CVEs from 2021
Total
4,783
critical
critical 281
high
high 1,014
medium
medium 1,186
low
low 139
% Critical
5.9%
% with KEV
4.5%
% with exploit
5.4%
Top vendors
Top products
- simatic_wincc_runtime_advanced 28
- office 13
- primavera_gateway 10
- weblogic_server 9
- primavera_unifier 8
- modicon_m340_bmxp342020 8
- log4j 8
- mbed_tls 8
| CVE | Severity | CVSS | Risk | Flags | OS | Vendor | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-27860 | unknown | — | 1.5 | 5y ago | A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. | |||
| CVE-2021-43890 | unknown | — | 1.5 | 5y ago | Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability. | |||
| CVE-2021-44168 | unknown | — | 1.5 | 5y ago | Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files. | |||
| CVE-2021-35394 | unknown | — | 1.5 | 5y ago | RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution. | |||
| CVE-2021-44515 | unknown | — | 1.5 | 5y ago | Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server. | |||
| CVE-2021-37415 | unknown | — | 1.5 | 5y ago | Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication | |||
| CVE-2021-42292 | unknown | — | 1.5 | 5y ago | A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution. | |||
| CVE-2021-31956 | unknown | — | 1.5 | 5y ago | Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application. | |||
| CVE-2021-22900 | unknown | — | 1.5 | 5y ago | Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability that allows an authenticated administrator to perform a file write via a maliciously crafted archive upload in the admin… | |||
| CVE-2021-20023 | unknown | — | 1.5 | 5y ago | SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Se… | |||
| CVE-2021-1906 | unknown | — | 1.5 | 5y ago | Multiple Qualcomm chipsets contain a detection of error condition without action vulnerability when improper handling of address deregistration on failure can lead to new GPU address allocation failu… | |||
| CVE-2021-31201 | unknown | — | 1.5 | 5y ago | Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation. | |||
| CVE-2021-31199 | unknown | — | 1.5 | 5y ago | Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation. | |||
| CVE-2021-30869 | unknown | — | 1.5 | 5y ago | Apple iOS, iPadOS, and macOS contain a type confusion vulnerability in the XNU which may allow a malicious application to execute code with kernel privileges. | |||
| CVE-2021-30713 | unknown | — | 1.5 | 5y ago | Apple macOS Transparency, Consent, and Control (TCC) contains an unspecified permissions issue which may allow a malicious application to bypass privacy preferences. | |||
| CVE-2021-36741 | unknown | — | 1.5 | 5y ago | Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files. | |||
| CVE-2021-1905 | unknown | — | 1.5 | 5y ago | Multiple Qualcomm Chipsets contain a use after free vulnerability due to improper handling of memory mapping of multiple processes simultaneously. | |||
| CVE-2021-31979 | unknown | — | 1.5 | 5y ago | Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. | |||
| CVE-2021-30860 | unknown | — | 1.5 | 5y ago | Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known … | |||
| CVE-2021-28664 | unknown | — | 1.5 | 5y ago | Arm Mali Graphics Processing Unit (GPU) kernel driver contains an unspecified vulnerability that may allow a non-privileged user to gain write access to read-only memory, gain root privilege, corrupt… | |||
| CVE-2021-22899 | unknown | — | 1.5 | 5y ago | Ivanti Pulse Connect Secure contains a command injection vulnerability that allows remote authenticated users to perform remote code execution via Windows File Resource Profiles. | |||
| CVE-2021-28663 | unknown | — | 1.5 | 5y ago | Arm Mali Graphics Processing Unit (GPU) kernel driver contains a use-after-free vulnerability that may allow a non-privileged user to make improper operations on GPU memory to gain root privilege, an… | |||
| CVE-2021-28550 | unknown | — | 1.5 | 5y ago | Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user. | |||
| CVE-2021-28310 | unknown | — | 1.5 | 5y ago | Microsoft Windows Win32k contains an unspecified vulnerability that allows for privilege escalation. | |||
| CVE-2021-22893 | unknown | — | 1.5 | 5y ago | Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services. | |||
| CVE-2021-20022 | unknown | — | 1.5 | 5y ago | SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability ha… | |||
| CVE-2021-27103 | unknown | — | 1.5 | 5y ago | Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html. | |||
| CVE-2021-27101 | unknown | — | 1.5 | 5y ago | Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html. | |||
| CVE-2021-27085 | unknown | — | 1.5 | 5y ago | Microsoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution. | |||
| CVE-2021-26411 | unknown | — | 1.5 | 5y ago | Microsoft Internet Explorer contains an unspecified vulnerability that allows for memory corruption. | |||
| CVE-2021-38645 | unknown | — | 1.5 | 5y ago | Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation. | |||
| CVE-2021-30807 | unknown | — | 1.5 | 5y ago | Apple iOS, iPadOS, macOS, and watchOS IOMobileFrameBuffer contain a memory corruption vulnerability which may allow an application to execute code with kernel privileges. | |||
