Vulnerabilities published in 2021
27,247 vulnerabilities were published in 2021: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 91 of 273.
- CVE-2021-41246 Session fixation in express-openid-connect
- CVE-2021-41245 Possible Cross-Site Request Forgery in Combodo iTop
- CVE-2021-41244 Cross organization admin control in Grafana
- CVE-2021-41243 OS Command Injection Vulnerability and Potential Zip Slip Vulnerability
- CVE-2021-41242 Path Traversal in some REST methods leading to file upload to arbitrary places
- CVE-2021-41241 Advanced permissions is not respected for subfolders in Nextcloud server
- CVE-2021-4124 Cross-site Scripting (XSS) - Stored in meetecho/janus-gateway
- CVE-2021-41239 User enumeration setting not respected in Nextcloud server
- CVE-2021-41238 Missing Authorization with Default Settings in Dashboard UI
- CVE-2021-41236 XSS vulnerability in oro/platform
- CVE-2021-41233 Missing authorization in Nextcloud text
- CVE-2021-41232 Improper Neutralization of Special Elements used in an LDAP Query
- CVE-2021-41231 OpenMage LTS DataFlow upload remote code execution vulnerability
- CVE-2021-41230 OIDC claims not updated from Identity Provider in Pomerium
- CVE-2021-4123 Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat
- CVE-2021-41229 Memory leak in BlueZ
- CVE-2021-41228 Code injection in `saved_model_cli`
- CVE-2021-41227 Arbitrary memory read in `ImmutableConst`
- CVE-2021-41226 Heap OOB read in `SparseBinCount`
- CVE-2021-41225 A use of uninitialized value vulnerability in Tensorflow
- CVE-2021-41224 `SparseFillEmptyRows` heap OOB read
- CVE-2021-41223 Heap OOB read in `FusedBatchNorm` kernels
- CVE-2021-41222 Segfault due to negative splits in `SplitV`
- CVE-2021-41221 Access to invalid memory during shape inference in `Cudnn*` ops
- CVE-2021-41220 Use after free in `CollectiveReduceV2`
- CVE-2021-4122 Security feature bypass in cryptsetup
- CVE-2021-41219 Undefined behavior via `nullptr` reference binding in sparse matrix multiplication
- CVE-2021-41218 Integer division by 0 in `tf.raw_ops.AllToAll`
- CVE-2021-41217 Null pointer exception when `Exit` node is not preceded by `Enter` op
- CVE-2021-41216 Heap buffer overflow in `Transpose`
- CVE-2021-41215 Null pointer exception in `DeserializeSparse`
- CVE-2021-41214 Reference binding to `nullptr` in `tf.ragged.cross`
- CVE-2021-41213 Deadlock in mutually recursive `tf.function` objects
- CVE-2021-41212 Heap OOB read in `tf.ragged.cross`
- CVE-2021-41211 Heap OOB read in shape inference for `QuantizeV2`
- CVE-2021-41210 Heap OOB read in `tf.raw_ops.SparseCountSparseOutput`
- CVE-2021-4121 Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm
- CVE-2021-41209 FPE in convolutions with zero size filters
- CVE-2021-41208 Incomplete validation in boosted trees code
- CVE-2021-41207 Division by zero in `ParallelConcat`
- CVE-2021-41206 Incomplete validation of shapes in multiple TF ops
- CVE-2021-41205 Heap OOB read in all `tf.raw_ops.QuantizeAndDequantizeV*` ops
- CVE-2021-41204 Segfault while copying constant resource tensor
- CVE-2021-41203 Missing validation during checkpoint loading
- CVE-2021-41202 Overflow/crash in `tf.range`
- CVE-2021-41201 Unitialized access in `EinsumHelper::ParseEquation`
- CVE-2021-41200 Incomplete validation in `tf.summary.create_file_writer`
- CVE-2021-4120 snapd could be made to bypass intended access restrictions through snap content interfaces and layout paths
- CVE-2021-41199 Overflow/crash in `tf.image.resize` when size is large
