VIR Vulnerability Intelligence Relay

CVEs from 2021

5,048 normalized CVEs published or assigned in this year.

Total
5,048
critical
critical 273
high
high 975
medium
medium 1,141
low
low 135
% Critical
5.4%
% with KEV
4.2%
% with exploit
4.2%

Top vendors

Top products

  • office 13
  • 365_apps 6
  • office_long_term_servicing_channel 6
  • library_automation_system 5
  • single_connect 4
  • http_server 3
  • solidfire 2
  • student_information_management_system 2

Top packages

Severitycriticalhighmediumlowunknown
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2021-32679 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-32657 high — 8.0 — multiple issues in nextcloud arch
CVE-2021-22209 high — 8.0 — multiple issues in gitlab arch
CVE-2021-22210 high — 8.0 — multiple issues in gitlab arch
CVE-2021-22171 high — 8.0 — multiple issues in gitlab arch
CVE-2021-22168 high — 8.0 — multiple issues in gitlab arch
CVE-2021-1051 high — 8.0 — multiple issues in nvidia-utils arch
CVE-2021-20247 high — 8.0 — A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailb… archdebian
CVE-2021-3551 high — 8.0 — Important: pki-core:10.6 security update debianrockylinux
CVE-2021-25215 high — 8.0 — Important: bind security update debianarchsuserockylinux
CVE-2021-1053 high — 8.0 — multiple issues in nvidia-utils archsusedebian
CVE-2021-1056 high — 8.0 — multiple issues in nvidia-utils archsusedebian
CVE-2021-1052 high — 8.0 — multiple issues in nvidia-utils archsusedebian
CVE-2021-38300 high — 8.0 — arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when transforming unprivileged cBPF programs, allowing execution of arbitrary code within the kernel co… archdebian
CVE-2021-4093 high — 8.0 — A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host ker… rockylinuxdebian
CVE-2021-41611 high — 8.0 — An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem all… archdebian
CVE-2021-42327 high — 8.0 — dp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel through 5.14.14 allows a heap-based buffer overflow by an attacker who can write a string to th… archsusedebian
CVE-2021-3405 high — 8.0 — A flaw was found in libebml before 1.4.2. A heap overflow bug exists in the implementation of EbmlString::ReadData and EbmlUnicodeString::ReadData in libebml. archdebian
CVE-2021-44879 high — 8.0 — In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference. archsusedebian
CVE-2021-20305 high — 8.0 — A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply fun… archsuserockylinuxdebian
CVE-2021-21170 high — 8.0 — Incorrect security UI in Loader in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted … archdebian
CVE-2021-29477 high — 8.0 — Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using t… suserockylinuxdebian
CVE-2021-28375 high — 8.0 — An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, aka CID-20c40794eb85… archsusedebian
CVE-2021-28660 high — 8.0 — rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the ->ssid[] array. NOTE: from the perspective of kernel.org rele… archsusedebian
CVE-2021-29265 high — 8.0 — An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up sequence has race… archsusedebian
CVE-2021-29967 high — 8.0 — Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of thes… archdebianrockylinux
CVE-2021-29982 high — 8.0 — Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a single bit of memory. This vulnerability affects Firefox < 91 an… archdebian
CVE-2021-2264 high — 8.0 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows low pr… archdebian
CVE-2021-30531 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-29987 high — 8.0 — After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still record a click in the default location,… archdebian
CVE-2021-38496 high — 8.0 — During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbir… archdebianrockylinux
CVE-2021-38500 high — 8.0 — Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these… archdebianrockylinux
CVE-2021-4129 high — 8.0 — Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safety bugs present in Firefox 94. Some of t… debianrockylinux
CVE-2021-43534 high — 8.0 — Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of these bugs showed evidence of memory corruption and we presume that with enoug… debianrockylinux
CVE-2021-43535 high — 8.0 — A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firef… debianrockylinux
CVE-2021-37983 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-41259 high — 8.0 — multiple issues in nim arch
CVE-2021-36377 high — 8.0 — Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation. archdebian
CVE-2021-30581 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-32749 high — 8.0 — fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 through 0.11.2, there is a vulnerability that leads to poss… archdebian
CVE-2021-30615 high — 8.0 — Chromium: CVE-2021-30615 Cross-origin data leak in Navigation archdebian
CVE-2021-39904 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39882 high — 8.0 — multiple issues in gitlab arch
CVE-2021-22166 high — 8.0 — multiple issues in gitlab arch
CVE-2021-22167 high — 8.0 — multiple issues in gitlab arch
