2021 CVEs¶
114 entries from 2021. 0 ship detection & prevention rules.
| CVE | Severity | Detection / prevention | PoC |
|---|---|---|---|
| CVE-2021-41277 — Metabase is an open source data analytics platform. | Critical (10.0) | — | ✅ |
| CVE-2021-44228 — Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and… | Critical (10.0) | — | ✅ |
| CVE-2021-1497 — Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX… | Critical (9.8) | — | ✅ |
| CVE-2021-1498 — Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX… | Critical (9.8) | — | ✅ |
| CVE-2021-1870 — A logic issue was addressed with improved restrictions. | Critical (9.8) | — | ✅ |
| CVE-2021-1871 — A logic issue was addressed with improved restrictions. | Critical (9.8) | — | ✅ |
| CVE-2021-20016 — A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote… | Critical (9.8) | — | ✅ |
| CVE-2021-20021 — A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to… | Critical (9.8) | — | ✅ |
| CVE-2021-20028 — Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting… | Critical (9.8) | — | ✅ |
| CVE-2021-20038 — A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi… | Critical (9.8) | — | ✅ |
| CVE-2021-20090 — A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware… | Critical (9.8) | — | ✅ |
| CVE-2021-21972 — The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter… | Critical (9.8) | — | ✅ |
| CVE-2021-21985 — The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of… | Critical (9.8) | — | ✅ |
| CVE-2021-22005 — The vCenter Server contains an arbitrary file upload vulnerability in the Analytics… | Critical (9.8) | — | ✅ |
| CVE-2021-22502 — Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR)… | Critical (9.8) | — | ✅ |
| CVE-2021-22941 — Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may… | Critical (9.8) | — | ✅ |
| CVE-2021-22986 — On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4,… | Critical (9.8) | — | ✅ |
| CVE-2021-22991 — On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4,… | Critical (9.8) | — | ✅ |
| CVE-2021-26084 — In affected versions of Confluence Server and Data Center, an OGNL injection… | Critical (9.8) | — | ✅ |
| CVE-2021-27101 — Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header… | Critical (9.8) | — | ✅ |
| CVE-2021-27103 — Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to… | Critical (9.8) | — | ✅ |
| CVE-2021-27104 — Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST… | Critical (9.8) | — | ✅ |
| CVE-2021-27561 — Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the… | Critical (9.8) | — | ✅ |
| CVE-2021-27852 — Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey… | Critical (9.8) | — | ✅ |
| CVE-2021-27860 — A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN… | Critical (9.8) | — | ✅ |
| CVE-2021-31166 — CVE ID: CVE-2021-31166, CWE: CWE-416, Type: RCE, Attack Vector: NETWORK, CVSS: 9.8 | Critical (9.8) | — | ✅ |
| CVE-2021-31755 — An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. | Critical (9.8) | — | ✅ |
| CVE-2021-32030 — The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra… | Critical (9.8) | — | ✅ |
| CVE-2021-33044 — The identity authentication bypass vulnerability found in some Dahua products during the… | Critical (9.8) | — | ✅ |
| CVE-2021-33045 — The identity authentication bypass vulnerability found in some Dahua products during the… | Critical (9.8) | — | ✅ |
| CVE-2021-35394 — Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP… | Critical (9.8) | — | ✅ |
| CVE-2021-35395 — Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a… | Critical (9.8) | — | ✅ |
| CVE-2021-35464 — ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the… | Critical (9.8) | — | ✅ |
| CVE-2021-35587 — Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2021-36260 — A command injection vulnerability in the web server of some Hikvision product. | Critical (9.8) | — | ✅ |
| CVE-2021-36380 — Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell… | Critical (9.8) | — | ✅ |
| CVE-2021-37415 — Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass… | Critical (9.8) | — | ✅ |
