Vulnerabilities published in 2021
27,247 vulnerabilities were published in 2021: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 41 of 273.
- GHSA-mf4f-j588-5xm8 Apache Log4j Remote Code Execution
- GHSA-m836-gxwq-j2pm Improper Access Control in github.com/treeverse/lakefs
- GHSA-m6m5-pp4g-fcc8 S3 storage write is not aborted on errors leading to unbounded memory usage
- GHSA-m6gx-rhvj-fh52 Denial of service in go-ethereum due to CVE-2020-28362
- GHSA-m489-xr35-fjxr Regular Expression Denial of Service in millisecond
- GHSA-jwh2-vrr9-vcp2 mz-avro's incorrect use of `set_len` allows for un-initialized memory
- GHSA-jvg4-9rc2-wvcr Generation of fake documents via public GET-call
- GHSA-jqj4-r483-4gvr Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
- GHSA-jq42-hfch-42f3 Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint
- GHSA-jpwx-ffjq-wr4w Content object state fetch functions open to SQL injection
- GHSA-jfmf-w293-8xr8 Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8
- GHSA-jcjx-c3j3-44pr Insufficient Session Expiration in @cyyynthia/tokenize
- GHSA-jcgr-9698-82jx Improper Neutralization of Special Elements used in a Command ('Command Injection') in @floffah/build
- GHSA-j9wr-49vq-rm5g Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19
- GHSA-j7c3-96rf-jrrp Critical vulnerability in log4j may affect generated PEAR projects
- GHSA-j23j-q57m-63v3 Denial of service in DataCommunicator class in Vaadin 8
- GHSA-hxwm-x553-x359 Arbitrary Command Injection due to Improper Command Sanitization
- GHSA-hwvm-vfw8-93mw Vulnerable dependency in XTDB connector
- GHSA-hw7r-qrhp-5pff Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20
- GHSA-hhw9-35p2-q2c5 Steam Socialite Provider v1 does not correctly validate openid server
- GHSA-hfwx-c7q6-g54c Vulnerability allowing for reading internal HTTP resources
- GHSA-h96f-fc7c-9r55 Regex denial of service vulnerability in codesample plugin
- GHSA-h588-76vg-prgj `DecimalArray` does not perform bound checks on accessing values and offsets
- GHSA-h45p-w933-jxh3 Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript
- GHSA-gwj5-3vfq-q992 Import loops in account imports, nats-server DoS
- GHSA-gqcf-83rq-gpfr Any storage file can be downloaded from p.sh if full server path is known
- GHSA-gmq2-39ff-f5qg A failed upgrade may lead to hung goroutines
- GHSA-gjrj-9rj4-pgwx DoS Vulnerability from Upstream Actix Web Issues
- GHSA-g98v-hv3f-hcfr Potential unaligned read
- GHSA-g636-q5fc-4pr7 accounts: Hash account number using Salt
- GHSA-g54h-m393-cpwq devices resource list treated as a blacklist by default
- GHSA-g2qj-pmxm-9f8f User enumeration in authentication mechanisms
- GHSA-g2q5-5433-rhrf Embedded malware in rc
- GHSA-fxwm-rx68-p5vx XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
- GHSA-fxq4-r6mr-9x64 CSRF Vuln can expose user's QRcode
- GHSA-fr26-qjc8-mvjx Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
- GHSA-f6p7-8xfw-fjqq Authenticated Stored XSS in Administration
- GHSA-f3w5-v9xx-rp8p Signature verification failure in Tendermint
- GHSA-cvmj-47v9-35m9 FUSE-Rust: Uninitalized memory read and leak caused by fuser crate
- GHSA-crh4-294p-vcfq Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
- GHSA-cfcv-q4qq-2ph4 CKEditor 4 vulnerabilities in versions <4.16.1
- GHSA-c6c4-7x48-4cqp Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18
- GHSA-c66w-hq56-4q97 Network policy may be bypassed by some ICMP Echo Requests
- GHSA-c57f-4vp2-jqhm Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19
- GHSA-9wx7-jrvc-28mm Signature verification vulnerability in Stark Bank ecdsa libraries
- GHSA-9vxv-wpv4-f52p Information leakage in Error Handler
- GHSA-9jp8-cwwx-p64q XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
- GHSA-9h6g-6mxg-vvp4 Timing side channel vulnerability in endpoint request handler in Vaadin 15-19
- GHSA-94g7-hpv8-h9qm Remote code injection in Log4j
- GHSA-8vfw-v2jv-9hwc Reflected cross-site scripting in development mode handler in Vaadin
