Vulnerabilities published in 2021
27,247 vulnerabilities were published in 2021: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 92 of 273.
- CVE-2021-41151 Path Traversal in @backstage/plugin-scaffolder-backend
- CVE-2021-41150 Improper sanitization of delegated role names in tough
- CVE-2021-4115 Denial of service in polkitd
- CVE-2021-41149 Improper sanitization of target names in tough
- CVE-2021-41148 The update of the CI job targeted by a widget is vulnerable to blind SQL injections
- CVE-2021-41147 SQL injection in the planning edition panel
- CVE-2021-41146 Arbitrary command execution on Windows in qutebrowser
- CVE-2021-41145 FreeSWITCH susceptible to Denial of Service via SIP flooding
- CVE-2021-41144 OpenMage LTS authenticated remote code execution through layout update
- CVE-2021-41143 OpenMage LTS arbitrary file deletion in customer media allows for remote code execution
- CVE-2021-41142 XSS via the name of a deleted attachment
- CVE-2021-41141 Missing release of locks in PJSIP
- CVE-2021-41140 Reactions leak for secure category topics and private messages
- CVE-2021-41139 Reflected XSS vulnerability in time.php
- CVE-2021-41138 Validity check for signed Frontier-specific extrinsic not called in block execution
- CVE-2021-41137 Bypassing policy restrictions on regular users
- CVE-2021-41136 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma
- CVE-2021-41135 Authz Module Non-Determinism
- CVE-2021-41134 Stored XSS in Jupyter nbdime
- CVE-2021-41133 Sandbox bypass via recent VFS-manipulating syscalls
- CVE-2021-41132 Inconsistent input sanitisation leads to XSS vectors
- CVE-2021-41131 Client metadata path-traversal in python-tuf
- CVE-2021-41130 X-Endpoint-API-UserInfo can be spoofed in cloudendpoints Extensible Service Proxy
- CVE-2021-41129 Authentication bypass in Pterodactyl
- CVE-2021-41128 CSV Injection Vulnerability in Hygeia
- CVE-2021-41127 Maliciously Crafted Model Archive Can Lead To Arbitrary File Write in rasa
- CVE-2021-41126 Deleted Admin Can Sign In to Admin Interface
- CVE-2021-41125 HTTP authentication credential leak to target websites in scrapy
- CVE-2021-41124 Splash authentication credentials potentially leaked to target websites in scrapy-splash
- CVE-2021-41123 Exposure of Sensitive Information to an Unauthorized Actor in WB.UI.Headquarters.dll
- CVE-2021-41122 Bounds check missing for decimal args in Vyper
- CVE-2021-41121 Memory corruption in Vyper
- CVE-2021-41120 Unauthorized access to Credit card form in sylius/paypal-plugin
- CVE-2021-4112 Privilege escalation in ansible-tower
- CVE-2021-41119 DoS vulnerabiliity in wire-server json parser
- CVE-2021-41118 ReDoS in DynamicPageList3
- CVE-2021-41117 Insecure random number generation
- CVE-2021-41116 Command injection in composer on Windows
- CVE-2021-41115 Regular expression denial-of-service in Zulip
- CVE-2021-41114 HTTP Host Header Injection in Request Handling in Typo3
- CVE-2021-41113 Cross-Site-Request-Forgery in Backend URI Handling in Typo3
- CVE-2021-41112 Missing Authorization in Rundeck
- CVE-2021-41111 Authorization Bypass Through User-Controlled Key in Rundeck
- CVE-2021-41110 CWL Viewer: deserialization of untrusted data can lead to complete takeover by an attacker
- CVE-2021-4111 Business Logic Errors in yetiforcecompany/yetiforcecrm
- CVE-2021-41109 LiveQuery publishes user session tokens
- CVE-2021-41106 File reference keys leads to incorrect hashes on HMAC algorithms
- CVE-2021-41105 FreeSWITCH susceptible to Denial of Service via invalid SRTP packets
