Archive
May 2021
Vulnerabilities first published in this month (UTC), newest first.
217 results · Clear filters · Feed
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.3…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.3…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.3…
-
High 8.4
Possible use after free due to lack of null check while memory is being freed in FastRPC driver in Snapdragon Auto, Sna…
-
High 7.5
Possible denial of service scenario due to improper handling of group management action frame in Snapdragon Auto, Snapd…
-
High 7.8
Buffer overflow can occur due to improper validation of NDP application information length in Snapdragon Auto, Snapdrag…
-
High 7.3
Double free in video due to lack of input buffer length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connec…
-
High 8.4CVE-2021-1905 Exploited
Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon …
KEV Nov 3, 2021 -
High 8.4
A possible use-after-free occurrence in audio driver can happen when pointers are not properly handled in Snapdragon Au…
-
High 7.8
Out of bound write can occur in TZ command handler due to lack of validation of command ID in Snapdragon Auto, Snapdrag…
-
High 7.8
Out of bound write can occur in playready while processing command due to lack of input validation in Snapdragon Auto, …
-
High 8.4
Locked memory can be unlocked and modified by non secure boot loader through improper system call sequence making the m…
-
High 8.2
Buffer over-read while unpacking the RTCP packet we may read extra byte if wrong length is provided in RTCP packets in …
-
High 7.5
Memory corruption while processing crafted SDES packets due to improper length check in sdes packets recieved in Snapdr…
-
High 7.5
Histogram type KPI was teardown with the assumption of the existence of histogram binning info and will lead to null po…
-
High 7.5
Denial of service in MODEM due to assert to the invalid configuration in Snapdragon Auto, Snapdragon Compute, Snapdrago…
-
High 7.5
Potential UE reset while decoding a crafted Sib1 or SIB1 that schedules unsupported SIBs and can lead to denial of serv…
-
High 7.5
Vault GitHub Action did not correctly mask multi-line secrets in output
HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking.
-
High 8.8
Cross-Site Request Forgery in forkcms
Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication of logged administrators.
-
High —
Unauthorized access through URL manipulation
### Impact The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. ### Patches The vulnerability has been patched in version 1.2.65 of the `master` branch, version 1.1.113 of the 1.1.x series, and …
-
High 8.1
Weak Password Recovery Mechanism for Forgotten Password in Strapi
In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password.
-
High 7.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validat…
-
High 7.5
Cisco SD-WAN Software vDaemon Denial of Service Vulnerability
A vulnerability in the vDaemon process of Cisco SD-WAN Software could allow an unauthenticated, remote attacker to cause a device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient handling of malformed pack…
-
High 8.8
Cisco SD-WAN vManage Software Authentication Bypass Vulnerability
A vulnerability in the web-based messaging service interface of Cisco SD-WAN vManage Software could allow an unauthenticated, adjacent attacker to bypass authentication and authorization and modify the configuration of an affected system. To exploit this vuln…
-
High 7.1
Cisco Unified Communications Manager IM & Presence Service SQL Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities are du…
-
High 7.1
Cisco Unified Communications Manager IM & Presence Service SQL Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities are du…
-
High 8.8
Cisco Small Business 100, 300, and 500 Series Wireless Access Points Vulnerabilities
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to obtain sensitive information from or inject arbitrary commands on a…
-
High 8.8
Cisco Small Business 100, 300, and 500 Series Wireless Access Points Vulnerabilities
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to obtain sensitive information from or inject arbitrary commands on a…
-
High 7.8
Cisco Enterprise NFV Infrastructure Software Command Injection Vulnerability
A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to perform a command injection attack on an affected device. The vulnerability is due to insufficient validation of user-supplied input to a c…
-
High 7.0
Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities
Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to hijack DLL or executable files that are used by the application. A successful expl…
-
High 7.0
Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities
Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to hijack DLL or executable files that are used by the application. A successful expl…
-
High 7.5
Cisco SD-WAN vEdge Software Buffer Overflow Vulnerabilities
Multiple vulnerabilities in Cisco SD-WAN vEdge Software could allow an attacker to execute arbitrary code as the root user or cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details se…
-
High 7.5
Cisco SD-WAN vEdge Software Buffer Overflow Vulnerabilities
Multiple vulnerabilities in Cisco SD-WAN vEdge Software could allow an attacker to execute arbitrary code as the root user or cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details se…
-
High 7.5
Cisco SD-WAN vEdge Software Buffer Overflow Vulnerabilities
Multiple vulnerabilities in Cisco SD-WAN vEdge Software could allow an attacker to execute arbitrary code as the root user or cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details se…
-
High 7.0
Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities
Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to hijack DLL or executable files that are used by the application. A successful expl…
-
High 7.0
Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities
Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to hijack DLL or executable files that are used by the application. A successful expl…
-
High 7.0
Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities
Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to hijack DLL or executable files that are used by the application. A successful expl…
-
High 7.0
Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities
Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to hijack DLL or executable files that are used by the application. A successful expl…
-
High 8.0
Dell EMC Integrated System for Microsoft Azure Stack Hub, versions 1906 – 2011, contain an undocumented default iDRAC a…
-
High 8.8
Command injection in git-parse
The "gitDiff" function in Wayfair git-parse <=1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. The issue has been resolved in ve…