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high p… archdebian
CVE-2021-35538 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.28. Easily exploitable vulnerability allows low pr… archdebian
CVE-2021-21184 high — 8.0 — Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. archdebian
CVE-2021-32741 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-28473 high — 8.0 — arbitrary code execution in code arch
CVE-2021-22229 high — 8.0 — multiple issues in gitlab arch
CVE-2021-32733 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-22230 high — 8.0 — multiple issues in gitlab arch
CVE-2021-2321 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows high p… archdebian
CVE-2021-22225 high — 8.0 — multiple issues in gitlab arch
CVE-2021-22226 high — 8.0 — multiple issues in gitlab arch
CVE-2021-37970 high — 8.0 — Use after free in File System API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-22231 high — 8.0 — multiple issues in gitlab arch
CVE-2021-32703 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-32725 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-32680 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-30629 high — 8.0 — arbitrary code execution in chromium archdebian
CVE-2021-23998 high — 8.0 — Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Fir… archsusedebian
CVE-2021-38497 high — 8.0 — Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusion and spoofing attacks. This vulnerabil… archsusedebianrockylinux
CVE-2021-3405 high — 8.0 — A flaw was found in libebml before 1.4.2. A heap overflow bug exists in the implementation of EbmlString::ReadData and EbmlUnicodeString::ReadData in libebml. archdebian
CVE-2021-32726 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-1053 high — 8.0 — multiple issues in nvidia-utils archsusedebian
CVE-2021-38498 high — 8.0 — During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Fire… archsusedebianrockylinux
CVE-2021-32678 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-22227 high — 8.0 — multiple issues in gitlab arch
CVE-2021-22224 high — 8.0 — multiple issues in gitlab arch
CVE-2021-29964 high — 8.0 — A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read. *This bug only affects Firefox on Windows. Other operat… archdebian
CVE-2021-38501 high — 8.0 — Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these… archsusedebianrockylinux
CVE-2021-21160 high — 8.0 — Heap buffer overflow in WebAudio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-30599 high — 8.0 — Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. archdebian
CVE-2021-21163 high — 8.0 — Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page and a malicious server. archdebian
CVE-2021-30540 high — 8.0 — Incorrect security UI in payments in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform domain spoofing via a crafted HTML page. archdebian
CVE-2021-20179 high — 8.0 — Important: pki-core:10.6 security update debianrockylinux
CVE-2021-37978 high — 8.0 — Heap buffer overflow in Blink in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-37958 high — 8.0 — Inappropriate implementation in Navigation in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to inject scripts or HTML into a privileged page via a crafted HTML page. archdebian
CVE-2021-29265 high — 8.0 — An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up sequence has race… archsusedebian
CVE-2021-39890 high — 8.0 — multiple issues in gitlab arch
CVE-2021-3551 high — 8.0 — Important: pki-core:10.6 security update debianrockylinux
CVE-2021-21221 high — 8.0 — Insufficient validation of untrusted input in Mojo in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HT… archdebian
CVE-2021-29971 high — 8.0 — If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host - irrespective of scheme or port - would be granted that permission. *This bug only affects … archdebian
CVE-2021-29973 high — 8.0 — Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This was corrected to require user interaction with the page before a user's password would be ente… archdebian
CVE-2021-22239 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21208 high — 8.0 — Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing via a crafted QR code. archdebian
CVE-2021-30601 high — 8.0 — Use after free in Extensions API in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted… archdebian
CVE-2021-30606 high — 8.0 — Chromium: CVE-2021-30606 Use after free in Blink archdebian
CVE-2021-30622 high — 8.0 — Chromium: CVE-2021-30622 Use after free in WebApp Installs archdebian
CVE-2021-4064 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-37957 high — 8.0 — Use after free in WebGPU in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-30623 high — 8.0 — Chromium: CVE-2021-30623 Use after free in Bookmarks archdebian
CVE-2021-21226 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21225 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21223 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21111 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21227 high — 8.0 — Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-21222 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-2131 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high p… archdebian
CVE-2021-21192 high — 8.0 — arbitrary code execution in chromium archdebian
CVE-2021-21116 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21191 high — 8.0 — arbitrary code execution in chromium archdebian
CVE-2021-21115 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-35542 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.28. Easily exploitable vulnerability allows high p… archdebian
CVE-2021-21106 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21113 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21112 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21110 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21109 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21108 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21107 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-30521 high — 8.0 — Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. archdebian
CVE-2021-41611 high — 8.0 — An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem all… archdebian
CVE-2021-39886 high — 8.0 — multiple issues in gitlab arch
CVE-2021-37960 high — 8.0 — multiple issues in chromium arch
CVE-2021-21216 high — 8.0 — Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a crafted HTML page. archdebian
CVE-2021-21150 high — 8.0 — Use after free in Downloads in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted… archdebian
CVE-2021-39882 high — 8.0 — multiple issues in gitlab arch
CVE-2021-32688 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-30620 high — 8.0 — Chromium: CVE-2021-30620 Insufficient policy enforcement in Blink archdebian
CVE-2021-39878 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21164 high — 8.0 — Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. archdebian
CVE-2021-22181 high — 8.0 — multiple issues in gitlab arch
CVE-2021-32653 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-21212 high — 8.0 — Incorrect security UI in Network Config UI in Google Chrome on ChromeOS prior to 90.0.4430.72 allowed a remote attacker to potentially compromise WiFi connection security via a malicious WAP. archdebian
CVE-2021-21174 high — 8.0 — Inappropriate implementation in Referrer in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. archdebian
CVE-2021-3557 high — 8.0 — information disclosure in argocd arch
CVE-2021-28375 high — 8.0 — An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, aka CID-20c40794eb85… archsusedebian