- CVE-2021-41104 web_server allows OTA update without checking user defined basic auth username & password
- CVE-2021-41103 Insufficiently restricted permissions on plugin directories
- CVE-2021-41101 CORS `Access-Control-Allow-Origin` settings are too lenient
- CVE-2021-41100 Account takeover when having only access to a user's short lived token in wire-server
- CVE-2021-4110 NULL Pointer Dereference in mruby/mruby
- CVE-2021-41099 Integer overflow issue with strings in Redis
- CVE-2021-41098 Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
- CVE-2021-41097 Prototype pollution in aurelia-path
- CVE-2021-41096 Use of a Broken or Risky Cryptographic Algorithm in com.mayank.rucky
- CVE-2021-41095 XSS via blocked watched word in error message
- CVE-2021-41094 Mandatory encryption at rest can be bypassed (UI) in Wire app
- CVE-2021-41093 Account takeover when having only access to a user's short lived token
- CVE-2021-41092 Docker CLI leaks private registry credentials to registry-1.docker.io
- CVE-2021-41091 Insufficiently restricted permissions on data directory in Docker Engine
- CVE-2021-41090 Instance config inline secret exposure
- CVE-2021-41089 `docker cp` allows unexpected chmod of host files
- CVE-2021-41088 Remote code execution via the web UI backend of Elvish
- CVE-2021-41087 Improperly Implemented path matching for in-toto-golang
- CVE-2021-41086 Clipboard-based XSS in jsuites
- CVE-2021-41084 Response Splitting from unsanitized headers in http4s
- CVE-2021-41083 CSRF Vulnerability in dada-mail 11.15.1 and below
- CVE-2021-41082 Private message title and participating users leaked in discourse
- CVE-2021-41081 SQL injection in zohocorp:manageengine network configuration manager
- CVE-2021-41080 SQL injection in zohocorp:manageengine network configuration manager
- CVE-2021-4108 Cross-site Scripting (XSS) - Stored in snipe/snipe-it
- CVE-2021-41079 Apache Tomcat DoS with unexpected TLS packet
- CVE-2021-41078 Nameko Arbitrary code execution due to YAML deserialization
- CVE-2021-41077 Information disclosure in travis-ci:travis ci
- CVE-2021-41075 SQL injection in zohocorp:manageengine opmanager
- CVE-2021-41074 Cross-site request forgery in webkul:qloapps
- CVE-2021-41073 Memory corruption in debian:debian linux
- CVE-2021-41072 Path traversal in debian:debian linux
- CVE-2021-4107 Cross-site Scripting (XSS) - Reflected in yetiforcecompany/yetiforcecrm
- CVE-2021-41067 Supply chain in listary:listary
- CVE-2021-41066 Missing authorization in bopsoft:listary
- CVE-2021-41065 Privilege escalation in bopsoft:listary
- CVE-2021-41063 SQL injection in xylem:aanderaa geoview
- CVE-2021-41061 Weak cryptography in riot-os:riot
- CVE-2021-4106 Vulnerability in Snow Inventory Java Scanner
- CVE-2021-41057 Path traversal in siemens:pss cape
- CVE-2021-41055 Denial of service in gajim:gajim
- CVE-2021-41054 Memory corruption in atftp project:atftp
- CVE-2021-4105 Unauthenticated Remote Code Execution on COSLAT Firewall
- CVE-2021-41043 Use after free in tcpslice
- CVE-2021-41042 XML External Entity Reference in Eclipse Lyo
- CVE-2021-41041 Security feature bypass in Eclipse OpenJ9
- CVE-2021-41040 Memory corruption in eclipse:wakaama
- CVE-2021-4104 Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2
- CVE-2021-41039 Denial of service in Eclipse Mosquitto
- CVE-2021-41038 Improper Verification of Communication Channel in @theia/plugin-ext
- CVE-2021-41037 Security feature bypass in Eclipse Equinox p2
- CVE-2021-41036 Memory corruption in Eclipse Paho MQTT C Client