- CVE-2021-41198 Overflow/crash in `tf.tile` when tiling tensor is large
- CVE-2021-41197 Crashes due to overflow and `CHECK`-fail in ops with large tensor shapes
- CVE-2021-41196 Crash in `max_pool3d` when size argument is 0 or negative
- CVE-2021-41195 Crash in `tf.math.segment_*` operations
- CVE-2021-41194 Improper Access Control in jupyterhub-firstuseauthenticator
- CVE-2021-41193 Use of Externally-Controlled Format String in wire-avs
- CVE-2021-41192 Insecure default configuration
- CVE-2021-41191 API giving out files without key
- CVE-2021-41190 Clarify Content-Type handling in OCI spec
- CVE-2021-4119 Improper Access Control in bookstackapp/bookstack
- CVE-2021-41189 Communities and collections administrators can escalate their privilege up to system administrator
- CVE-2021-41188 Authenticated Stored XSS in Administration
- CVE-2021-41187 SQL Injection in DHIS2 Tracker API
- CVE-2021-41186 ReDoS vulnerability in parser_apache2
- CVE-2021-41185 Download file outside intended directory
- CVE-2021-41184 XSS in the `of` option of the `.position()` util
- CVE-2021-41183 XSS in `*Text` options of the Datepicker widget
- CVE-2021-41182 XSS in the `altField` option of the Datepicker widget
- CVE-2021-41181 Nextcloud Talk app exposes chat messages on lockscreen
- CVE-2021-41180 Geolocation preview links can be set to arbitrary links in nextcloud talk
- CVE-2021-4118 Deserialization of Untrusted Data in pytorchlightning/pytorch-lightning
- CVE-2021-41179 Two-Factor Authentication not enforced for pages marked as public
- CVE-2021-41178 File Traversal affecting SVG files on Nextcloud Server
- CVE-2021-41177 Rate-limits not working on instances without configured memory cache backend
- CVE-2021-41176 logout CSRF in Pterodactyl Panel
- CVE-2021-41175 Stored XSS in Client Groups Management (Authenticated)
- CVE-2021-41174 XSS vulnerability allowing arbitrary JavaScript execution
- CVE-2021-41173 DoS via maliciously crafted p2p message
- CVE-2021-41172 Self-XSS in AS_Redis
- CVE-2021-41171 Bypass bruteforce protection on login form in elabftw
- CVE-2021-41170 Evaluation of closures can lead to execution of methods & functions in current program scope
- CVE-2021-4117 Business Logic Errors in yetiforcecompany/yetiforcecrm
- CVE-2021-41169 Improper Neutralization HTML tags in sulu/sulu
- CVE-2021-41168 Hash-Collision Denial-of-Service Vulnerability in snudown
- CVE-2021-41167 Unlimited requests in modern-async
- CVE-2021-41166 Permission bypass in Nextcloud Android App
- CVE-2021-41165 HTML comments vulnerability allowing to execute JavaScript code
- CVE-2021-41164 Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML
- CVE-2021-41163 RCE via malicious SNS subscription payload
- CVE-2021-41162 Cross-site Scripting in Combodo iTop
- CVE-2021-41161 XSS in csvimport in 3.0.0-beta versions
- CVE-2021-41160 Improper region checks in FreeRDP allow out of bound write to memory
- CVE-2021-4116 Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm
- CVE-2021-41159 Improper client input validation for FreeRDP gateway connections allows to overwrite memory
- CVE-2021-41158 FreeSWITCH vulnerable to SIP digest leak for configured gateways
- CVE-2021-41157 FreeSWITCH does not authenticate SIP SUBSCRIBE requests by default
- CVE-2021-41156 Reflected XSS vulnerability
- CVE-2021-41155 SQL injection in CVS revisions browser
- CVE-2021-41154 SQL injection in the "SVN core" commits browser
- CVE-2021-41153 Specification non-compliance in JUMPI
- CVE-2021-41152 Path Traversal in Folder Component Leading to Local File Inclusion