CVE Vulnerability Database
Search and browse 394,712 CVE records with CVSS scores, EPSS exploit predictions, CISA KEV status and whether the Vulnix engine has a detection for them.
20,149 records from 2021Clear filters
- CVE-2021-24753High 7.2Dec 27, 2021The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue
- CVE-2021-45711High 7.5Dec 27, 2021An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.
- CVE-2021-45710High 8.1Dec 27, 2021An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption.
- CVE-2021-45709Critical 9.8Dec 27, 2021An issue was discovered in the crypto2 crate through 2021-10-08 for Rust. During Chacha20 encryption and decryption, an unaligned read of a u32 may occur.
- CVE-2021-45708High 7.5Dec 27, 2021An issue was discovered in the abomonation crate through 2021-10-17 for Rust. Because transmute operations are insufficiently constrained, there can be an information leak or ASLR bypass.
- CVE-2021-45707Critical 9.8Dec 27, 2021An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an out-of-bounds write if a user is in more than 16 /etc/groups groups.
- CVE-2021-45706Critical 9.8Dec 27, 2021An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
- CVE-2021-45705Critical 9.8Dec 27, 2021An issue was discovered in the nanorand crate before 0.6.1 for Rust. There can be multiple mutable references to the same object because the TlsWyRand Deref implementation dereferences a raw pointer.
- CVE-2021-45704High 8.1Dec 27, 2021An issue was discovered in the metrics-util crate before 0.7.0 for Rust. There is a data race and memory corruption because AtomicBucket<T> unconditionally implements the Send and Sync traits.
- CVE-2021-45703Critical 9.8Dec 27, 2021An issue was discovered in the tectonic_xdv crate before 0.1.12 for Rust. XdvParser::<T>::process may read from uninitialized memory locations.
- CVE-2021-45702High 7.5Dec 27, 2021An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A merge operation may result in a use-after-free.
- CVE-2021-45701Critical 9.8Dec 27, 2021An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A patch operation may result in a use-after-free.
- CVE-2021-45700High 7.5Dec 27, 2021An issue was discovered in the ckb crate before 0.40.0 for Rust. Attackers can cause a denial of service (Nervos CKB blockchain node crash) via a dead call that is used as a DepGroup.
- CVE-2021-45699High 7.5Dec 27, 2021An issue was discovered in the ckb crate before 0.40.0 for Rust. Remote attackers may be able to conduct a 51% attack against the Nervos CKB blockchain by triggering an inability to allocate memory for the misbehavior HashMap.
- CVE-2021-45698Critical 9.8Dec 27, 2021An issue was discovered in the ckb crate before 0.40.0 for Rust. A get_block_template RPC call may fail in situations where it is supposed to select a Nervos CKB blockchain transaction with a higher fee rate than another transaction.
- CVE-2021-45697Critical 9.8Dec 27, 2021An issue was discovered in the molecule crate before 0.7.2 for Rust. A FixVec partial read has an incorrect result.
- CVE-2021-45696Critical 9.8Dec 27, 2021An issue was discovered in the sha2 crate 0.9.7 before 0.9.8 for Rust. Hashes of long messages may be incorrect when the AVX2-accelerated backend is used.
- CVE-2021-45695Critical 9.8Dec 27, 2021An issue was discovered in the mopa crate through 2021-06-01 for Rust. It incorrectly relies on Trait memory layout, possibly leading to future occurrences of arbitrary code execution or ASLR bypass.
- CVE-2021-45694High 7.5Dec 27, 2021An issue was discovered in the rdiff crate through 2021-02-03 for Rust. Window may read from uninitialized memory locations.
- CVE-2021-45693Critical 9.8Dec 27, 2021An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string_primitive may read from uninitialized memory locations.
- CVE-2021-45692Critical 9.8Dec 27, 2021An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_extension_others may read from uninitialized memory locations.
- CVE-2021-45691Critical 9.8Dec 27, 2021An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string may read from uninitialized memory locations.
- CVE-2021-45690Critical 9.8Dec 27, 2021An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_binary may read from uninitialized memory locations.
- CVE-2021-45689Critical 9.8Dec 27, 2021An issue was discovered in the gfx-auxil crate through 2021-01-07 for Rust. gfx_auxil::read_spirv may read from uninitialized memory locations.
- CVE-2021-45688Critical 9.8Dec 27, 2021An issue was discovered in the ash crate before 0.33.1 for Rust. util::read_spv may read from uninitialized memory locations.