- GHSA-8r4g-cg4m-x23c Denial of Service in node-static
- GHSA-89v2-g37m-g3ff Improper Verification of Cryptographic Signature in aws-encryption-sdk-cli
- GHSA-88rc-3p98-rgvx After order payment process manipulation in shopware/platform and shopware/core
- GHSA-84p7-fh9c-6g8h Prototype Pollution in mixme
- GHSA-82mf-mmh7-hxp5 Directory traversal in development mode handler in Vaadin 14 and 15-17
- GHSA-7xcv-wvr7-4h6p Malicious npm package: an0n-chat-lib
- GHSA-7vwg-39h8-8qp8 /user/sessions endpoint allows detecting valid accounts
- GHSA-7qfm-6m33-rgg9 XML External Entity Reference
- GHSA-7h5v-85w9-pq6c Denial of service (via resource exhaustion) due to improper input validation in third-party identifier endpoint
- GHSA-7fjp-g4m7-fx23 User (Encrypted) Password Field Being Serialised
- GHSA-77vh-xpmg-72qh Clarify `mediaType` handling
- GHSA-773q-5334-5gf9 Memory over-allocation in evm-core
- GHSA-76f4-fw33-6j2v Potential sensitive data exposure in applications using Vaadin 15
- GHSA-73qr-pfmq-6rp8 Embedded malware in coa
- GHSA-6w87-g839-9wv7 Helm OCI credentials leaked into Argo CD logs
- GHSA-6rg3-8h8x-5xfv Unchecked hostname resolution could allow access to local network resources by users outside the local network
- GHSA-6hgr-2g6q-3rmc Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
- GHSA-6cj2-92m5-7mvp Improperly Controlled Modification of Object Prototype Attributes
- GHSA-6c73-2v8x-qpvm Argo Server TLS requests could be forged by attacker with network access
- GHSA-65p7-pjj8-ggmr Member account takeover
- GHSA-63rq-p8fp-524q Potential API key leak
- GHSA-5vm8-hhgr-jcjp Cross-site scripting vulnerability in TinyMCE
- GHSA-5j5w-g665-5m35 Ambiguous OCI manifest parsing
- GHSA-5684-g483-2249 Signature Validation Bypass
- GHSA-5629-8855-gf4g Authentication Bypass by CSRF Weakness
- GHSA-4wv4-mgfq-598v Code injection in nobelprizeparser
- GHSA-4whq-r978-2x68 Arbitrary code execution in ExifTool
- GHSA-4ph2-8337-hm62 Key Caching behavior in the DynamoDB Encryption Client.
- GHSA-4mg9-vhxq-vm7j SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database
- GHSA-4g53-vp7q-gfjv constructEvent does not verify header
- GHSA-433w-mm6h-rv9p Auth bypass in SAML provider
- GHSA-3wxm-m9m4-cprj Import of incorrectly embargoed keys could cause early publication
- GHSA-3w6p-8f82-gw8r Using JMSAppender in log4j configuration may lead to deserialization of untrusted data
- GHSA-3pcr-4982-548m Exposure of .env if project root is configured as web root in shopware/production
- GHSA-3jch-9qgp-4844 Generated code can read and write out of bounds in safe code
- GHSA-3h5r-928v-mxhh Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11
- GHSA-36mj-6r7r-mqhf User can obtain JWT token even if account is disabled
- GHSA-32wx-4gxx-h48f Users can edit the tags of any discussion
- GHSA-2rh5-jvgx-pgw3 Any storage file can be downloaded from p.sh if full server path is known
- GHSA-2g8g-63j4-9w3r RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend
- GHSA-2frx-j9hj-6c65 User enumeration in authentication mechanisms
- GHSA-2c83-wfv3-q25f Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ZMarkdown
- GHSA-243q-g9j3-qf6r non-admin users can create integration role with administrator role
- DRUPAL-CORE-2021-011 The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4) library for WYSIWYG editing.
- DRUPAL-CORE-2021-005 The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4), library for WYSIWYG editing.
- DRUPAL-CORE-2021-001 The Drupal project uses the pear Archive\_Tar library, which has released a security update that impacts Drupal.
- DRUPAL-CONTRIB-2021-047 This modules enables users to login via email address.
- DRUPAL-CONTRIB-2021-045 Access Bypass: This module enables you to build forms and surveys in Drupal.
- DRUPAL-CONTRIB-2021-044 This module enables users to authenticate through their Microsoft Azure AD account.
- DRUPAL-CONTRIB-2021-043 This module enables aklump/loft\_data\_grids to be used as a Drupal module.