CVE-2021-33611

Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL

• CWE-79
• CWE-79

• https://github.com/vaadin/vaadin-menu-bar/pull/126Patch, Third Party Advisory
• https://vaadin.com/security/cve-2021-33611Exploit, Third Party Advisory
• https://github.com/vaadin/vaadin-menu-bar/pull/126Patch, Third Party Advisory
• https://vaadin.com/security/cve-2021-33611Exploit, Third Party Advisory

Published

Nov 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33601A vulnerability was discovered in the web user interface of …8.8
• CVE-2021-33602A vulnerability affecting the F-Secure Antivirus engine was …5.3
• CVE-2021-33603A Denial-of-Service (DoS) vulnerability was discovered in F-…6.5
• CVE-2021-33604URL encoding error in development mode handler in com.vaadin…2.5
• CVE-2021-33605Improper check in CheckboxGroup in com.vaadin:vaadin-checkbo…4.3
• CVE-2021-33609Missing check in DataCommunicator class in com.vaadin:vaadin…4.3
• CVE-2021-33615RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a…7.5
• CVE-2021-33616RSA Archer 6.x through 6.9 SP1 P4 (6.9.1.4) allows stored XS…5.4
• CVE-2021-33617Zoho ManageEngine Password Manager Pro before 11.2 11200 all…5.3
• CVE-2021-33618Dolibarr ERP and CRM 13.0.2 allows XSS via object details, a…6.1
• CVE-2021-33620Squid before 4.15 and 5.x before 5.0.6 allows remote servers…6.5
• CVE-2021-33621The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x be…8.8