# Vulnerabilities published in 2021


- [GSD-2021-1000075](https://insights.sbomify.com/GSD-2021-1000075/): cifs: fix regression when mounting shares with prefix paths (not scored)
- [GSD-2021-1000074](https://insights.sbomify.com/GSD-2021-1000074/): riscv/kprobe: fix kernel panic when invoking sys_read traced by kprobe (not scored)
- [GSD-2021-1000073](https://insights.sbomify.com/GSD-2021-1000073/): btrfs: fix race between transaction aborts and fsyncs leading to use-after-free (not scored)
- [GSD-2021-1000072](https://insights.sbomify.com/GSD-2021-1000072/): openvswitch: fix stack OOB read while fragmenting IPv4 packets (not scored)
- [GSD-2021-1000071](https://insights.sbomify.com/GSD-2021-1000071/): virtiofs: fix memory leak in virtio_fs_probe() (not scored)
- [GSD-2021-1000070](https://insights.sbomify.com/GSD-2021-1000070/): net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packets (not scored)
- [GSD-2021-1000069](https://insights.sbomify.com/GSD-2021-1000069/): ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure (not scored)
- [GSD-2021-1000068](https://insights.sbomify.com/GSD-2021-1000068/): NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds (not scored)
- [GSD-2021-1000067](https://insights.sbomify.com/GSD-2021-1000067/): md/raid1: properly indicate failure when ending a failed write request (not scored)
- [GSD-2021-1000066](https://insights.sbomify.com/GSD-2021-1000066/): tpm: efi: Use local variable for calculating final log size (not scored)
- [GSD-2021-1000065](https://insights.sbomify.com/GSD-2021-1000065/): sfc: farch: fix TX queue lookup in TX flush done handling (not scored)
- [GSD-2021-1000064](https://insights.sbomify.com/GSD-2021-1000064/): sfc: adjust efx->xdp_tx_queue_count with the real number of initialized queues (not scored)
- [GSD-2021-1000063](https://insights.sbomify.com/GSD-2021-1000063/): sfc: farch: fix TX queue lookup in TX event handling (not scored)
- [GSD-2021-1000062](https://insights.sbomify.com/GSD-2021-1000062/): ext4: fix check to prevent false positive report of incorrect used inodes (not scored)
- [GSD-2021-1000061](https://insights.sbomify.com/GSD-2021-1000061/): media: dvbdev: Fix memory leak in dvb_media_device_free() (not scored)
- [GSD-2021-1000060](https://insights.sbomify.com/GSD-2021-1000060/): ext4: always panic when errors=panic is specified (not scored)
- [GSD-2021-1000059](https://insights.sbomify.com/GSD-2021-1000059/): media: staging/intel-ipu3: Fix memory leak in imu_fmt (not scored)
- [GSD-2021-1000058](https://insights.sbomify.com/GSD-2021-1000058/): media: staging/intel-ipu3: Fix set_fmt error handling (not scored)
- [GSD-2021-1000057](https://insights.sbomify.com/GSD-2021-1000057/): io_uring: fix shared sqpoll cancellation hangs (not scored)
- [GSD-2021-1000056](https://insights.sbomify.com/GSD-2021-1000056/): usb: dwc3: core: Do core softreset when switch mode (not scored)
- [GSD-2021-1000055](https://insights.sbomify.com/GSD-2021-1000055/): tracing: Restructure trace_clock_global() to never block (not scored)
- [GSD-2021-1000054](https://insights.sbomify.com/GSD-2021-1000054/): tools/power turbostat: Fix offset overflow issue in index converting (not scored)
- [GSD-2021-1000053](https://insights.sbomify.com/GSD-2021-1000053/): dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails (not scored)
- [GSD-2021-1000052](https://insights.sbomify.com/GSD-2021-1000052/): thermal/drivers/cpufreq_cooling: Fix slab OOB issue (not scored)
- [GSD-2021-1000050](https://insights.sbomify.com/GSD-2021-1000050/): locking/qrwlock: Fix ordering in queued_write_lock_slowpath() (not scored)
