CVEs from 2021
Total
4,797
critical
critical 280
high
high 1,019
medium
medium 1,175
low
low 138
% Critical
5.8%
% with KEV
4.4%
% with exploit
5.3%
Top vendors
Top products
- simatic_wincc_runtime_advanced 28
- office 13
- primavera_gateway 10
- weblogic_server 9
- primavera_unifier 8
- modicon_m340_bmxp342020 8
- log4j 8
- communications_unified_inventory_management 7
| CVE | Severity | CVSS | Risk | Flags | OS | Vendor | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-47338 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: fbmem: Do not delete the mode that is still in use The execution of fb_delete_videomode() is not based on the result of the previ… | |||
| CVE-2021-47609 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Fix string overflow in SCPI genpd driver Without the bound checks for scpi_pd->name, it could result in the b… | |||
| CVE-2021-47412 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: block: don't call rq_qos_ops->done_bio if the bio isn't tracked rq_qos framework is only applied on request based driver, so: 1)… | |||
| CVE-2021-47606 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: net: netlink: af_netlink: Prevent empty skb by adding a check on len. Adding a check on len parameter to avoid empty skb. This pr… | |||
| CVE-2021-47461 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: userfaultfd: fix a race between writeprotect and exit_mmap() A race is possible when a process exits, its VMAs are removed by exi… | |||
| CVE-2021-47468 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: isdn: mISDN: Fix sleeping function called from invalid context The driver can call card->isac.release() function from an atomic c… | |||
| CVE-2021-47018 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: powerpc/64: Fix the definition of the fixmap area At the time being, the fixmap area is defined at the top of the address space o… | |||
| CVE-2021-47408 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: serialize hash resizes and cleanups Syzbot was able to trigger the following warning [1] No repro found by… | |||
| CVE-2021-47257 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: net: ieee802154: fix null deref in parse dev addr Fix a logic error that could result in a null deref if the user sets the mode i… | |||
| CVE-2021-47491 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: mm: khugepaged: skip huge page collapse for special files The read-only THP for filesystems will collapse THP for files opened re… | |||
| CVE-2021-47304 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized This commit fixes a bug (found by syzkaller) that could cause spuri… | |||
| CVE-2021-46939 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: tracing: Restructure trace_clock_global() to never block It was reported that a fix to the ring buffer recursion detection would … | |||
| CVE-2021-47624 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change The refcount leak issues take place in an error handling pat… | |||
| CVE-2021-47284 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: isdn: mISDN: netjet: Fix crash in nj_probe: 'nj_setup' in netjet.c might fail with -EIO and in this case 'card->irq' is initializ… | |||
| CVE-2021-47596 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg Currently, the hns3_remove function firstly uninstall client instance, … | |||
| CVE-2021-47548 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() The if statement: if (port… | |||
| CVE-2021-47356 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: mISDN: fix possible use-after-free in HFC_cleanup() This module's remove path calls del_timer(). However, that function does not … | |||
| CVE-2021-47353 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: udf: Fix NULL pointer dereference in udf_symlink function In function udf_symlink, epos.bh is assigned with the value returned by… | |||
| CVE-2021-47456 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: can: peak_pci: peak_pci_remove(): fix UAF When remove the module peek_pci, referencing 'chan' again after releasing 'dev' will ca… | |||
| CVE-2021-47069 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry do_mq_timedreceive calls wq_sleep with a stack local add… | |||
| CVE-2021-46909 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: ARM: footbridge: fix PCI interrupt mapping Since commit 30fdfb929e82 ("PCI: Add a call to pci_assign_irq() in pci_device_probe()"… | |||
| CVE-2021-47310 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: net: ti: fix UAF in tlan_remove_one priv is netdev private data and it cannot be used after free_netdev() call. Using priv after … | |||
| CVE-2021-47236 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: net: cdc_eem: fix tx fixup skb leak when usbnet transmit a skb, eem fixup it in eem_tx_fixup(), if skb_copy_expand() failed, it r… | |||
