VIR Vulnerability Intelligence Relay

CVEs from 2021

5,048 normalized CVEs published or assigned in this year.

Total
5,048
critical
critical 273
high
high 975
medium
medium 1,141
low
low 135
% Critical
5.4%
% with KEV
4.2%
% with exploit
4.2%

Top vendors

Top products

  • office 13
  • 365_apps 6
  • office_long_term_servicing_channel 6
  • library_automation_system 5
  • single_connect 4
  • http_server 3
  • solidfire 2
  • student_information_management_system 2

Top packages

Severitycriticalhighmediumlowunknown
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2021-39878 high — 8.0 — multiple issues in gitlab arch
CVE-2021-2131 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high p… archdebian
CVE-2021-30622 high — 8.0 — Chromium: CVE-2021-30622 Use after free in WebApp Installs archdebian
CVE-2021-32921 high — 8.0 — An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This can potentially be used in a… archdebian
CVE-2021-32920 high — 8.0 — Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests. archdebian
CVE-2021-32919 high — 8.0 — An issue was discovered in Prosody before 0.11.9. The undocumented dialback_without_dialback option in mod_dialback enables an experimental feature for server-to-server authentication. It does not co… archdebian
CVE-2021-39890 high — 8.0 — multiple issues in gitlab arch
CVE-2021-2279 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows unau… archdebian
CVE-2021-32918 high — 8.0 — An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaustion when running under Lua 5.2 or Lua 5.… archdebian
CVE-2021-32917 high — 8.0 — An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use … archdebian
CVE-2021-30620 high — 8.0 — Chromium: CVE-2021-30620 Insufficient policy enforcement in Blink archdebian
CVE-2021-23964 high — 8.0 — Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these… archsusedebian
CVE-2021-37960 high — 8.0 — multiple issues in chromium arch
CVE-2021-23972 high — 8.0 — One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://www.phishingtarget.com@evil.com'. To mitigate this type of attack, Firefox will display a warning dialog; howe… archsusedebian
CVE-2021-30619 high — 8.0 — Chromium: CVE-2021-30619 UI Spoofing in Autofill archdebian
CVE-2021-30465 high — 8.0 — Important: container-tools:3.0 security update almalinuxarchsuserockylinux+2
CVE-2021-21182 high — 8.0 — Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafte… archdebian
CVE-2021-30617 high — 8.0 — Chromium: CVE-2021-30617 Policy bypass in Blink archdebian
CVE-2021-2145 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high… archdebian
CVE-2021-39879 high — 8.0 — multiple issues in gitlab arch
CVE-2021-38575 high — 8.0 — Important: edk2 security update archdebiansuserockylinux
CVE-2021-33910 high — 8.0 — basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker)… archsuserockylinuxdebian
CVE-2021-39886 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39887 high — 8.0 — multiple issues in gitlab arch
CVE-2021-30616 high — 8.0 — Chromium: CVE-2021-30616 Use after free in Media archdebian
CVE-2021-2310 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high… archdebian
CVE-2021-23996 high — 8.0 — By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing attack that could have been used for phishing or other att… archdebian
CVE-2021-30532 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-2442 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.24. Easily exploitable vulnerability allows high p… archdebian
CVE-2021-41387 high — 8.0 — seatd-launch in seatd 0.6.x before 0.6.2 allows privilege escalation because it uses execlp and may be installed setuid root. archdebian
CVE-2021-38500 high — 8.0 — Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these… archdebianrockylinux
CVE-2021-30534 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-30614 high — 8.0 — Chromium: CVE-2021-30614 Heap buffer overflow in TabStrip archdebian
CVE-2021-21209 high — 8.0 — Inappropriate implementation in storage in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. archdebian
CVE-2021-2284 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows unauth… archdebian
CVE-2021-39891 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39872 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21198 high — 8.0 — Out of bounds read in IPC in Google Chrome prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. archdebian
CVE-2021-30612 high — 8.0 — Chromium: CVE-2021-30612 Use after free in WebRTC archdebian
CVE-2021-39873 high — 8.0 — multiple issues in gitlab arch
CVE-2021-32654 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-21155 high — 8.0 — Heap buffer overflow in Tab Strip in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a c… archdebian
CVE-2021-2124 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high p… archdebian
CVE-2021-21152 high — 8.0 — Heap buffer overflow in Media in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-3446 high — 8.0 — A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV (initialization vector) when certain s… archsusedebian
CVE-2021-21151 high — 8.0 — Use after free in Payments in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. archdebian
CVE-2021-39875 high — 8.0 — multiple issues in gitlab arch
CVE-2021-2321 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows high p… archdebian
CVE-2021-38010 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-41524 high — 8.0 — multiple issues in apache debianarch
CVE-2021-30613 high — 8.0 — Chromium: CVE-2021-30613 Use after free in Base internals archdebian
CVE-2021-21159 high — 8.0 — Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-29977 high — 8.0 — Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been expl… archsusedebian
CVE-2021-21160 high — 8.0 — Heap buffer overflow in WebAudio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-39914 high — 8.0 — multiple issues in gitlab arch
CVE-2021-30606 high — 8.0 — Chromium: CVE-2021-30606 Use after free in Blink archdebian
CVE-2021-21161 high — 8.0 — Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-30535 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-39902 high — 8.0 — multiple issues in gitlab arch
CVE-2021-37983 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-29964 high — 8.0 — A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read. *This bug only affects Firefox on Windows. Other operat… archdebian
CVE-2021-38002 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-39903 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21211 high — 8.0 — Inappropriate implementation in Navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. archdebian
CVE-2021-21169 high — 8.0 — Out of bounds memory access in V8 in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. archdebian
CVE-2021-22237 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39907 high — 8.0 — multiple issues in gitlab arch
CVE-2021-37999 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-30607 high — 8.0 — Chromium: CVE-2021-30607 Use after free in Permissions archdebian
CVE-2021-21183 high — 8.0 — Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. archdebian
CVE-2021-39895 high — 8.0 — multiple issues in gitlab arch
CVE-2021-2128 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows low pr… archdebian
CVE-2021-39905 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21179 high — 8.0 — Use after free in Network Internals in Google Chrome on Linux prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-21178 high — 8.0 — Inappropriate implementation in Compositing in Google Chrome on Linux and Windows prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML pag… archdebian
CVE-2021-21180 high — 8.0 — Use after free in tab search in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-28473 high — 8.0 — arbitrary code execution in code arch
CVE-2021-21181 high — 8.0 — Side-channel information leakage in autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. archdebian
CVE-2021-37997 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-30603 high — 8.0 — Data race in WebAudio in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-21184 high — 8.0 — Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. archdebian
CVE-2021-22901 high — 8.0 — curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use… archdebian
CVE-2021-22223 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39898 high — 8.0 — multiple issues in gitlab arch
CVE-2021-2111 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high p… archdebian
CVE-2021-22225 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39909 high — 8.0 — multiple issues in gitlab arch
CVE-2021-32655 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-21197 high — 8.0 — Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-30604 high — 8.0 — Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-39897 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39906 high — 8.0 — multiple issues in gitlab arch
CVE-2021-30601 high — 8.0 — Use after free in Extensions API in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted… archdebian
CVE-2021-43540 high — 8.0 — WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been uninstalled with the extension. This vulnerability affects … archsusedebian
CVE-2021-30600 high — 8.0 — Use after free in Printing in Google Chrome prior to 92.0.4515.159 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-30602 high — 8.0 — Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to visit a malicious website to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-21188 high — 8.0 — Use after free in Blink in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-22231 high — 8.0 — multiple issues in gitlab arch
CVE-2021-22226 high — 8.0 — multiple issues in gitlab arch
CVE-2021-3570 high — 8.0 — A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or pote… suserockylinuxdebian