- [GSD-2021-1000049](https://insights.sbomify.com/GSD-2021-1000049/): net: hso: fix NULL-deref on disconnect regression (not scored)
- [GSD-2021-1000048](https://insights.sbomify.com/GSD-2021-1000048/): locking/qrwlock: Fix ordering in queued_write_lock_slowpath() (not scored)
- [GSD-2021-1000047](https://insights.sbomify.com/GSD-2021-1000047/): locking/qrwlock: Fix ordering in queued_write_lock_slowpath() (not scored)
- [GSD-2021-1000046](https://insights.sbomify.com/GSD-2021-1000046/): net: hso: fix NULL-deref on disconnect regression (not scored)
- [GSD-2021-1000045](https://insights.sbomify.com/GSD-2021-1000045/): KEYS: trusted: Fix TPM reservation for seal/unseal (not scored)
- [GSD-2021-1000044](https://insights.sbomify.com/GSD-2021-1000044/): locking/qrwlock: Fix ordering in queued_write_lock_slowpath() (not scored)
- [GSD-2021-1000043](https://insights.sbomify.com/GSD-2021-1000043/): net: hso: fix NULL-deref on disconnect regression (not scored)
- [GSD-2021-1000042](https://insights.sbomify.com/GSD-2021-1000042/): net: hso: fix NULL-deref on disconnect regression (not scored)
- [GSD-2021-1000041](https://insights.sbomify.com/GSD-2021-1000041/): KEYS: trusted: Fix TPM reservation for seal/unseal (not scored)
- [GSD-2021-1000039](https://insights.sbomify.com/GSD-2021-1000039/): ARM: footbridge: fix PCI interrupt mapping (not scored)
- [GSD-2021-1000038](https://insights.sbomify.com/GSD-2021-1000038/): netfilter: nft_limit: avoid possible divide error in nft_limit_init (not scored)
- [GSD-2021-1000037](https://insights.sbomify.com/GSD-2021-1000037/): ARM: footbridge: fix PCI interrupt mapping (not scored)
- [GSD-2021-1000036](https://insights.sbomify.com/GSD-2021-1000036/): ch_ktls: Fix kernel panic (not scored)
- [GSD-2021-1000035](https://insights.sbomify.com/GSD-2021-1000035/): net: Make tcp_allowed_congestion_control readonly in non-init netns (not scored)
- [GSD-2021-1000034](https://insights.sbomify.com/GSD-2021-1000034/): libbpf: Fix potential NULL pointer dereference (not scored)
- [GSD-2021-1000033](https://insights.sbomify.com/GSD-2021-1000033/): netfilter: nft_limit: avoid possible divide error in nft_limit_init (not scored)
- [GSD-2021-1000032](https://insights.sbomify.com/GSD-2021-1000032/): ixgbe: fix unbalanced device enable/disable in suspend/resume (not scored)
- [GSD-2021-1000031](https://insights.sbomify.com/GSD-2021-1000031/): dmaengine: idxd: fix wq cleanup of WQCFG registers (not scored)
- [GSD-2021-1000030](https://insights.sbomify.com/GSD-2021-1000030/): dmaengine: idxd: fix wq size store permission state (not scored)
- [GSD-2021-1000029](https://insights.sbomify.com/GSD-2021-1000029/): dmaengine: idxd: Fix clobbering of SWERR overflow bit on writeback (not scored)
- [GSD-2021-1000028](https://insights.sbomify.com/GSD-2021-1000028/): netfilter: nft_limit: avoid possible divide error in nft_limit_init (not scored)
- [GSD-2021-1000027](https://insights.sbomify.com/GSD-2021-1000027/): ixgbe: Fix NULL pointer dereference in ethtool loopback test (not scored)
- [GSD-2021-1000026](https://insights.sbomify.com/GSD-2021-1000026/): dmaengine: idxd: fix wq cleanup of WQCFG registers (not scored)
- [GSD-2021-1000025](https://insights.sbomify.com/GSD-2021-1000025/): dmaengine: idxd: clear MSIX permission entry on shutdown (not scored)
- [GSD-2021-1000024](https://insights.sbomify.com/GSD-2021-1000024/): dmaengine: idxd: fix wq size store permission state (not scored)