CVE-2021-37977 high — 8.0 — Use after free in Garbage Collection in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-30598 high — 8.0 — Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. archdebian
CVE-2021-30599 high — 8.0 — Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. archdebian
CVE-2021-30602 high — 8.0 — Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to visit a malicious website to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-30600 high — 8.0 — Use after free in Printing in Google Chrome prior to 92.0.4515.159 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-30601 high — 8.0 — Use after free in Extensions API in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted… archdebian
CVE-2021-30604 high — 8.0 — Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-30603 high — 8.0 — Data race in WebAudio in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-30607 high — 8.0 — Chromium: CVE-2021-30607 Use after free in Permissions archdebian
CVE-2021-30606 high — 8.0 — Chromium: CVE-2021-30606 Use after free in Blink archdebian
CVE-2021-30613 high — 8.0 — Chromium: CVE-2021-30613 Use after free in Base internals archdebian
CVE-2021-30612 high — 8.0 — Chromium: CVE-2021-30612 Use after free in WebRTC archdebian
CVE-2021-30614 high — 8.0 — Chromium: CVE-2021-30614 Heap buffer overflow in TabStrip archdebian
CVE-2021-30616 high — 8.0 — Chromium: CVE-2021-30616 Use after free in Media archdebian
CVE-2021-30617 high — 8.0 — Chromium: CVE-2021-30617 Policy bypass in Blink archdebian
CVE-2021-30619 high — 8.0 — Chromium: CVE-2021-30619 UI Spoofing in Autofill archdebian
CVE-2021-30620 high — 8.0 — Chromium: CVE-2021-30620 Insufficient policy enforcement in Blink archdebian
CVE-2021-30622 high — 8.0 — Chromium: CVE-2021-30622 Use after free in WebApp Installs archdebian
CVE-2021-30623 high — 8.0 — Chromium: CVE-2021-30623 Use after free in Bookmarks archdebian
CVE-2021-30624 high — 8.0 — Chromium: CVE-2021-30624 Use after free in Autofill archdebian
CVE-2021-39881 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39868 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39877 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39870 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39889 high — 8.0 — multiple issues in gitlab arch
CVE-2021-30628 high — 8.0 — arbitrary code execution in chromium archdebian
CVE-2021-30629 high — 8.0 — arbitrary code execution in chromium archdebian
CVE-2021-37957 high — 8.0 — Use after free in WebGPU in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-37956 high — 8.0 — Use after free in Offline use in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted… archdebian
CVE-2021-37958 high — 8.0 — Inappropriate implementation in Navigation in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to inject scripts or HTML into a privileged page via a crafted HTML page. archdebian
CVE-2021-37959 high — 8.0 — Use after free in Task Manager in Google Chrome prior to 94.0.4606.54 allowed an attacker who convinced a user to enage in a series of user gestures to potentially exploit heap corruption via a craft… archdebian
CVE-2021-37961 high — 8.0 — Use after free in Tab Strip in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-21213 high — 8.0 — Use after free in WebMIDI in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-21217 high — 8.0 — Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file. archdebian
CVE-2021-1055 high — 8.0 — multiple issues in nvidia-utils arch
CVE-2021-39884 high — 8.0 — multiple issues in gitlab arch
CVE-2021-21227 high — 8.0 — Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-21229 high — 8.0 — Incorrect security UI in downloads in Google Chrome on Android prior to 90.0.4430.93 allowed a remote attacker to perform domain spoofing via a crafted HTML page. archdebian
CVE-2021-21228 high — 8.0 — Insufficient policy enforcement in extensions in Google Chrome prior to 90.0.4430.93 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a … archdebian
CVE-2021-32765 high — 8.0 — Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted `RESP` `mult-bulk` proto… archdebian
CVE-2021-21230 high — 8.0 — Type confusion in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-21233 high — 8.0 — Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-21232 high — 8.0 — Use after free in Dev Tools in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2021-30521 high — 8.0 — Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. archdebian
CVE-2021-30508 high — 8.0 — multiple issues in chromium archdebian
CVE-2021-37968 high — 8.0 — Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted HTML page. archdebian
CVE-2021-37980 high — 8.0 — Inappropriate implementation in Sandbox in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially bypass site isolation via Windows. archdebian
CVE-2021-39912 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39913 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39934 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39936 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39933 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39932 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39931 high — 8.0 — multiple issues in gitlab arch
CVE-2021-39917 high — 8.0 — multiple issues in gitlab arch