| CVE-2021-47073 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios init_dell_smbios_wmi() only registers the dell_smbios_wmi_driver on … | |||
| CVE-2021-47311 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: net: qcom/emac: fix UAF in emac_remove adpt is netdev private data and it cannot be used after free_netdev() call. Using adpt aft… | |||
| CVE-2021-46972 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: ovl: fix leaked dentry Since commit 6815f479ca90 ("ovl: use only uppermetacopy state in ovl_lookup()"), overlayfs doesn't put tem… | |||
| CVE-2021-43815 | high | — | 8.0 | 2y ago | Grafana directory traversal for .cvs files | |||
| CVE-2021-47579 | high | — | 8.0 | 2y ago | In the Linux kernel, the following vulnerability has been resolved: ovl: fix warning in ovl_create_real() Syzbot triggered the following warning in ovl_workdir_create() -> ovl_create_real(): if (… | |||
| CVE-2021-43975 | high | — | 8.0 | 3y ago | In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-… | |||
| CVE-2021-47515 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: seg6: fix the iif in the IPv6 socket control block When an IPv4 packet is received, the ip_rcv_core(...) sets the receiving inter… | |||
| CVE-2021-47221 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: mm/slub: actually fix freelist pointer vs redzoning It turns out that SLUB redzoning ("slub_debug=Z") checks from s->object_size … | |||
| CVE-2021-33656 | high | — | 8.0 | 3y ago | When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds. | |||
| CVE-2021-47592 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix tc flower deletion for VLAN priority Rx steering To replicate the issue:- 1) Add 1 flower filter for VLAN Prior… | |||
| CVE-2021-33655 | high | — | 8.0 | 3y ago | When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds. | |||
| CVE-2021-26341 | high | — | 8.0 | 3y ago | RHSA-2023:2951: kernel security, bug fix, and enhancement update (Important) | |||
| CVE-2021-47393 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs Fan speed minimum can be enforced from sy… | |||
| CVE-2021-47441 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: mlxsw: thermal: Fix out-of-bounds memory accesses Currently, mlxsw allows cooling states to be set above the maximum cooling stat… | |||
| CVE-2021-38578 | high | — | 8.0 | 3y ago | Important: edk2 security, bug fix, and enhancement update | |||
| CVE-2021-47671 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path In es58x_rx_err_msg(), if can->do_set_mode() fails, the functi… | |||
| CVE-2021-35065 | high | — | 8.0 | 3y ago | RHSA-2023:1743: nodejs:14 security, bug fix, and enhancement update (Important) | |||
| CVE-2021-47560 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum: Protect driver from buggy firmware When processing port up/down events generated by the device's firmware, the d… | |||
| CVE-2021-33631 | high | — | 8.0 | 3y ago | Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, … | |||
| CVE-2021-47373 | high | — | 8.0 | 4y ago | In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Fix potential VPE leak on error In its_vpe_irq_domain_alloc, when its_vpe_init() returns an error, there is a… | |||
| CVE-2021-42340 | high | — | 8.0 | 4y ago | The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics f… | |||
| CVE-2021-3839 | high | — | 8.0 | 4y ago | Important: dpdk security and bug fix update | |||
| CVE-2021-47556 | high | — | 8.0 | 4y ago | In the Linux kernel, the following vulnerability has been resolved: ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce() ethtool_set_coalesce() now uses both the .get_coalesce() and .… | |||
| CVE-2021-47455 | high | — | 8.0 | 4y ago | In the Linux kernel, the following vulnerability has been resolved: ptp: Fix possible memory leak in ptp_clock_register() I got memory leak as follows when doing fault injection test: unreferenced… | |||
| CVE-2021-34485 | high | — | 8.0 | 4y ago | RHSA-2021:3148: .NET 5.0 security and bugfix update (Important) | |||
| CVE-2021-3632 | high | — | 8.0 | 4y ago | Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow | |||
| CVE-2021-3513 | high | — | 8.0 | 4y ago | Incorrect implementation of lockout feature in Keycloak | |||
| CVE-2021-46784 | high | — | 8.0 | 4y ago | RHSA-2022:5526: squid:4 security update (Important) | |||
| CVE-2021-3697 | high | — | 8.0 | 4y ago | Important: grub2, mokutil, shim, and shim-unsigned-x64 security update | |||
| CVE-2021-3695 | high | — | 8.0 | 4y ago | Important: grub2, mokutil, shim, and shim-unsigned-x64 security update | |||
| CVE-2021-3696 | high | — | 8.0 | 4y ago | Important: grub2, mokutil, shim, and shim-unsigned-x64 security update | |||
| CVE-2021-43616 | high | — | 8.0 | 4y ago | The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the… | |||
| CVE-2021-21671 | high | — | 8.0 | 4y ago | multiple issues in jenkins | |||
| CVE-2021-21670 | high | — | 8.0 | 4y ago | multiple issues in jenkins | |||
