CVEs from 2021
Total
4,807
critical
critical 280
high
high 1,018
medium
medium 1,175
low
low 138
% Critical
5.8%
% with KEV
4.4%
% with exploit
5.3%
Top vendors
Top products
- simatic_wincc_runtime_advanced 28
- office 13
- primavera_gateway 10
- weblogic_server 9
- primavera_unifier 8
- modicon_m340_bmxp342020 8
- log4j 8
- communications_unified_inventory_management 7
| CVE | Severity | CVSS | Risk | Flags | OS | Vendor | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-22555 | high | — | 10.0 | 8mo ago | Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space. | |||
| CVE-2021-43798 | high | — | 10.0 | 2y ago | Grafana contains a path traversal vulnerability that could allow access to local files. | |||
| CVE-2021-3560 | high | — | 10.0 | 3y ago | Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation. | |||
| CVE-2021-4034 | high | — | 10.0 | 4y ago | The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights. | |||
| CVE-2021-3156 | high | — | 10.0 | 4y ago | Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation. | |||
| CVE-2021-41773 | high | — | 10.0 | 5y ago | A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-li… | |||
| CVE-2021-21220 | high | — | 10.0 | 5y ago | Google Chromium V8 Engine contains an improper input validation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could af… | |||
| CVE-2021-32305 | high | — | 9.0 | — | arbitrary command execution in websvn | |||
| CVE-2021-44790 | high | — | 9.0 | 4y ago | A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerab… | |||
| CVE-2021-23017 | high | — | 9.0 | 5y ago | RHSA-2022:0323: nginx:1.20 security update (Important) | |||
| CVE-2021-27928 | high | — | 9.0 | 5y ago | RHSA-2021:1242: mariadb:10.3 and mariadb-devel:10.3 security update (Important) | |||
| CVE-2021-22204 | medium | — | 8.0 | 5y ago | Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image | |||
| CVE-2021-3490 | medium | — | 6.5 | — | The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kern… | |||
| CVE-2021-29447 | medium | — | 6.5 | — | Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress install… | |||
| CVE-2021-31806 | medium | — | 6.5 | 5y ago | RHSA-2021:4292: squid:4 security, bug fix, and enhancement update (Moderate) | |||
| CVE-2021-31807 | medium | — | 6.5 | 5y ago | RHSA-2021:4292: squid:4 security, bug fix, and enhancement update (Moderate) | |||
| CVE-2021-21300 | low | — | 3.5 | — | Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as… |