| CVE-2021-26858 | unknown | — | 1.5 | 5y ago | Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain. | |||
| CVE-2021-27102 | unknown | — | 1.5 | 5y ago | Accellion FTA contains an OS command injection vulnerability exploited via a local web service call. | |||
| CVE-2021-1782 | unknown | — | 1.5 | 5y ago | Apple iOS, iPadOs, macOS, watchOS, and tvOS contain a race condition vulnerability that may allow a malicious application to elevate privileges. | |||
| CVE-2021-21017 | unknown | — | 1.5 | 5y ago | Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user. | |||
| CVE-2021-1879 | unknown | — | 1.5 | 5y ago | Apple iOS, iPadOS, and watchOS WebKit contain an unspecified vulnerability that allows for universal cross-site scripting (XSS) when processing maliciously crafted web content. This vulnerability cou… | |||
| CVE-2021-36948 | unknown | — | 1.5 | 5y ago | Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation. | |||
| CVE-2021-22894 | unknown | — | 1.5 | 5y ago | Ivanti Pulse Connect Secure Collaboration Suite contains a buffer overflow vulnerabilities that allows a remote authenticated users to execute code as the root user via maliciously crafted meeting ro… | |||
| CVE-2021-35395 | unknown | — | 1.5 | 5y ago | Realtek AP-Router SDK HTTP web server boa contains a buffer overflow vulnerability due to unsafe copies of some overly long parameters submitted in the form that lead to denial-of-service (DoS). | |||
| CVE-2021-27059 | unknown | — | 1.5 | 5y ago | Microsoft Office contains an unspecified vulnerability that allows for remote code execution. | |||
| CVE-2021-27561 | unknown | — | 1.5 | 5y ago | Yealink Device Management contains a server-side request forgery (SSRF) vulnerability that allows for unauthenticated remote code execution. | |||
| CVE-2021-33739 | unknown | — | 1.5 | 5y ago | Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation. | |||
| CVE-2021-36955 | unknown | — | 1.5 | 5y ago | Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. | |||
| CVE-2021-36742 | unknown | — | 1.5 | 5y ago | Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation. | |||
| CVE-2021-35211 | unknown | — | 1.5 | 5y ago | SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution. | |||
| CVE-2021-33771 | unknown | — | 1.5 | 5y ago | Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. | |||
| CVE-2021-27104 | unknown | — | 1.5 | 5y ago | Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints. | |||
| CVE-2021-20090 | unknown | — | 1.5 | 5y ago | Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affe… | |||
| CVE-2021-30116 | unknown | — | 1.5 | 5y ago | Kaseya Virtual System/Server Administrator (VSA) contains an information disclosure vulnerability allowing an attacker to obtain the sessionId that can be used to execute further attacks against the … | |||
| CVE-2021-23874 | unknown | — | 1.5 | 5y ago | McAfee Total Protection (MTP) contains an improper privilege management vulnerability that allows a local user to gain elevated privileges and execute code, bypassing MTP self-defense. | |||
| CVE-2021-22506 | unknown | — | 1.5 | 5y ago | Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used. | |||
| CVE-2021-31955 | unknown | — | 1.5 | 5y ago | Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode … | |||
| CVE-2021-1647 | unknown | — | 1.5 | 5y ago | Microsoft Defender contains an unspecified vulnerability that allows for remote code execution. | |||
| CVE-2021-26857 | unknown | — | 1.5 | 5y ago | Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain. | |||
| CVE-2021-20021 | unknown | — | 1.5 | 5y ago | SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This… | |||
| CVE-2021-20016 | unknown | — | 1.5 | 5y ago | SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker. | |||
| CVE-2021-31755 | unknown | — | 1.5 | 5y ago | Tenda AC11 devices contain a stack buffer overflow vulnerability in /goform/setmac which allows attackers to execute code via a crafted post request. | |||
| CVE-2021-33742 | unknown | — | 1.5 | 5y ago | Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution. | |||
| CVE-2021-38649 | unknown | — | 1.5 | 5y ago | Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation. | |||
| CVE-2021-34448 | unknown | — | 1.5 | 5y ago | Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption. | |||
| CVE-2021-32648 | unknown | — | 1.5 | 5y ago | In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. | |||
| CVE-2021-21315 | unknown | — | 1.5 | 5y ago | The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation b… | |||
| CVE-2021-21311 | unknown | — | 1.5 | 5y ago | Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information. | |||
| CVE-2021-43116 | unknown | — | 1.0 | 4y ago | Use of Hard-coded Credentials in Nacos | |||
| CVE-2021-42697 | unknown | — | 1.0 | 4y ago | Uncontrolled Recursion in Akka HTTP | |||
| CVE-2021-22145 | unknown | — | 1.0 | 4y ago | Generation of Error Message Containing Sensitive Information in Elasticsearch | |||
| CVE-2021-38294 | unknown | — | 1.0 | 5y ago | Command injection leading to Remote Code Execution in Apache Storm | |||
