Vulnerabilities published in 2021
27,247 vulnerabilities were published in 2021: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 239 of 273.
- CVE-2021-21364 Generated Code Contains Local Information Disclosure Vulnerability
- CVE-2021-21363 Generator Web Application: Local Privilege Escalation Vulnerability via System Temp Directory
- CVE-2021-21362 Bypassing readOnly policy by creating a temporary 'mc share upload' URL
- CVE-2021-21361 Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin
- CVE-2021-21360 Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetup
- CVE-2021-2136 Other in WebLogic Server
- CVE-2021-21359 Denial of Service in Page Error Handling
- CVE-2021-21358 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form
- CVE-2021-21357 Broken Access Control in Form Framework
- CVE-2021-21355 Unrestricted File Upload in Form Framework
- CVE-2021-21354 Open redirect in pollbot
- CVE-2021-21353 Remote code execution in pug
- CVE-2021-21352 Predictable tokens used for password resets
- CVE-2021-21351 XStream is vulnerable to an Arbitrary Code Execution attack
- CVE-2021-21350 XStream is vulnerable to an Arbitrary Code Execution attack
- CVE-2021-2135 Other in WebLogic Server
- CVE-2021-21349 A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
- CVE-2021-21348 XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)
- CVE-2021-21347 XStream is vulnerable to an Arbitrary Code Execution attack
- CVE-2021-21346 XStream is vulnerable to an Arbitrary Code Execution attack
- CVE-2021-21345 XStream is vulnerable to a Remote Command Execution attack
- CVE-2021-21344 XStream is vulnerable to an Arbitrary Code Execution attack
- CVE-2021-21343 XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights
- CVE-2021-21342 A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
- CVE-2021-21341 XStream can cause a Denial of Service
- CVE-2021-21340 Cross-Site Scripting in Content Preview
- CVE-2021-2134 Denial of service in Enterprise Manager for Fusion Middleware
- CVE-2021-21339 Cleartext storage of session identifier
- CVE-2021-21338 Open Redirection in Login Handling
- CVE-2021-21337 URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService
- CVE-2021-21336 Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager
- CVE-2021-21335 Basic Authentication can be bypassed using a malformed username
- CVE-2021-21334 environment variable leak
- CVE-2021-21333 HTML injection in email and account expiry notifications
- CVE-2021-21332 Cross-site scripting (XSS) vulnerability in the password reset endpoint
- CVE-2021-21331 DataDog API Client contains a Local Information Disclosure Vulnerability
- CVE-2021-21330 Open redirect vulnerability in aiohttp
- CVE-2021-21329 Multi Factor Authentication Token Improperly Validated On User Login
- CVE-2021-21328 Denial of Service
- CVE-2021-21327 Unsafe Reflection in getItemForItemtype()
- CVE-2021-21326 Horizontal Privilege Escalation
- CVE-2021-21325 Stored XSS in budget type
- CVE-2021-21324 Insecure Direct Object Reference (IDOR) on "Solutions"
- CVE-2021-21323 Regression in DNS leakage from Tor windows
- CVE-2021-21322 Prefix escape
- CVE-2021-21321 Prefix escape
- CVE-2021-21320 User content sandbox can be confused into opening arbitrary documents
- CVE-2021-21319 Several stored XSS
- CVE-2021-21318 Removing access may not effect published series
- CVE-2021-21317 Denial of Service in uap-core
- CVE-2021-21316 Arbitrary code execution in less-openui5
- CVE-2021-21315 System Information Library for Node.JS Command Injection
- CVE-2021-21314 XSS injection on ticket update
- CVE-2021-21313 XSS on tabs
- CVE-2021-21312 Stored XSS on documents
- CVE-2021-21311 Adminer Server-Side Request Forgery
- CVE-2021-21310 Token verification bug in next-auth
- CVE-2021-2131 Other in VM VirtualBox
- CVE-2021-21309 Integer overflow on 32-bit systems
- CVE-2021-21308 Improper session management for soft logout
- CVE-2021-21307 Remote Code Exploit in Lucee Admin
- CVE-2021-21306 Denial of Service in Marked
- CVE-2021-21305 Code Injection vulnerability in CarrierWave
- CVE-2021-21304 Prototype Pollution in Dynamoose
- CVE-2021-21303 Injection attack in Helm
- CVE-2021-21302 CSV Injection via csv export
- CVE-2021-21301 Video feed was captured while user has disabled video
- CVE-2021-21300 malicious repositories can execute remote code while cloning
- CVE-2021-2130 Denial of service in VM VirtualBox
- CVE-2021-21299 Multiple Transfer-Encoding headers misinterprets request payload
- CVE-2021-21298 Path traversal in Node-Red
- CVE-2021-21297 Prototype Pollution in Node-Red
- CVE-2021-21296 Denial-of-service in Fleet
- CVE-2021-21295 Possible request smuggling in HTTP/2 due missing validation
- CVE-2021-21294 Unbounded connection acceptance in http4s-blaze-server
- CVE-2021-21293 Unbounded connection acceptance leads to file handle exhaustion
- CVE-2021-21292 Unquoted Windows binary path in Traccar
- CVE-2021-21291 Subdomain checking of whitelisted domains could allow unintended redirects
- CVE-2021-21290 Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files
- CVE-2021-2129 Other in VM VirtualBox
- CVE-2021-21289 Command Injection Vulnerability in Mechanize
- CVE-2021-21288 Server-side request forgery in CarrierWave
- CVE-2021-21287 Server-Side Request Forgery in MinIO Browser API
- CVE-2021-21286 Authorization Bypass in AVideo Platform
- CVE-2021-21285 Docker daemon crash during image pull of malicious image
- CVE-2021-21284 privilege escalation in Moby
- CVE-2021-21283 XSS in Flarum Sticky extension.
- CVE-2021-21282 Buffer overflow in RPL source routing header processing
- CVE-2021-21281 Buffer overflow due to unvalidated TCP data offset
- CVE-2021-21280 Out-of-bounds write when processing 6LoWPAN extension headers
- CVE-2021-2128 Information disclosure in VM VirtualBox
- CVE-2021-21279 Infinite loop in IPv6 neighbor solicitation processing
- CVE-2021-21278 Risk of code injection in RSSHub
- CVE-2021-21277 Angular Expressions - Remote Code Execution
- CVE-2021-21276 Privilege escalation in Polr
- CVE-2021-21275 CSRF in MediaWiki Report extension
- CVE-2021-21274 Denial of service attack via .well-known lookups
- CVE-2021-21273 Open redirects on some federation and push requests
- CVE-2021-21272 zip slip in ORAS
- CVE-2021-21271 Denial of service in TenderMint Core