| CVE-2021-38647 — Open Management Infrastructure Remote Code Execution Vulnerability | Critical (9.8) | — | ✅ |
| CVE-2021-40539 — Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API… | Critical (9.8) | — | ✅ |
| CVE-2021-40870 — An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. | Critical (9.8) | — | ✅ |
| CVE-2021-42013 — It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was… | Critical (9.8) | — | ✅ |
| CVE-2021-42237 — Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure… | Critical (9.8) | — | ✅ |
| CVE-2021-42258 — BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for… | Critical (9.8) | — | ✅ |
| CVE-2021-44026 — Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via… | Critical (9.8) | — | ✅ |
| CVE-2021-44077 — Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and… | Critical (9.8) | — | ✅ |
| CVE-2021-44515 — Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to… | Critical (9.8) | — | ✅ |
| CVE-2021-30633 — Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote… | Critical (9.6) | — | ✅ |
| CVE-2021-37973 — Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote… | Critical (9.6) | — | ✅ |
| CVE-2021-26855 — CVE ID: CVE-2021-26855, CWE: CWE-918, Type: SSRF, Attack Vector: NETWORK, CVSS: 9.1 | Critical (9.1) | — | ✅ |
| CVE-2021-34473 — CVE ID: CVE-2021-34473, CWE: CWE-918, Type: SSRF, Attack Vector: NETWORK, CVSS: 9.1 | Critical (9.1) | — | ✅ |
| CVE-2021-34523 — Microsoft Exchange Server Elevation of Privilege Vulnerability | Critical (9.0) | — | ✅ |
| CVE-2021-35211 — Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U… | Critical (9.0) | — | ✅ |
| CVE-2021-40438 — A crafted request uri-path can cause mod_proxy to forward the request to an origin server… | Critical (9.0) | — | ✅ |
| CVE-2021-45046 — It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete… | Critical (9.0) | — | ✅ |
| CVE-2021-1789 — A type confusion issue was addressed with improved state handling. | High (8.8) | — | ✅ |
| CVE-2021-21017 — Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and… | High (8.8) | — | ✅ |
| CVE-2021-21148 — Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote… | High (8.8) | — | ✅ |
| CVE-2021-21166 — Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to… | High (8.8) | — | ✅ |
| CVE-2021-21193 — Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker… | High (8.8) | — | ✅ |
| CVE-2021-21206 — Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker… | High (8.8) | — | ✅ |
| CVE-2021-21220 — Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128… | High (8.8) | — | ✅ |
| CVE-2021-21224 — Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to… | High (8.8) | — | ✅ |
| CVE-2021-21551 — Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which… | High (8.8) | — | ✅ |
| CVE-2021-22894 — A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a… | High (8.8) | — | ✅ |
| CVE-2021-22899 — A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a… | High (8.8) | — | ✅ |
| CVE-2021-25296 — Nagios XI version xi-5.7.5 is affected by OS command injection. | High (8.8) | — | ✅ |
| CVE-2021-25297 — Nagios XI version xi-5.7.5 is affected by OS command injection. | High (8.8) | — | ✅ |
| CVE-2021-25298 — Nagios XI version xi-5.7.5 is affected by OS command injection. | High (8.8) | — | ✅ |
| CVE-2021-26828 — OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote… | High (8.8) | — | ✅ |
| CVE-2021-27085 — CVE ID: CVE-2021-27085, Attack Vector: NETWORK, CVSS: 8.8 | High (8.8) | — | ✅ |
| CVE-2021-27878 — An issue was discovered in Veritas Backup Exec before 21.2. | High (8.8) | — | ✅ |
| CVE-2021-28550 — Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and… | High (8.8) | — | ✅ |
| CVE-2021-28663 — The Arm Mali GPU kernel driver allows privilege escalation or information disclosure… | High (8.8) | — | ✅ |
| CVE-2021-28664 — The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory… | High (8.8) | — | ✅ |
| CVE-2021-29256 — . | High (8.8) | — | ✅ |
| CVE-2021-30551 — Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to… | High (8.8) | — | ✅ |
| CVE-2021-30554 — Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker… | High (8.8) | — | ✅ |