| CVE-2021-34429 | unknown | — | 1.0 | 5y ago | Encoded URIs can access WEB-INF directory in Eclipse Jetty | |||
| CVE-2021-25646 | unknown | — | 1.0 | 5y ago | Code injection in Apache Druid | |||
| CVE-2021-27850 | unknown | — | 1.0 | 5y ago | Remote code execution in Apache Tapestry | |||
| CVE-2021-33561 | unknown | — | 1.0 | 5y ago | Cross-site scripting in Shopizer | |||
| CVE-2021-33562 | unknown | — | 1.0 | 5y ago | Cross-site scripting in Shopizer | |||
| CVE-2021-28164 | unknown | — | 1.0 | 5y ago | Authorization Before Parsing and Canonicalization in jetty | |||
| CVE-2021-47594 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: mptcp: never allow the PM to close a listener subflow Currently, when deleting an endpoint the netlink PM treverses all the local… | |||
| CVE-2021-47584 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: iocost: Fix divide-by-zero on donation from low hweight cgroup The donation calculation logic assumes that the donor has non-zero… | |||
| CVE-2021-47182 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix scsi_mode_sense() buffer length handling Several problems exist with scsi_mode_sense() buffer length handling: … | |||
| CVE-2021-47562 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ice: fix vsi->txq_map sizing The approach of having XDP queue per CPU regardless of user's setting exposed a hidden bug that coul… | |||
| CVE-2021-47552 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release() For avoiding to slow down queue destroy, we don'… | |||
| CVE-2021-47577 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: io-wq: check for wq exit after adding new worker task_work We check IO_WQ_BIT_EXIT before attempting to create a new worker, and … | |||
| CVE-2021-47536 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix wrong list_del in smc_lgr_cleanup_early smc_lgr_cleanup_early() meant to delete the link group from the link group l… | |||
| CVE-2021-47191 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() The following warning was observed running syzkaller: [ 3813.830724]… | |||
| CVE-2021-47197 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() Prior to this patch in case mlx5_core_destroy_cq() failed it proceed… | |||
| CVE-2021-47199 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: CT, Fix multiple allocations and memleak of mod acts CT clear action offload adds additional mod hdr actions to the fl… | |||
| CVE-2021-47402 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: sched: flower: protect fl_walk() with rcu Patch that refactored fl_walk() to use idr_for_each_entry_continue_ul() also remov… | |||
| CVE-2021-47593 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: mptcp: clear 'kern' flag from fallback sockets The mptcp ULP extension relies on sk->sk_sock_kern being set correctly: It prevent… | |||
| CVE-2021-25311 | unknown | — | — | — | condor_credd in HTCondor before 8.9.11 allows Directory Traversal outside the SEC_CREDENTIAL_DIRECTORY_OAUTH directory, as demonstrated by creating a file under /etc that will later be executed by ro… | |||
| CVE-2021-47583 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: media: mxl111sf: change mutex_init() location Syzbot reported, that mxl111sf_ctrl_msg() uses uninitialized mutex. The problem was… | |||
| CVE-2021-47591 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: mptcp: remove tcp ulp setsockopt support TCP_ULP setsockopt cannot be used for mptcp because its already used internally to plumb… | |||
| CVE-2021-47578 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Don't call kcalloc() if size arg is zero If the size arg to kcalloc() is zero, it returns ZERO_SIZE_PTR. Becau… | |||
| CVE-2021-47568 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix memleak in get_file_stream_info() Fix memleak in get_file_stream_info() | |||
| CVE-2021-44731 | unknown | — | — | — | A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to gain root privileges by bind-mounting their … | |||
| CVE-2021-4120 | unknown | — | — | — | snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor policy rules via malformed content inte… | |||
| CVE-2021-3155 | unknown | — | — | — | snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been pri… | |||
| CVE-2021-47547 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound In line 5001, if all id in the array 'lp->phy[… | |||
| CVE-2021-38023 | unknown | — | — | — | Use after free in Extensions in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | |||
| CVE-2021-21443 | unknown | — | — | — | Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1 and later versions. OT… | |||
| CVE-2021-21439 | unknown | — | — | — | DoS attack can be performed when an email contains specially designed URL in the body. It can lead to the high CPU usage and cause low quality of service, or in extreme case bring the system to a hal… | |||
| CVE-2021-21440 | unknown | — | — | — | Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS … | |||
| CVE-2021-47542 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings() In qlcnic_83xx_add_rings(), the indirect function … |