VIR Vulnerability Intelligence Relay

CVEs from 2021

5,048 normalized CVEs published or assigned in this year.

Total
5,048
critical
critical 273
high
high 975
medium
medium 1,141
low
low 135
% Critical
5.4%
% with KEV
4.2%
% with exploit
4.2%

Top vendors

Top products

  • office 13
  • 365_apps 6
  • office_long_term_servicing_channel 6
  • library_automation_system 5
  • single_connect 4
  • http_server 3
  • solidfire 2
  • student_information_management_system 2

Top packages

Severitycriticalhighmediumlowunknown
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2021-39874 high — 8.0 — multiple issues in gitlab arch
CVE-2021-32777 high — 8.0 — multiple issues in istio arch
CVE-2021-30590 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38008 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-32678 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-22227 high — 8.0 — multiple issues in gitlab arch
CVE-2021-30529 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21174 high — 8.0 — Inappropriate implementation in Referrer in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. archdebian
CVE-2021-30591 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-29477 high — 8.0 — Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using t… suserockylinuxdebian
CVE-2021-21173 high — 8.0 — Side-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. archdebian
CVE-2021-30592 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38013 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-39903 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21172 high — 8.0 — Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89.0.4389.72 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. archdebian
CVE-2021-37959 high — 8.0 — Use after free in Task Manager in Google Chrome prior to 94.0.4606.54 allowed an attacker who convinced a user to enage in a series of user gestures to potentially exploit heap corruption via a craft… archdebian
CVE-2021-21205 high — 8.0 — Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. archdebian
CVE-2021-39897 high — 8.0 — multiple issues in gitlab arch
CVE-2021-30597 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21201 high — 8.0 — Use after free in permissions in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. archdebian
CVE-2021-21185 high — 8.0 — Insufficient policy enforcement in extensions in Google Chrome prior to 89.0.4389.72 allowed an attacker who convinced a user to install a malicious extension to obtain sensitive information via a cr… archdebian
CVE-2021-37958 high — 8.0 — Inappropriate implementation in Navigation in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to inject scripts or HTML into a privileged page via a crafted HTML page. archdebian
CVE-2021-30585 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-4056 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21187 high — 8.0 — Insufficient data validation in URL formatting in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. archdebian
CVE-2021-39917 high — 8.0 — multiple issues in gitlab arch
CVE-2021-29462 high — 8.0 — The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp (libupnp) appears to be vulnerable to DNS rebinding attacks because… archdebian
CVE-2021-39884 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21229 high — 8.0 — Incorrect security UI in downloads in Google Chrome on Android prior to 90.0.4430.93 allowed a remote attacker to perform domain spoofing via a crafted HTML page. archdebian
CVE-2021-30604 high — 8.0 — Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-21171 high — 8.0 — Incorrect security UI in TabStrip and Navigation in Google Chrome on Android prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. archdebian
CVE-2021-21189 high — 8.0 — Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. archdebian
CVE-2021-21231 high — 8.0 — Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-37956 high — 8.0 — Use after free in Offline use in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted… archdebian
CVE-2021-28375 high — 8.0 — An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, aka CID-20c40794eb85… archsusedebian
CVE-2021-28660 high — 8.0 — rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the ->ssid[] array. NOTE: from the perspective of kernel.org rele… archsusedebian
CVE-2021-29963 high — 8.0 — Address bar search suggestions in private browsing mode were re-using session data from normal mode. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnera… archdebian
CVE-2021-30579 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-30596 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-29265 high — 8.0 — An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up sequence has race… archsusedebian
CVE-2021-21214 high — 8.0 — Use after free in Network API in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. archdebian
CVE-2021-4055 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21215 high — 8.0 — Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a crafted HTML page. archdebian
CVE-2021-30573 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38022 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-39913 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21230 high — 8.0 — Type confusion in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-22224 high — 8.0 — multiple issues in gitlab arch
CVE-2021-26910 high — 8.0 — Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation. archdebian
CVE-2021-4053 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21170 high — 8.0 — Incorrect security UI in Loader in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted … archdebian
CVE-2021-30572 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21199 high — 8.0 — Use after free in Aura in Google Chrome on Linux prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML pa… archdebian
CVE-2021-39931 high — 8.0 — multiple issues in gitlab arch
CVE-2021-30626 high — 8.0 — arbitrary code execution in chromium archdebian
CVE-2021-29967 high — 8.0 — Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of thes… archdebianrockylinux
CVE-2021-21168 high — 8.0 — Insufficient policy enforcement in appcache in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. archdebian
CVE-2021-38019 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-32765 high — 8.0 — Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted `RESP` `mult-bulk` proto… archdebian
CVE-2021-30559 high — 8.0 — arbitrary code execution in chromium archdebian
CVE-2021-22228 high — 8.0 — multiple issues in gitlab arch
CVE-2021-2264 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows low pr… archdebian
CVE-2021-21233 high — 8.0 — Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-29987 high — 8.0 — After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still record a click in the default location,… archdebian
CVE-2021-21164 high — 8.0 — Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. archdebian
CVE-2021-38496 high — 8.0 — During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbir… archdebianrockylinux
CVE-2021-30528 high — 8.0 — Use after free in WebAuthentication in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker who had compromised the renderer process of a user who had saved a credit card in their… archdebian
CVE-2021-38500 high — 8.0 — Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these… archdebianrockylinux
CVE-2021-4129 high — 8.0 — Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safety bugs present in Firefox 94. Some of t… debianrockylinux
CVE-2021-43534 high — 8.0 — Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of these bugs showed evidence of memory corruption and we presume that with enoug… debianrockylinux
CVE-2021-43535 high — 8.0 — A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firef… debianrockylinux
CVE-2021-37983 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-41259 high — 8.0 — multiple issues in nim arch
CVE-2021-37979 high — 8.0 — heap buffer overflow in WebRTC in Google Chrome prior to 94.0.4606.81 allowed a remote attacker who convinced a user to browse to a malicious website to potentially exploit heap corruption via a craf… archdebian
CVE-2021-30564 high — 8.0 — arbitrary code execution in chromium archdebian
CVE-2021-30542 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-30574 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-36377 high — 8.0 — Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation. archdebian
CVE-2021-4061 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-2442 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.24. Easily exploitable vulnerability allows high p… archdebian
CVE-2021-39933 high — 8.0 — multiple issues in gitlab arch
CVE-2021-32749 high — 8.0 — fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 through 0.11.2, there is a vulnerability that leads to poss… archdebian
CVE-2021-30615 high — 8.0 — Chromium: CVE-2021-30615 Cross-origin data leak in Navigation archdebian
CVE-2021-39904 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21165 high — 8.0 — Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-39882 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39932 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21162 high — 8.0 — Use after free in WebRTC in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-20305 high — 8.0 — A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply fun… archsuserockylinuxdebian
CVE-2021-30578 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-39879 high — 8.0 — multiple issues in gitlab arch
CVE-2021-4058 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-22166 high — 8.0 — multiple issues in gitlab arch
CVE-2021-22167 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21212 high — 8.0 — Incorrect security UI in Network Config UI in Google Chrome on ChromeOS prior to 90.0.4430.72 allowed a remote attacker to potentially compromise WiFi connection security via a malicious WAP. archdebian
CVE-2021-30598 high — 8.0 — Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. archdebian
CVE-2021-30599 high — 8.0 — Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. archdebian
CVE-2021-30602 high — 8.0 — Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to visit a malicious website to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-30600 high — 8.0 — Use after free in Printing in Google Chrome prior to 92.0.4515.159 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-39886 high — 8.0 — multiple issues in gitlab arch