| CVE-2021-24112 | high | — | 8.0 | 4y ago | .NET Core Remote Code Execution Vulnerability | |||
| CVE-2021-21611 | high | — | 8.0 | 4y ago | multiple issues in jenkins | |||
| CVE-2021-21610 | high | — | 8.0 | 4y ago | multiple issues in jenkins | |||
| CVE-2021-21607 | high | — | 8.0 | 4y ago | multiple issues in jenkins | |||
| CVE-2021-21605 | high | — | 8.0 | 4y ago | multiple issues in jenkins | |||
| CVE-2021-21602 | high | — | 8.0 | 4y ago | multiple issues in jenkins | |||
| CVE-2021-21604 | high | — | 8.0 | 4y ago | multiple issues in jenkins | |||
| CVE-2021-21608 | high | — | 8.0 | 4y ago | multiple issues in jenkins | |||
| CVE-2021-21609 | high | — | 8.0 | 4y ago | multiple issues in jenkins | |||
| CVE-2021-21603 | high | — | 8.0 | 4y ago | multiple issues in jenkins | |||
| CVE-2021-21606 | high | — | 8.0 | 4y ago | multiple issues in jenkins | |||
| CVE-2021-44717 | high | — | 8.0 | 4y ago | RHSA-2021:5160: go-toolset:rhel8 security and bug fix update (Important) | |||
| CVE-2021-47076 | high | — | 8.0 | 4y ago | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Return CQE error if invalid lkey was supplied RXE is missing update of WQE status in LOCAL_WRITE failures. This caused… | |||
| CVE-2021-43056 | high | — | 8.0 | 4y ago | An issue was discovered in the Linux kernel for powerpc before 5.14.15. It allows a malicious KVM guest to crash the host, when the host is running on Power8, due to an arch/powerpc/kvm/book3s_hv_rmh… | |||
| CVE-2021-3743 | high | — | 8.0 | 4y ago | An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a local attacker to gain access to out-of-bounds memory, leadi… | |||
| CVE-2021-3759 | high | — | 8.0 | 4y ago | A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple times, creating semaphores. This flaw al… | |||
| CVE-2021-4037 | high | — | 8.0 | 4y ago | A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership an… | |||
| CVE-2021-3669 | high | — | 8.0 | 4y ago | A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS. | |||
| CVE-2021-37159 | high | — | 8.0 | 4y ago | hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free. | |||
| CVE-2021-3764 | high | — | 8.0 | 4y ago | A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The h… | |||
| CVE-2021-45485 | high | — | 8.0 | 4y ago | In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that… | |||
| CVE-2021-3752 | high | — | 8.0 | 4y ago | A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to… | |||
| CVE-2021-43976 | high | — | 8.0 | 4y ago | In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_pan… | |||
| CVE-2021-3773 | high | — | 8.0 | 4y ago | RHSA-2022:1988: kernel security, bug fix, and enhancement update (Important) | |||
| CVE-2021-44733 | high | — | 8.0 | 4y ago | A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a s… | |||
| CVE-2021-42739 | high | — | 8.0 | 4y ago | The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandles… | |||
| CVE-2021-45486 | high | — | 8.0 | 4y ago | In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small. | |||
| CVE-2021-3612 | high | — | 8.0 | 4y ago | An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user t… | |||
| CVE-2021-4203 | high | — | 8.0 | 4y ago | A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker wit… | |||
| CVE-2021-4002 | high | — | 8.0 | 4y ago | A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of som… | |||
| CVE-2021-4157 | high | — | 8.0 | 4y ago | An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, having access to the NF… | |||
| CVE-2021-41864 | high | — | 8.0 | 4y ago | prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds wri… | |||
| CVE-2021-4197 | high | — | 8.0 | 4y ago | An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled… | |||
| CVE-2021-4083 | high | — | 8.0 | 4y ago | A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigg… | |||
| CVE-2021-20322 | high | — | 8.0 | 4y ago | A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw al… | |||
| CVE-2021-0941 | high | — | 8.0 | 4y ago | In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User inte… | |||
| CVE-2021-3772 | high | — | 8.0 | 4y ago | A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used a… | |||
| CVE-2021-26401 | high | — | 8.0 | 4y ago | LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs. | |||
| CVE-2021-21781 | high | — | 8.0 | 4y ago | An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application… | |||
| CVE-2021-43389 | high | — | 8.0 | 4y ago | An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c. | |||
| CVE-2021-29154 | high | — | 8.0 | 4y ago | BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/… | |||
| CVE-2021-3744 | high | — | 8.0 | 4y ago | A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This … | |||
| CVE-2021-47203 | high | — | 8.0 | 4y ago | In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() When parsing the txq list in lpfc_drain_txq(), the driver attempts to p… |