2021 CVE Vulnerabilities
23,481 CVEs published in 2021.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2021-40527 | HIGH | 7.5 | 0.7% | Oct 25, 2021 | Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and in... |
| CVE-2021-21703 | HIGH | 7 | 1.3% | Oct 25, 2021 | In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI w... |
| CVE-2021-42840 | HIGH | 8.8 | 58.9% | Oct 22, 2021 | SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumsta... |
| CVE-2021-41171 | HIGH | 8.8 | 1.9% | Oct 22, 2021 | eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it al... |
| CVE-2021-42836 | HIGH | 7.5 | 2.2% | Oct 22, 2021 | GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack. |
| CVE-2021-42542 | HIGH | 8.8 | 1.4% | Oct 22, 2021 | The affected product is vulnerable to directory traversal due to mishandling of provided backup folder structure. |
| CVE-2021-42540 | HIGH | 8.8 | 1.0% | Oct 22, 2021 | The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can l... |
| CVE-2021-42539 | HIGH | 8.8 | 0.7% | Oct 22, 2021 | The affected product is vulnerable to a missing permission validation on system backup restore, which could lead to acco... |
| CVE-2021-42538 | HIGH | 8.8 | 0.9% | Oct 22, 2021 | The affected product is vulnerable to a parameter injection via passphrase, which enables the attacker to supply uncontr... |
| CVE-2021-38485 | HIGH | 8.8 | 0.9% | Oct 22, 2021 | The affected product is vulnerable to improper input validation in the restore file. This enables an attacker to provide... |
| CVE-2021-30359 | HIGH | 7.8 | 3.9% | Oct 22, 2021 | The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps duri... |
| CVE-2021-0870 | HIGH | 8.1 | 7.0% | Oct 22, 2021 | In RW_SetActivatedTagType of rw_main.cc, there is possible memory corruption due to a race condition. This could lead to... |
| CVE-2021-0708 | HIGH | 7.8 | 0.1% | Oct 22, 2021 | In runDumpHeap of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused deput... |
| CVE-2021-0705 | HIGH | 7.8 | 0.3% | Oct 22, 2021 | In sanitizeSbn of NotificationManagerService.java, there is a possible way to keep service running in foreground and kee... |
| CVE-2021-0652 | HIGH | 7.8 | 0.2% | Oct 22, 2021 | In VectorDrawable::VectorDrawable of VectorDrawable.java, there is a possible way to introduce a memory corruption due t... |
| CVE-2021-0483 | HIGH | 7.8 | 0.1% | Oct 22, 2021 | In multiple methods of AAudioService, there is a possible use-after-free due to a race condition. This could lead to loc... |
| CVE-2021-38479 | HIGH | 7.5 | 0.8% | Oct 22, 2021 | Many API function codes receive raw pointers remotely from the user and trust these pointers as valid in-bound memory re... |
| CVE-2021-38475 | HIGH | 8.8 | 0.9% | Oct 22, 2021 | The database connection to the server is performed by calling a specific API, which could allow an unprivileged user to ... |
| CVE-2021-38473 | HIGH | 8.8 | 0.9% | Oct 22, 2021 | The affected product’s code base doesn’t properly control arguments for specific functions, which could lead to a stack ... |
| CVE-2021-38469 | HIGH | 7.1 | 0.6% | Oct 22, 2021 | Many of the services used by the affected product do not specify full paths for the DLLs they are loading. An attacker c... |
| CVE-2021-38467 | HIGH | 8.1 | 0.7% | Oct 22, 2021 | A specific function code receives a raw pointer supplied by the user and deallocates this pointer. The user can then con... |
| CVE-2021-38463 | HIGH | 8.1 | 0.7% | Oct 22, 2021 | The affected product does not properly control the allocation of resources. A user may be able to allocate unlimited mem... |
| CVE-2021-38461 | HIGH | 8.2 | 0.5% | Oct 22, 2021 | The affected product uses a hard-coded blowfish key for encryption/decryption processes. The key can be easily extracted... |
| CVE-2021-34362 | HIGH | 7.2 | 1.3% | Oct 22, 2021 | A command injection vulnerability has been reported to affect QNAP device running Media Streaming add-on. If exploited, ... |
| CVE-2021-41127 | HIGH | 7.1 | 0.7% | Oct 21, 2021 | Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a... |
Check if your code is affected by 2021 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now