Archive
10 February 2021
Vulnerabilities first published on this day (UTC), newest first.
114 results · Feed
-
Unscored —CVE-2021-0330 Public exploit
In add_user_ce and remove_user_ce of storaged.cpp, there is a possible use-after-free due to improper locking. This cou…
-
Unscored —CVE-2021-0331 Public exploit
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible overlay attack due to an insecure defau…
-
Unscored —CVE-2021-0332 Public exploit
In bootFinished of SurfaceFlinger.cpp, there is a possible memory corruption due to a use after free. This could lead t…
-
Unscored —CVE-2021-0333 Public exploit
In onCreate of BluetoothPermissionActivity.java, there is a possible permissions bypass due to a tapjacking overlay tha…
-
Unscored —CVE-2021-0334 Public exploit
In onTargetSelected of ResolverActivity.java, there is a possible settings bypass allowing an app to become the default…
-
Unscored —
In process of C2SoftHevcDec.cpp, there is a possible out of bounds write due to a use after free. This could lead to re…
-
Unscored —CVE-2021-0336 Public exploit
In onReceive of BluetoothPermissionRequest.java, there is a possible permissions bypass due to a mutable PendingIntent.…
-
Unscored —CVE-2021-0337 Public exploit
In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lea…
-
Unscored —
In SystemSettingsValidators, there is a possible permanent denial of service due to missing bounds checks on UI setting…
-
Unscored —CVE-2021-0302 Public exploit
In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local e…
-
Unscored —
In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local e…
-
Unscored —CVE-2021-0339 Public exploit
In loadAnimation of WindowContainer.java, there is a possible way to keep displaying a malicious app while a target app…
-
Unscored —CVE-2021-0340 Public exploit
In parseNextBox of IsoInterface.java, there is a possible leak of unredacted location information due to improper input…
-
Unscored —
xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fa…
-
Unscored —
An integer overflow has been found in the the latest version of Issuer. The total issuedCount can be zero if the parame…
-
Unscored —
An integer underflow has been found in the latest version of ZCFees. The variables 'currPeriodIdx' and 'lastPeriodExecI…
-
Unscored —
Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One W…
-
Medium 4.8
Stored Cross Site Scripting in ENS
A stored cross site scripting vulnerability in ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 February 2021 Update allows an ENS ePO administrator to add a script to a policy event which will trigger the script to be run through a browser blo…
-
High 8.2CVE-2021-23874 Exploited
McAfee Total Protection (MTP) privilege escalation vulnerability
Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP self-defense.
KEV Nov 3, 2021 -
High 7.8
McAfee Total Protection (MTP) Bypass Remote Procedure call vulnerability
Bypass Remote Procedure call in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and perform arbitrary file modification as the SYSTEM user potentially causing Denial of Service via executing carefully constructed…
-
High 7.8
McAfee Total Protection (MTP) privilege escalation vulnerability
Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and perform arbitrary file deletion as the SYSTEM user potentially causing Denial of Service via manipulating Junction link, a…
-
Medium 4.0
Null Pointer Dereference vulnerability in McAfee Endpoint Security (ENS)
A Null Pointer Dereference vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows a local administrator to cause Windows to crash via a specific system call which is not handled correctly. This varies by machin…
-
High 8.2
Improper Access Control in the ENS installer
Improper Access Control vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows local administrators to prevent the installation of some ENS files by placing carefully crafted files where ENS will be installed. …
-
Medium 6.7
Improper Access Control in the ENS installer
Improper Access Control in attribute in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows authenticated local administrator user to perform an uninstallation of the anti-malware engine via the running of a specific command…
-
High 7.3
Clear text storage of sensitive Information in ENS
Clear text storage of sensitive Information in memory vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows a local user to view ENS settings and credentials via accessing process memory after the ENS administ…
-
Unscored —
Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scri…
-
Low —
Generation of fake documents via public GET-call
### Impact Generation of fake documents via public GET-call ### Patches We recommend to update to the current version 6.3.5.1. You can get the update to 6.3.5.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/…
-
Unscored —
In InoERP 0.7.2, an unauthorized attacker can execute arbitrary code on the server side due to lack of validations in /…
-
Unscored —
Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the …
-
Unscored —
The daemon in GENIVI diagnostic log and trace (DLT), is vulnerable to a heap-based buffer overflow that could allow an …
-
High 7.5
A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially …
-
High 7.5
A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially …
-
Critical 9.8
A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially c…
-
High 7.5
A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially …