VIR Vulnerability Intelligence Relay

CVEs from 2021

5,048 normalized CVEs published or assigned in this year.

Total
5,048
critical
critical 273
high
high 975
medium
medium 1,141
low
low 135
% Critical
5.4%
% with KEV
4.2%
% with exploit
4.2%

Top vendors

Top products

  • office 13
  • 365_apps 6
  • office_long_term_servicing_channel 6
  • library_automation_system 5
  • single_connect 4
  • http_server 3
  • solidfire 2
  • student_information_management_system 2

Top packages

Severitycriticalhighmediumlowunknown
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2021-32680 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-32725 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-39917 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21202 high — 8.0 — Use after free in extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chr… archdebian
CVE-2021-32781 high — 8.0 — multiple issues in istio arch
CVE-2021-21109 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-29972 high — 8.0 — A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library. Updating the library resolved the issue, and may have remediated other, unknown security vulnerabilit… archsusedebian
CVE-2021-21107 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38017 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-29969 high — 8.0 — If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore … archsuserockylinuxdebian
CVE-2021-21188 high — 8.0 — Use after free in Blink in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-30508 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-22228 high — 8.0 — multiple issues in gitlab arch
CVE-2021-43540 high — 8.0 — WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been uninstalled with the extension. This vulnerability affects … archsusedebian
CVE-2021-36740 high — 8.0 — Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, a… suserockylinuxdebian
CVE-2021-38011 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-39885 high — 8.0 — multiple issues in gitlab arch
CVE-2021-38012 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-22206 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21210 high — 8.0 — Inappropriate implementation in Network in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially access local UDP ports via a crafted HTML page. archdebian
CVE-2021-21232 high — 8.0 — Use after free in Dev Tools in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-21205 high — 8.0 — Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. archdebian
CVE-2021-39933 high — 8.0 — multiple issues in gitlab arch
CVE-2021-4054 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38020 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-39888 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21111 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-25216 high — 8.0 — In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of t… debianarchsuse
CVE-2021-38013 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38008 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-22181 high — 8.0 — multiple issues in gitlab arch
CVE-2021-38494 high — 8.0 — Mozilla developers reported memory safety bugs present in Firefox 91. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been expl… archdebian
CVE-2021-4052 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21112 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-22219 high — 8.0 — multiple issues in gitlab arch
CVE-2021-22236 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39870 high — 8.0 — multiple issues in gitlab arch
CVE-2021-32653 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-30612 high — 8.0 — Chromium: CVE-2021-30612 Use after free in WebRTC archdebian
CVE-2021-21261 high — 8.0 — Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to exec… archsusedebian
CVE-2021-22239 high — 8.0 — multiple issues in gitlab arch
CVE-2021-4062 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-39936 high — 8.0 — multiple issues in gitlab arch
CVE-2021-22915 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-21189 high — 8.0 — Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. archdebian
CVE-2021-21110 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21114 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-22259 high — 8.0 — multiple issues in gitlab arch
CVE-2021-32778 high — 8.0 — multiple issues in istio arch
CVE-2021-22237 high — 8.0 — multiple issues in gitlab arch
CVE-2021-4058 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-38015 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-21190 high — 8.0 — Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file. archdebian
CVE-2021-21231 high — 8.0 — Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-38009 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-29477 high — 8.0 — Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using t… suserockylinuxdebian
CVE-2021-23985 high — 8.0 — If an attacker is able to alter specific about:config values (for example malware running on the user's computer), the Devtools remote debugging feature could have been enabled in a way that was unno… archsusedebian
CVE-2021-30616 high — 8.0 — Chromium: CVE-2021-30616 Use after free in Media archdebian
CVE-2021-30620 high — 8.0 — Chromium: CVE-2021-30620 Insufficient policy enforcement in Blink archdebian
CVE-2021-22220 high — 8.0 — multiple issues in gitlab arch
CVE-2021-22213 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21222 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-32654 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-22221 high — 8.0 — multiple issues in gitlab arch
CVE-2021-30631 high — 8.0 — arbitrary code execution in chromium arch
CVE-2021-39175 high — 8.0 — cross-site scripting in hedgedoc arch
CVE-2021-3998 high — 8.0 — A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sensitive data. archsusedebian
CVE-2021-21116 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-22168 high — 8.0 — multiple issues in gitlab arch
CVE-2021-22216 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21197 high — 8.0 — Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-22218 high — 8.0 — multiple issues in gitlab arch
CVE-2021-29429 high — 8.0 — In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable t… archsusedebian
CVE-2021-39874 high — 8.0 — multiple issues in gitlab arch
CVE-2021-30540 high — 8.0 — Incorrect security UI in payments in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform domain spoofing via a crafted HTML page. archdebian
CVE-2021-39866 high — 8.0 — multiple issues in gitlab arch
CVE-2021-30623 high — 8.0 — Chromium: CVE-2021-30623 Use after free in Bookmarks archdebian
CVE-2021-39883 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39932 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21115 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-37960 high — 8.0 — multiple issues in chromium arch
CVE-2021-21223 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-39900 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21195 high — 8.0 — Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-39890 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21207 high — 8.0 — Use after free in IndexedDB in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chro… archdebian
CVE-2021-39887 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21217 high — 8.0 — Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file. archdebian
CVE-2021-30614 high — 8.0 — Chromium: CVE-2021-30614 Heap buffer overflow in TabStrip archdebian
CVE-2021-32765 high — 8.0 — Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted `RESP` `mult-bulk` proto… archdebian
CVE-2021-39886 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39879 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39877 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21187 high — 8.0 — Insufficient data validation in URL formatting in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. archdebian
CVE-2021-26434 high — 8.0 — multiple issues in code arch
CVE-2021-38491 high — 8.0 — Mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded. This vulnerability affects Firefox < 92. archsusedebian
CVE-2021-22217 high — 8.0 — multiple issues in gitlab arch
CVE-2021-33582 high — 8.0 — Important: cyrus-imapd security update debiansuserockylinux
CVE-2021-21154 high — 8.0 — Heap buffer overflow in Tab Strip in Google Chrome prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML… archdebian
CVE-2021-29947 high — 8.0 — Mozilla developers and community members reported memory safety bugs present in Firefox 87. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of thes… archsusedebian