Vulnerabilities published in 2021
27,247 vulnerabilities were published in 2021: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 154 of 273.
- CVE-2021-32817 File disclosure in express-hbs
- CVE-2021-32816 Regular expression Denial of Service in ProtonMail
- CVE-2021-32815 Denial of service due to assertion failure in crwimage_int.cpp
- CVE-2021-32814 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Skytable
- CVE-2021-32813 Drop Headers via Malicious Connection Header
- CVE-2021-32812 Cross-site scripting in monkshu
- CVE-2021-32811 Remote Code Execution via Script (Python) objects under Python 3
- CVE-2021-32810 Data race in crossbeam-deque
- CVE-2021-3281 Django Directory Traversal via archive.extract
- CVE-2021-32809 Arbitrary HTML injection vulnerability in ckeditor
- CVE-2021-32808 Cross-site scripting in ckeditor via abuse of undo functionality
- CVE-2021-32807 Remote Code Execution via unsafe classes in otherwise permitted modules
- CVE-2021-32806 URL Redirection to Untrusted Site ('Open Redirect') in Products.isurlinportal
- CVE-2021-32805 URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder
- CVE-2021-32804 Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization
- CVE-2021-32803 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
- CVE-2021-32802 Preview generation used third-party library not suited for user-generated content in Nextcloud server
- CVE-2021-32801 Exceptions may have logged Encryption-at-Rest key content in Nextcloud server
- CVE-2021-32800 Bypass of Two Factor Authentication in Nextcloud server
- CVE-2021-32798 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebook
- CVE-2021-32797 JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>
- CVE-2021-32796 Misinterpretation of malicious XML input in xmldom
- CVE-2021-32795 Denial of Service via Steam chat in ArchiSteamFarm
- CVE-2021-32794 Accidental removal of IPCPassword (< 5.1.2.4)
- CVE-2021-32793 Stored XSS Vulnerability in the Pi-hole Webinterface
- CVE-2021-32792 XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc
- CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc
- CVE-2021-32790 Blind SQL Injection possible via Authenticated Web-hook Search API Endpoint
- CVE-2021-3279 Cross-site scripting in fortics:szchat
- CVE-2021-32789 Arbitrary SQL (SQL injection) possible via the Store API component.
- CVE-2021-32788 Post creator of a whisper post can be revealed to non-staff users in Discourse
- CVE-2021-32787 Low risk information disclosure in Sourcegraph
- CVE-2021-32786 Open Redirect in oidc_validate_redirect_url()
- CVE-2021-32785 Format string bug in the Redis cache implementation
- CVE-2021-32783 Authorization bypass in Contour
- CVE-2021-32782 Cross-Site Scripting in Nextcloud Circles
- CVE-2021-32781 Continued processing of requests after locally generated response
- CVE-2021-32780 Incorrect handling of H/2 GOAWAY followed by SETTINGS frames
- CVE-2021-3278 SQL injection in local services search engine management system project:local services search engine management system
- CVE-2021-32779 Incorrectly handling of URI '#fragment' element as part of the path element
- CVE-2021-32778 Excessive CPU utilization when closing HTTP/2 streams
- CVE-2021-32777 Incorrect concatenation of multiple value request headers in ext-authz extension
- CVE-2021-32776 No CSRF form token cleanup on Windows servers
- CVE-2021-32775 Any user can see any fields (including mailbox password) with GroupBy Dashlet
- CVE-2021-32774 Cross-Site Request Forgery (CSRF) in DataDump
- CVE-2021-32773 Confused deputy attack in sandbox module resolution
- CVE-2021-32772 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in helper_entries
- CVE-2021-32771 Buffer overflow in contiki-ng
- CVE-2021-32770 Basic-auth app bundle credential exposure in gatsby-source-wordpress
- CVE-2021-3277 File upload in nagios:nagios xi
- CVE-2021-32769 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-core
- CVE-2021-32768 Cross-Site Scripting via Rich-Text Content
- CVE-2021-32767 Information Disclosure in User Authentication
- CVE-2021-32766 Nextcloud Text app can disclose existence of folders in "File Drop" link share
- CVE-2021-32765 Integer Overflow to Buffer Overflow in Hiredis
- CVE-2021-32764 YouTube Onebox susceptible to XSS
- CVE-2021-32763 Regular Expression Denial of Service in OpenProject forum messages
- CVE-2021-32762 Integer overflow that can lead to heap overflow in redis-cli, redis-sentinel on some platforms
- CVE-2021-32761 Integer overflow issues with *BIT commands on 32-bit systems
- CVE-2021-32760 Archive package allows chmod of file outside of unpack target directory
- CVE-2021-32759 Data Flow Sanitation Issue Fix
- CVE-2021-32758 Layout XML Arbitrary Code Fix
- CVE-2021-32756 Arbitrary eval through MiqExpression
- CVE-2021-32755 Certificate pinning is not enforced on the web socket connection
- CVE-2021-32754 Improper Restriction of XML External Entity Reference in de.tud.sse
- CVE-2021-32753 Hardcoded credentials in edgex-go
- CVE-2021-32752 Files or Directories Accessible to External Parties in ether/logs
- CVE-2021-32751 Arbitrary code execution via specially crafted environment variables
- CVE-2021-32750 De-anonymization via message
- CVE-2021-3275 Cross-site scripting in tp-link:archer-c3150 firmware
- CVE-2021-32749 Possible RCE vulnerability in mailing action using mailutils (mail-whois)
- CVE-2021-32748 WOPI API not protected by credentials/IP check
- CVE-2021-32747 Custom variable protection and blacklists can be circumvented
- CVE-2021-32746 Possible path traversal by use of the `doc` module
- CVE-2021-32745 Reflected Cross-Site-Scripting vulnerability
- CVE-2021-32744 Unauthenticated attacker could gain access to currently open files
- CVE-2021-32743 Passwords used to access external services inadvertently exposed through API
- CVE-2021-32742 Untrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crash
- CVE-2021-32741 Lack of ratelimit on public share link mount endpoint
- CVE-2021-32740 Regular Expression Denial of Service in Addressable templates
- CVE-2021-32739 Privilege escalation in icinga2
- CVE-2021-32738 Utils.readChallengeTx does not verify the server account signature
- CVE-2021-32737 XSS Injection in Media Collection Title was possible
- CVE-2021-32736 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in think-helper
- CVE-2021-32735 Cross-site scripting (XSS) from field and configuration text displayed in the Panel
- CVE-2021-32734 File path disclosure of shared files in Nextcloud Text application
- CVE-2021-32733 XSS in Nextcloud Text application
- CVE-2021-32732 Cross-Site Request Forgery in xwiki-platform
- CVE-2021-32731 The reset password form reveal users email address
- CVE-2021-32730 No CSRF protection on the password change form
- CVE-2021-3273 Code injection in nagios:nagios xi
- CVE-2021-32729 A user without PR can reset user authentication failures information
- CVE-2021-32728 End-to-end encryption device setup did not verify public key
- CVE-2021-32727 End-to-end encryption device setup did not verify public key
- CVE-2021-32726 Webauthn tokens not removed after user has been deleted
- CVE-2021-32725 Default share permissions not respected for federated reshares
- CVE-2021-32724 check-spelling workflow vulnerable to GITHUB_TOKEN leakage via symlink attack
- CVE-2021-32723 Regular Expression Denial of Service (ReDoS) in Prism
- CVE-2021-32722 Uncontrolled Resource Consumption in GlobalNewFiles
- CVE-2021-32721 URL Redirection to Untrusted Site ('Open Redirect') in github.com/AndrewBurian/powermux