| CVE-2021-30563 — Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to… | High (8.8) | — | ✅ |
| CVE-2021-30632 — Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote… | High (8.8) | — | ✅ |
| CVE-2021-30661 — A use after free issue was addressed with improved memory management. | High (8.8) | — | ✅ |
| CVE-2021-30663 — An integer overflow was addressed with improved input validation. | High (8.8) | — | ✅ |
| CVE-2021-30665 — A memory corruption issue was addressed with improved state management. | High (8.8) | — | ✅ |
| CVE-2021-30666 — A buffer overflow issue was addressed with improved memory handling. | High (8.8) | — | ✅ |
| CVE-2021-30761 — A memory corruption issue was addressed with improved state management. | High (8.8) | — | ✅ |
| CVE-2021-30762 — A use after free issue was addressed with improved memory management. | High (8.8) | — | ✅ |
| CVE-2021-30858 — A use after free issue was addressed with improved memory management. | High (8.8) | — | ✅ |
| CVE-2021-3493 — The overlayfs implementation in the linux kernel did not properly validate with respect… | High (8.8) | — | ✅ |
| CVE-2021-36741 — An improper input validation vulnerability in Trend Micro Apex One, Apex One as a… | High (8.8) | — | ✅ |
| CVE-2021-37975 — Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to… | High (8.8) | — | ✅ |
| CVE-2021-38003 — Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a… | High (8.8) | — | ✅ |
| CVE-2021-40444 — Microsoft is investigating reports of a remote code execution vulnerability in MSHTML… |
High (8.8) | — | ✅ |
| CVE-2021-4102 — Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to… | High (8.8) | — | ✅ |
| CVE-2021-42321 — Microsoft Exchange Server Remote Code Execution Vulnerability | High (8.8) | — | ✅ |
| CVE-2021-39144 — XStream is a simple library to serialize objects to XML and back again. | High (8.5) | — | ✅ |
| CVE-2021-1905 — Possible use after free due to improper handling of memory mapping of multiple processes… | High (8.4) | — | ✅ |
| CVE-2021-33739 — Microsoft DWM Core Library Elevation of Privilege Vulnerability | High (8.4) | — | ✅ |
| CVE-2021-22555 — A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in… | High (8.3) | — | ✅ |
| CVE-2021-23874 — Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to… | High (8.2) | — | ✅ |
| CVE-2021-27877 — An issue was discovered in Veritas Backup Exec before 21.2. | High (8.2) | — | ✅ |
| CVE-2021-32648 — octobercms in a CMS platform based on the Laravel PHP Framework. | High (8.2) | — | ✅ |
| CVE-2021-27137 — An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. | High (8.1) | — | ✅ |
| CVE-2021-44207 — CVE ID: CVE-2021-44207, CWE: CWE-798, Attack Vector: NETWORK, CVSS: 8.1 | High (8.1) | — | ✅ |
| CVE-2021-22205 — CVE ID: CVE-2021-22205, CWE: CWE-94, Type: RCE, Attack Vector: NETWORK, CVSS: 10.0 | Unrated | — | ✅ |
| CVE-2021-22893 — CVE ID: CVE-2021-22893, CWE: CWE-287, Attack Vector: NETWORK, CVSS: 10.0 | Unrated | — | ✅ |
| CVE-2021-26411 — CVE ID: CVE-2021-26411, CWE: CWE-416, Attack Vector: NETWORK, CVSS: 8.8 | Unrated | — | ✅ |
| CVE-2021-27876 — CVE ID: CVE-2021-27876, Attack Vector: NETWORK, CVSS: 8.1 | Unrated | — | ✅ |
| CVE-2021-28799 — CVE ID: CVE-2021-28799, CWE: CWE-285, Attack Vector: NETWORK, CVSS: 10.0 | Unrated | — | ✅ |
| CVE-2021-30116 — CVE ID: CVE-2021-30116, CWE: CWE-522, Attack Vector: NETWORK, CVSS: 10.0 | Unrated | — | ✅ |
| CVE-2021-3129 — CVE ID: CVE-2021-3129, Attack Vector: NETWORK, CVSS: 9.8 | Unrated | — | ✅ |
| CVE-2021-34527 — CVE ID: CVE-2021-34527, Attack Vector: NETWORK, CVSS: 8.8 | Unrated | — | ✅ |
| CVE-2021-38163 — CVE ID: CVE-2021-38163, CWE: CWE-22, Type: PATH_TRAVERSAL, Attack Vector: NETWORK, CVSS:… | Unrated | — | ✅ |
| CVE-2021-39226 — CVE ID: CVE-2021-39226, CWE: CWE-287, Type: RCE, Attack Vector: NETWORK, CVSS: 9.8 | Unrated | — | ✅ |
| CVE-2021-44529 — CVE ID: CVE-2021-44529, CWE: CWE-94, Type: RCE, Attack Vector: NETWORK, CVSS: 9.8 | Unrated | — | ✅ |
| CVE-2021-45382 — CVE ID: CVE-2021-45382, CWE: CWE-78, Type: RCE, Attack Vector: NETWORK, CVSS: 9.8 | Unrated | — | ✅ |