- [GSD-2021-1000023](https://insights.sbomify.com/GSD-2021-1000023/): dmaengine: idxd: Fix clobbering of SWERR overflow bit on writeback (not scored)
- [GSD-2021-1000022](https://insights.sbomify.com/GSD-2021-1000022/): KVM: VMX: Don't use vcpu->run->internal.ndata as an array index (not scored)
- [GSD-2021-1000021](https://insights.sbomify.com/GSD-2021-1000021/): bpf: Use correct permission flag for mixed signed bounds arithmetic (not scored)
- [GSD-2021-1000020](https://insights.sbomify.com/GSD-2021-1000020/): ARM: footbridge: fix PCI interrupt mapping (not scored)
- [GSD-2021-1000019](https://insights.sbomify.com/GSD-2021-1000019/): ARM: 9063/1: mm: reduce maximum number of CPUs if DEBUG_KMAP_LOCAL is enabled (not scored)
- [GSD-2021-1000018](https://insights.sbomify.com/GSD-2021-1000018/): ch_ktls: Fix kernel panic (not scored)
- [GSD-2021-1000017](https://insights.sbomify.com/GSD-2021-1000017/): net: Make tcp_allowed_congestion_control readonly in non-init netns (not scored)
- [GSD-2021-1000016](https://insights.sbomify.com/GSD-2021-1000016/): libbpf: Fix potential NULL pointer dereference (not scored)
- [GSD-2021-1000015](https://insights.sbomify.com/GSD-2021-1000015/): netfilter: nftables: clone set element expression template (not scored)
- [GSD-2021-1000014](https://insights.sbomify.com/GSD-2021-1000014/): ixgbe: fix unbalanced device enable/disable in suspend/resume (not scored)
- [GSD-2021-1000013](https://insights.sbomify.com/GSD-2021-1000013/): kasan: remove redundant config option (not scored)
- [GSD-2021-1000012](https://insights.sbomify.com/GSD-2021-1000012/): KVM: VMX: Don't use vcpu->run->internal.ndata as an array index (not scored)
- [GSD-2021-1000011](https://insights.sbomify.com/GSD-2021-1000011/): bpf: Use correct permission flag for mixed signed bounds arithmetic (not scored)
- [GHSA-xxfh-x98p-j8fr](https://insights.sbomify.com/GHSA-xxfh-x98p-j8fr/): Remote code injection in Log4j (through pax-logging-log4j2) (not scored)
- [GHSA-xx4c-jj58-r7x6](https://insights.sbomify.com/GHSA-xx4c-jj58-r7x6/): Inefficient Regular Expression Complexity in Validator.js (not scored)
- [GHSA-xmh9-rg6f-j3mr](https://insights.sbomify.com/GHSA-xmh9-rg6f-j3mr/): Verification flaw in Solid identity-token-verifier (not scored)
- [GHSA-xh2p-7p87-fhgh](https://insights.sbomify.com/GHSA-xh2p-7p87-fhgh/): Incorrect TCR calculation in batchLiquidateTroves() during Recovery Mode (not scored)
- [GHSA-x7p5-p2c9-phvg](https://insights.sbomify.com/GHSA-x7p5-p2c9-phvg/): Unexpected database bindings (not scored)
- [GHSA-x5h4-9gqw-942j](https://insights.sbomify.com/GHSA-x5h4-9gqw-942j/): Improper Verification of Cryptographic Signature in aws-encryption-sdk (not scored)
- [GHSA-x5c7-x7m2-rhmf](https://insights.sbomify.com/GHSA-x5c7-x7m2-rhmf/): Local directory executable lookup in sops (Windows-only) (not scored)
- [GHSA-wq3r-jwrq-xg6w](https://insights.sbomify.com/GHSA-wq3r-jwrq-xg6w/): Canceling of orders not related to the logged-in user (not scored)
- [GHSA-wmpv-c2jp-j2xg](https://insights.sbomify.com/GHSA-wmpv-c2jp-j2xg/): ERC1155Supply vulnerability in OpenZeppelin Contracts (not scored)
- [GHSA-wfrj-qqc2-83cm](https://insights.sbomify.com/GHSA-wfrj-qqc2-83cm/): Remote command injection when using sendmail email transport (not scored)
- [GHSA-w8fh-pvq2-x8c4](https://insights.sbomify.com/GHSA-w8fh-pvq2-x8c4/): Malicious npm package: sonatype (not scored)
- [GHSA-w736-hf9p-qqh3](https://insights.sbomify.com/GHSA-w736-hf9p-qqh3/): Key Caching behavior in the DynamoDB Encryption Client. (not scored)
