VIR Vulnerability Intelligence Relay

CVEs from 2021

6,087 normalized CVEs published or assigned in this year.

Total
6,087
critical
critical 273
high
high 975
medium
medium 1,141
low
low 135
% Critical
4.5%
% with KEV
3.5%
% with exploit
3.5%

Top vendors

Top products

  • office 13
  • 365_apps 6
  • office_long_term_servicing_channel 6
  • library_automation_system 5
  • single_connect 4
  • http_server 3
  • solidfire 2
  • student_information_management_system 2

Top packages

Severitycriticalhighmediumlowunknown
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2021-29948 high — 8.0 — Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user is replacing the file. This vulnerability affects… archsusedebian
CVE-2021-29946 high — 8.0 — Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header. This vulnerability affects Firefox … archsusedebian
CVE-2021-29986 high — 8.0 — A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash. *Note: This issue only affected Linux operating systems. Other operating systems are … archsusedebianrockylinux
CVE-2021-29989 high — 8.0 — Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of thes… archsusedebianrockylinux
CVE-2021-38505 high — 8.0 — Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it available on other computers in certain… archsusedebian
CVE-2021-25216 high — 8.0 — In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of t… debianarchsuse
CVE-2021-43396 high — 8.0 — In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an inter… archsusedebian
CVE-2021-36740 high — 8.0 — Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, a… suserockylinuxdebian
CVE-2021-39944 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39940 high — 8.0 — multiple issues in gitlab arch
CVE-2021-36952 high — 8.0 — multiple issues in code arch
CVE-2021-21158 high — 8.0 — insufficient validation in chromium arch
CVE-2021-23969 high — 8.0 — As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s no… archsusedebian
CVE-2021-32751 high — 8.0 — Gradle is a build tool with a focus on build automation. In versions prior to 7.2, start scripts generated by the `application` plugin and the `gradlew` script are both vulnerable to arbitrary code e… archsusedebian
CVE-2021-1053 high — 8.0 — NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape or IOCTL in which improper validation of a us… archsusedebian
CVE-2021-28660 high — 8.0 — rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the ->ssid[] array. NOTE: from the perspective of kernel.org rele… archsusedebian
CVE-2021-44879 high — 8.0 — In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference. archsusedebian
CVE-2021-25217 high — 8.0 — Important: dhcp security update archsusedebianrockylinux
CVE-2021-27803 high — 8.0 — A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in denial of service or other impact (poten… archsusedebian
CVE-2021-23960 high — 8.0 — Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, an… archsusedebian
CVE-2021-23998 high — 8.0 — Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Fir… archsusedebian
CVE-2021-30542 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38021 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-4065 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-4068 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-4067 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-4062 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-4066 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-4057 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-4052 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38017 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-4063 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-4058 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-4061 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38022 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38013 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38008 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-4056 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-4054 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-4055 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-4053 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38019 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38020 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38018 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38014 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38012 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38011 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38016 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38009 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38015 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21226 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21225 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21223 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21111 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21222 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21192 high — 8.0 — arbitrary code execution in chromium archdebian
CVE-2021-21116 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21191 high — 8.0 — arbitrary code execution in chromium archdebian
CVE-2021-21115 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21114 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21106 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21113 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21112 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21110 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21109 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21108 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21107 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-26925 high — 8.0 — Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering. archdebian
CVE-2021-21168 high — 8.0 — Insufficient policy enforcement in appcache in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. archdebian
CVE-2021-21172 high — 8.0 — Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89.0.4389.72 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. archdebian
CVE-2021-21201 high — 8.0 — Use after free in permissions in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. archdebian
CVE-2021-41611 high — 8.0 — An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem all… archdebian
CVE-2021-3405 high — 8.0 — A flaw was found in libebml before 1.4.2. A heap overflow bug exists in the implementation of EbmlString::ReadData and EbmlUnicodeString::ReadData in libebml. archdebian
CVE-2021-4093 high — 8.0 — A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host ker… rockylinuxdebian
CVE-2021-39882 high — 8.0 — multiple issues in gitlab arch
CVE-2021-22166 high — 8.0 — multiple issues in gitlab arch
CVE-2021-37977 high — 8.0 — Use after free in Garbage Collection in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-30598 high — 8.0 — Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. archdebian
CVE-2021-30604 high — 8.0 — Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-30603 high — 8.0 — Data race in WebAudio in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-30607 high — 8.0 — Chromium: CVE-2021-30607 Use after free in Permissions archdebian
CVE-2021-30613 high — 8.0 — Chromium: CVE-2021-30613 Use after free in Base internals archdebian
CVE-2021-30612 high — 8.0 — Chromium: CVE-2021-30612 Use after free in WebRTC archdebian
CVE-2021-30614 high — 8.0 — Chromium: CVE-2021-30614 Heap buffer overflow in TabStrip archdebian
CVE-2021-30617 high — 8.0 — Chromium: CVE-2021-30617 Policy bypass in Blink archdebian
CVE-2021-30619 high — 8.0 — Chromium: CVE-2021-30619 UI Spoofing in Autofill archdebian
CVE-2021-30620 high — 8.0 — Chromium: CVE-2021-30620 Insufficient policy enforcement in Blink archdebian
CVE-2021-30622 high — 8.0 — Chromium: CVE-2021-30622 Use after free in WebApp Installs archdebian
CVE-2021-30623 high — 8.0 — Chromium: CVE-2021-30623 Use after free in Bookmarks archdebian
CVE-2021-30624 high — 8.0 — Chromium: CVE-2021-30624 Use after free in Autofill archdebian
CVE-2021-39881 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39868 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39877 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39870 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39889 high — 8.0 — multiple issues in gitlab arch
CVE-2021-30628 high — 8.0 — arbitrary code execution in chromium archdebian
CVE-2021-37957 high — 8.0 — Use after free in WebGPU in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-37958 high — 8.0 — Inappropriate implementation in Navigation in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to inject scripts or HTML into a privileged page via a crafted HTML page. archdebian
CVE-2021-37959 high — 8.0 — Use after free in Task Manager in Google Chrome prior to 94.0.4606.54 allowed an attacker who convinced a user to enage in a series of user gestures to potentially exploit heap corruption via a craft… archdebian
CVE-2021-21217 high — 8.0 — Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file. archdebian