Vulnerabilities published in 2021
27,247 vulnerabilities were published in 2021: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 155 of 273.
- CVE-2021-32720 List of order ids, number, items total and token value exposed for unauthorized uses via new API
- CVE-2021-3272 Memory corruption in fedoraproject:fedora
- CVE-2021-32719 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ federation management plugin
- CVE-2021-32718 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UI
- CVE-2021-32717 Private files publicly accessible with Cloud Storage providers
- CVE-2021-32716 Internal hidden fields are visible on to many associations in admin api
- CVE-2021-32715 Lenient Parsing of Content-Length Header When Prefixed with Plus Sign
- CVE-2021-32714 Integer Overflow in Chunked Transfer-Encoding
- CVE-2021-32713 Authenticated Stored XSS
- CVE-2021-32712 Information leakage in Error Handler
- CVE-2021-32711 Leak of information via Store-API
- CVE-2021-32710 Potential Session Hijacking in Shopware
- CVE-2021-3271 Stored cross-site scripting in PressBooks
- CVE-2021-32709 Creation of order credits was not validated by acl in admin orders
- CVE-2021-32708 Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem
- CVE-2021-32707 Bypass of image blocking in Nextcloud Mail
- CVE-2021-32706 (Authenticated) Remote Code Execution Possible in Web Interface 5.5
- CVE-2021-32705 Lack of ratelimit on public DAV endpoint
- CVE-2021-32704 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-core
- CVE-2021-32703 Lack of ratelimit on shareinfo endpoint
- CVE-2021-32702 Reflected XSS from the callback handler's error query parameter
- CVE-2021-32701 Possible bypass of token claim validation when OAuth2 Introspection caching is enabled
- CVE-2021-32700 Supply chain attack via MiTM against users
- CVE-2021-32699 Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings
- CVE-2021-32698 Blind Server-Side Request Forgery (SSRF) in eLabFTW
- CVE-2021-32697 Form validation can be skipped
- CVE-2021-32696 Passing in a non-string 'html' argument can lead to unsanitized output
- CVE-2021-32695 Malicious Android app could access Shared Preferences of the Nextcloud Android client
- CVE-2021-32694 Malicious Android application can crash the Nextcloud Android Client
- CVE-2021-32693 Authentication granted with multiple firewalls
- CVE-2021-32692 Activity Watch vulnerable to command execution on macOS via printAppTitle.scpt
- CVE-2021-32691 Auto-merging Person Records Compromised
- CVE-2021-32690 Repository credentials passed to alternate domain
- CVE-2021-32689 Nextcloud Talk not properly disassociating users from chats after account deletion
- CVE-2021-32688 Application specific tokens can change their own scope
- CVE-2021-32687 Integer overflow issue with intsets in Redis
- CVE-2021-32686 Denial of Service in PJSIP
- CVE-2021-32685 Improper Verification of Cryptographic Signature in tenvoy
- CVE-2021-32684 Missing Handler in @scandipwa/magento-scripts
- CVE-2021-32683 XSS through createObjectURL
- CVE-2021-32682 Multiple vulnerabilities leading to RCE
- CVE-2021-32681 Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks
- CVE-2021-32680 Audit log is not properly logging unsetting of share expiration date
- CVE-2021-32679 Filenames not escaped by default in controllers using DownloadResponse
- CVE-2021-32678 Ratelimit not applied on OCS API responses
- CVE-2021-32677 Cross-Site Request Forgery (CSRF) in FastAPI
- CVE-2021-32676 Session Fixation in Nextcloud Talk
- CVE-2021-32675 DoS vulnerability in Redis
- CVE-2021-32674 Remote Code Execution via traversal in TAL expressions
- CVE-2021-32673 Remote Command Execution in reg-keygen-git-hash-plugin
- CVE-2021-32672 Vulnerability in Lua Debugger in Redis
- CVE-2021-32671 XSS vulnerability with translator
- CVE-2021-32670 Reflected cross-site scripting issue in Datasette
- CVE-2021-3267 File upload in kitesky:kitecms
- CVE-2021-32669 Cross-Site Scripting in Backend Grid View
- CVE-2021-32668 Cross-Site Scripting in Query Generator & Query View
- CVE-2021-32667 Cross-Site Scripting in Page Preview
- CVE-2021-32666 Asset DoS vulnerability
- CVE-2021-32665 Verified groups not reliable
- CVE-2021-32664 Reflected XSS in Combodo/iTop
- CVE-2021-32663 Unauthorized setup leads to SSRF in Combodo/iTop
- CVE-2021-32662 TechDocs mkdocs.yml path traversal
- CVE-2021-32661 TechDocs object element script injection
- CVE-2021-32660 TechDocs content sanitization bypass
- CVE-2021-32659 Automatic room upgrade handling can be used maliciously to bridge a room non-consentually
- CVE-2021-32658 Sensitive data may not be removed from storage on account removal
- CVE-2021-32657 Malicious user could break user administration page
- CVE-2021-32656 Trusted servers exchange can be triggered by attacker
- CVE-2021-32655 Files Drop public link can be added as federated share
- CVE-2021-32654 Attacker can obtain write access to any federated share/public link
- CVE-2021-32653 Default settings leak federated cloud ID to lookup server of all users
- CVE-2021-32652 Missing permission check on email metadata retrieval
- CVE-2021-32651 LDAP injection via OneDev may leak some LDAP directory information
- CVE-2021-32650 Arbitrary code execution in october/system
- CVE-2021-32649 Authenticated file write leads to remote code execution in october/system
- CVE-2021-32648 October CMS Improper Authentication
- CVE-2021-32647 Post-authentication Remote Code Execution (RCE) in emissary:emissary
- CVE-2021-32646 Escalation of permissions in roomer
- CVE-2021-32645 Open Redirect in tenancy
- CVE-2021-32644 Cross-site Scripting in Random.php
- CVE-2021-32643 StaticFile.fromUrl can leak presence of a directory
- CVE-2021-32642 Missing input validation in dynamic discovery example scripts.
- CVE-2021-32641 Reflected XSS when using flashMessages
- CVE-2021-32640 ReDoS in Sec-Websocket-Protocol header
- CVE-2021-3264 SQL injection in cxuu:cxuucms
- CVE-2021-32639 Server-Side Request Forgery (SSRF) in emissary:emissary
- CVE-2021-32638 CodeQL runner: Command-line options that make GitHub access tokens visible to other processes are now deprecated
- CVE-2021-32637 Authentication bypassed with malformed request URI
- CVE-2021-32635 Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint
- CVE-2021-32634 Deserialization of Untrusted Data in Emissary
- CVE-2021-32633 Remote Code Execution via traversal in TAL expressions
- CVE-2021-32632 CSRF allowing modification of commands, modules, banphrases through hidden iFrames
- CVE-2021-32631 JSON Web Tokens not properly verified
- CVE-2021-32630 Various
- CVE-2021-32629 Memory access due to code generation flaw in Cranelift module
- CVE-2021-32628 Vulnerability in handling large ziplists
- CVE-2021-32627 Integer overflow issue with Streams in Redis
- CVE-2021-32626 Lua scripts can overflow the heap-based Lua stack in Redis
- CVE-2021-32625 Redis vulnerability in STRALGO LCS on 32-bit systems
- CVE-2021-32624 Private Field data leak