- [GHSA-vjf8-9fx6-mv6x](https://insights.sbomify.com/GHSA-vjf8-9fx6-mv6x/): Triton VM Soundness Vulnerability due to Missing Constraint (not scored)
- [GHSA-v988-828w-xvf2](https://insights.sbomify.com/GHSA-v988-828w-xvf2/): Authentication Bypass Using an Alternate Path or Channel and Authentication Bypass by Primary Weakness in rucio-webui (not scored)
- [GHSA-v935-pqmr-g8v9](https://insights.sbomify.com/GHSA-v935-pqmr-g8v9/): Unexpected panics in num-bigint (not scored)
- [GHSA-rrqv-vjrw-hrcr](https://insights.sbomify.com/GHSA-rrqv-vjrw-hrcr/): Arbitrary Code Execution in json-ptr (not scored)
- [GHSA-rrfw-hg9m-j47h](https://insights.sbomify.com/GHSA-rrfw-hg9m-j47h/): Signature Validation Bypass (not scored)
- [GHSA-rc7p-gmvh-xfx2](https://insights.sbomify.com/GHSA-rc7p-gmvh-xfx2/): Attack on Kubernetes via Misconfigured Argo Workflows (not scored)
- [GHSA-r7cj-wmwv-hfw5](https://insights.sbomify.com/GHSA-r7cj-wmwv-hfw5/): `BinaryArray` does not perform bound checks on reading values and offsets (not scored)
- [GHSA-r64m-qchj-hrjp](https://insights.sbomify.com/GHSA-r64m-qchj-hrjp/): Webcache Poisoning in shopware/platform and shopware/core (not scored)
- [GHSA-qxx8-292g-2w66](https://insights.sbomify.com/GHSA-qxx8-292g-2w66/): Improper Authentication (not scored)
- [GHSA-qv2g-99x4-45x6](https://insights.sbomify.com/GHSA-qv2g-99x4-45x6/): Malicious npm package: discord-fix (not scored)
- [GHSA-qrmm-w75w-3wpx](https://insights.sbomify.com/GHSA-qrmm-w75w-3wpx/): Server side request forgery in SwaggerUI (not scored)
- [GHSA-qrmm-w4v4-q7f8](https://insights.sbomify.com/GHSA-qrmm-w4v4-q7f8/): Unauthorized access through URL manipulation (not scored)
- [GHSA-qmfx-75ff-8mw6](https://insights.sbomify.com/GHSA-qmfx-75ff-8mw6/): Listing of upload directory contents possible (not scored)
- [GHSA-qm7x-rc44-rrqw](https://insights.sbomify.com/GHSA-qm7x-rc44-rrqw/): Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server) (not scored)
- [GHSA-qh54-9vc5-m9fg](https://insights.sbomify.com/GHSA-qh54-9vc5-m9fg/): MD5 hash support in github.com/foxcpp/maddy (not scored)
- [GHSA-qgrp-8f3v-q85p](https://insights.sbomify.com/GHSA-qgrp-8f3v-q85p/): `FixedSizeBinaryArray` does not perform bound checks on accessing values and offsets (not scored)
- [GHSA-qg7c-q3vq-rgxr](https://insights.sbomify.com/GHSA-qg7c-q3vq-rgxr/): Leak of information via Store-API aggregations in shopware/platform and shopware/core (not scored)
- [GHSA-qc22-qwm9-j8rx](https://insights.sbomify.com/GHSA-qc22-qwm9-j8rx/): Remote Code Execution in npm-groovy-lint (not scored)
- [GHSA-q4h9-46xg-m3x9](https://insights.sbomify.com/GHSA-q4h9-46xg-m3x9/): UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable (not scored)
- [GHSA-q324-q795-2q5p](https://insights.sbomify.com/GHSA-q324-q795-2q5p/): Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name (not scored)
- [GHSA-prqf-xr2j-xf65](https://insights.sbomify.com/GHSA-prqf-xr2j-xf65/): Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client` (not scored)
- [GHSA-prmc-5v5w-c465](https://insights.sbomify.com/GHSA-prmc-5v5w-c465/): Client TLS credentials sent raw to server in npm package nats (not scored)
- [GHSA-pp8r-vv2j-9j5v](https://insights.sbomify.com/GHSA-pp8r-vv2j-9j5v/): traitobject is Unmaintained (not scored)
- [GHSA-pjj4-jjgc-h3r8](https://insights.sbomify.com/GHSA-pjj4-jjgc-h3r8/): Authenticated remote code execution (not scored)
- [GHSA-p7mj-xvxg-grff](https://insights.sbomify.com/GHSA-p7mj-xvxg-grff/): `out_reference::Out::from_raw` should be `unsafe` (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/40/