CVE 2021 document archive · 19
Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →
2,160 documents · Identifier year 2021 · 19 / 44
- CVE-2021-42252kernel: memory overwrite in the kernel with potential privileges execution
- CVE-2021-42114hw: dram: new non-uniform circumvent TRR to induce bit flips via Rowhammer
- CVE-2021-42097mailman: CSRF token bypass allows to perform CSRF attacks and account takeover
- CVE-2021-42096mailman: CSRF token derived from admin password allows offline brute-force attack
- CVE-2021-42013httpd: path traversal and remote code execution (incomplete fix of CVE-2021-41773)
- CVE-2021-42008kernel: slab out-of-bounds write in decode_data() in drivers/net/hamradio/6pack.c
- CVE-2021-41991strongswan: integer overflow when replacing certificates in cache
- CVE-2021-41990strongswan: gmp plugin: integer overflow via a crafted certificate with an RSASSA-PSS signature
- CVE-2021-41864kernel: eBPF multiplication integer overflow in prealloc_elems_and_freelist() in kernel/bpf/stackmap.c leads to out-of-bounds write
- CVE-2021-41819ruby: Cookie prefix spoofing in CGI::Cookie.parse
- CVE-2021-41817ruby: Regular expression denial of service vulnerability of Date parsing methods
- CVE-2021-41816ruby: buffer overflow in CGI.escape_html
- CVE-2021-41773httpd: path traversal and file disclosure vulnerability
- CVE-2021-41772golang: archive/zip: Reader.Open panics on empty string
- CVE-2021-41771golang: debug/macho: invalid dynamic symbol table command can cause panic
- CVE-2021-41617openssh: privilege escalation when AuthorizedKeysCommand or AuthorizedPrincipalsCommand are configured
- CVE-2021-41611squid: improper certificate validation
- CVE-2021-41524httpd: NULL pointer dereference via crafted request during HTTP/2 request processing
- CVE-2021-41496numpy: buffer overflow in the array_from_pyobj() in fortranobject.c
- CVE-2021-41495numpy: NULL pointer dereference in numpy.sort in in the PyArray_DescrNew() due to missing return-value validation
- CVE-2021-41355dotnet: System.DirectoryServices.Protocols.LdapConnection sends credentials in plaintext if TLS handshake fails
- CVE-2021-41244grafana: Incorrect access control in fine-grained access control feature
- CVE-2021-41229bluez: memory leak in the SDP protocol
- CVE-2021-41190opencontainers: OCI manifest and index parsing confusion
- CVE-2021-41184jquery-ui: XSS in the 'of' option of the .position() util
- CVE-2021-41183jquery-ui: XSS in *Text options of the datepicker widget
- CVE-2021-41182jquery-ui: XSS in the altField option of the datepicker widget
- CVE-2021-41174grafana: XSS vulnerability on unauthenticated pages through interpolation binding expressions for AngularJS in URL
- CVE-2021-41160freerdp: improper region checks in all clients allow out of bound write to memory
- CVE-2021-41159freerdp: improper client input validation for gateway connections allows to overwrite memory
- CVE-2021-41133flatpak: Sandbox bypass via recent VFS-manipulating syscalls
- CVE-2021-41099redis: Integer overflow issue with strings
- CVE-2021-41092docker: cli leaks private registry credentials to registry-1.docker.io
- CVE-2021-41091moby: data directory contains subdirectories with insufficiently restricted permissions, which could lead to directory traversal
- CVE-2021-41089moby: `docker cp` allows unexpected chmod of host file
- CVE-2021-41079tomcat: Infinite loop while reading an unexpected TLS packet when using OpenSSL JSSE engine
- CVE-2021-41073kernel: local user privilege escalation via loop_rw_iter in fs/io_uring.c
- CVE-2021-41072squashfs-tools: possible Directory Traversal via symbolic link
- CVE-2021-41043tcpslice: use-after-free in extract_slice()
- CVE-2021-41041java-11-openj9,java-1_8_0-openj9: unverified methods can be invoked using MethodHandles
- CVE-2021-41035JDK: IllegalAccessError exception not thrown for MethodHandles that invoke inaccessible interface methods
- CVE-2021-40528libgcrypt: ElGamal implementation allows plaintext recovery
- CVE-2021-40490kernel: race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem
- CVE-2021-40438httpd: mod_proxy: SSRF via a crafted request uri-path containing "unix:"
- CVE-2021-40426sox: heap-based buffer overflow vulnerability exists in the sphere.c start_read() function
- CVE-2021-40346haproxy: request smuggling attack or response splitting via duplicate content-length header
- CVE-2021-40330git: unexpected cross-protocol requests via a repository path containing a newline character
- CVE-2021-40325cobbler: Authorization bypass allows modifying settings
- CVE-2021-40324cobbler: Arbitrary file write via upload_log_data XMLRPC function
- CVE-2021-40323cobbler: Arbitrary File Disclosure/Template Injection via generate_script RPC method