VIR Vulnerability Intelligence Relay

CVEs from 2021

6,087 normalized CVEs published or assigned in this year.

Total
6,087
critical
critical 273
high
high 975
medium
medium 1,141
low
low 135
% Critical
4.5%
% with KEV
3.5%
% with exploit
3.5%

Top vendors

Top products

  • office 13
  • 365_apps 6
  • office_long_term_servicing_channel 6
  • library_automation_system 5
  • single_connect 4
  • http_server 3
  • solidfire 2
  • student_information_management_system 2

Top packages

Severitycriticalhighmediumlowunknown
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2021-39873 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21232 high — 8.0 — Use after free in Dev Tools in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-22208 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39878 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39890 high — 8.0 — multiple issues in gitlab arch
CVE-2021-38494 high — 8.0 — Mozilla developers reported memory safety bugs present in Firefox 91. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been expl… archdebian
CVE-2021-41387 high — 8.0 — seatd-launch in seatd 0.6.x before 0.6.2 allows privilege escalation because it uses execlp and may be installed setuid root. archdebian
CVE-2021-30631 high — 8.0 — arbitrary code execution in chromium arch
CVE-2021-39175 high — 8.0 — cross-site scripting in hedgedoc arch
CVE-2021-22220 high — 8.0 — multiple issues in gitlab arch
CVE-2021-32654 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-32778 high — 8.0 — multiple issues in istio arch
CVE-2021-22214 high — 8.0 — multiple issues in gitlab arch
CVE-2021-22915 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-32653 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-32705 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-22237 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39884 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21156 high — 8.0 — Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption via a crafted script. archdebian
CVE-2021-3557 high — 8.0 — information disclosure in argocd arch
CVE-2021-28477 high — 8.0 — arbitrary code execution in code arch
CVE-2021-39909 high — 8.0 — multiple issues in gitlab arch
CVE-2021-37968 high — 8.0 — Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted HTML page. archdebian
CVE-2021-37980 high — 8.0 — Inappropriate implementation in Sandbox in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially bypass site isolation via Windows. archdebian
CVE-2021-21212 high — 8.0 — Incorrect security UI in Network Config UI in Google Chrome on ChromeOS prior to 90.0.4430.72 allowed a remote attacker to potentially compromise WiFi connection security via a malicious WAP. archdebian
CVE-2021-21176 high — 8.0 — Inappropriate implementation in full screen mode in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. archdebian
CVE-2021-22223 high — 8.0 — multiple issues in gitlab arch
CVE-2021-22225 high — 8.0 — multiple issues in gitlab arch
CVE-2021-22229 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21210 high — 8.0 — Inappropriate implementation in Network in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially access local UDP ports via a crafted HTML page. archdebian
CVE-2021-21162 high — 8.0 — Use after free in WebRTC in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-22231 high — 8.0 — multiple issues in gitlab arch
CVE-2021-32703 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-2264 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows low pr… archdebian
CVE-2021-32726 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-32680 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-21165 high — 8.0 — Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-2283 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows unauth… archdebian
CVE-2021-41259 high — 8.0 — multiple issues in nim arch
CVE-2021-32678 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-41611 high — 8.0 — An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem all… archdebian
CVE-2021-21229 high — 8.0 — Incorrect security UI in downloads in Google Chrome on Android prior to 90.0.4430.93 allowed a remote attacker to perform domain spoofing via a crafted HTML page. archdebian
CVE-2021-22228 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21227 high — 8.0 — Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-22227 high — 8.0 — multiple issues in gitlab arch
CVE-2021-28373 high — 8.0 — The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) before 2021-03-12 allows an attacker to log in via the OTP code without a valid password. NOTE: this issue only affected the git master branch f… archdebian
CVE-2021-27064 high — 8.0 — privilege escalation in code arch
CVE-2021-21188 high — 8.0 — Use after free in Blink in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-42322 high — 8.0 — multiple issues in code arch
CVE-2021-4129 high — 8.0 — Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safety bugs present in Firefox 94. Some of t… debianrockylinux
CVE-2021-39931 high — 8.0 — multiple issues in gitlab arch
CVE-2021-37966 high — 8.0 — Inappropriate implementation in Compositing in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. archdebian
CVE-2021-29983 high — 8.0 — Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit. *Note: This issue only affected Firefox for Android. Other operatin… archdebian
CVE-2021-32765 high — 8.0 — Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted `RESP` `mult-bulk` proto… archdebian
CVE-2021-43535 high — 8.0 — A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firef… debianrockylinux
CVE-2021-30608 high — 8.0 — Chromium: CVE-2021-30608 Use after free in Web Share archdebian
CVE-2021-43534 high — 8.0 — Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of these bugs showed evidence of memory corruption and we presume that with enoug… debianrockylinux
CVE-2021-39901 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39875 high — 8.0 — multiple issues in gitlab arch
CVE-2021-30609 high — 8.0 — Chromium: CVE-2021-30609 Use after free in Sign-In archdebian
CVE-2021-39917 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39911 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21233 high — 8.0 — Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-39912 high — 8.0 — multiple issues in gitlab arch
CVE-2021-3405 high — 8.0 — A flaw was found in libebml before 1.4.2. A heap overflow bug exists in the implementation of EbmlString::ReadData and EbmlUnicodeString::ReadData in libebml. archdebian
CVE-2021-21179 high — 8.0 — Use after free in Network Internals in Google Chrome on Linux prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-39915 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39906 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39945 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39941 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21230 high — 8.0 — Type confusion in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-39905 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39895 high — 8.0 — multiple issues in gitlab arch
CVE-2021-38385 high — 8.0 — Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-00… archdebian
CVE-2021-39907 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39902 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39903 high — 8.0 — multiple issues in gitlab arch
CVE-2021-38371 high — 8.0 — The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending. archdebian
CVE-2021-39933 high — 8.0 — multiple issues in gitlab arch
CVE-2021-30618 high — 8.0 — Chromium: CVE-2021-30618 Inappropriate implementation in DevTools archdebian
CVE-2021-30508 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-36377 high — 8.0 — Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation. archdebian
CVE-2021-29982 high — 8.0 — Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a single bit of memory. This vulnerability affects Firefox < 91 an… archdebian
CVE-2021-21228 high — 8.0 — Insufficient policy enforcement in extensions in Google Chrome prior to 90.0.4430.93 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a … archdebian
CVE-2021-30521 high — 8.0 — Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. archdebian
CVE-2021-39934 high — 8.0 — multiple issues in gitlab arch
CVE-2021-38010 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-39886 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39887 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39879 high — 8.0 — multiple issues in gitlab arch
CVE-2021-37960 high — 8.0 — multiple issues in chromium arch
CVE-2021-38500 high — 8.0 — Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these… archdebianrockylinux
CVE-2021-29987 high — 8.0 — After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still record a click in the default location,… archdebian
CVE-2021-29967 high — 8.0 — Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of thes… archdebianrockylinux
CVE-2021-37983 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-39883 high — 8.0 — multiple issues in gitlab arch
CVE-2021-26434 high — 8.0 — multiple issues in code arch
CVE-2021-32777 high — 8.0 — multiple issues in istio arch
CVE-2021-21170 high — 8.0 — Incorrect security UI in Loader in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted … archdebian
CVE-2021-21208 high — 8.0 — Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing via a crafted QR code. archdebian