Archive
July 2021
Vulnerabilities first published in this month (UTC), newest first.
358 results · Clear filters · Feed
-
Medium 5.3
An issue was discovered in Arm Mbed TLS before 2.23.0. Because of a side channel in modular exponentiation, an RSA priv…
-
Medium 5.0
Archive package allows chmod of file outside of unpack target directory
containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes…
-
Medium 6.4
A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to eleva…
-
Medium 6.8
Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could…
-
Medium 6.7
A potential vulnerability in the system shutdown SMI callback function in some ThinkPad models may allow an attacker wi…
-
Medium 5.7
Windows Hello Security Feature Bypass Vulnerability
Windows Hello Security Feature Bypass Vulnerability
-
Medium 5.5
Windows Remote Access Connection Manager Information Disclosure Vulnerability
Windows Remote Access Connection Manager Information Disclosure Vulnerability
-
Medium 5.5
Windows Remote Access Connection Manager Information Disclosure Vulnerability
Windows Remote Access Connection Manager Information Disclosure Vulnerability
-
Medium 5.3
Microsoft Office Online Server Spoofing Vulnerability
Microsoft Office Online Server Spoofing Vulnerability
-
Medium 6.8
Scripting Engine Memory Corruption Vulnerability
Scripting Engine Memory Corruption Vulnerability
KEV Nov 3, 2021 -
Medium 6.8
Windows MSHTML Platform Remote Code Execution Vulnerability
Windows MSHTML Platform Remote Code Execution Vulnerability
-
Medium 6.5
Windows DNS Server Denial of Service Vulnerability
Windows DNS Server Denial of Service Vulnerability
-
Medium 5.5
GDI+ Information Disclosure Vulnerability
GDI+ Information Disclosure Vulnerability
-
Medium 5.3
IBM QRadar SIEM 7.3 and 7.4 uses less secure methods for protecting data in transit between hosts when encrypt host con…
-
Medium 5.9
IBM InfoSphere Data Replication 11.4 and IBM InfoSphere Change Data Capture for z/OS 10.2.1, under certain configuratio…
-
Medium 6.5
IBM InfoSphere Master Data Management Server 11.6 is vulnerable to cross-site request forgery which could allow an atta…
-
Medium 5.4CVE-2021-28114 EPSS 52%
Cross-site Scripting in Froala WYSIWYG Editor
Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.
-
Medium 6.5
An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-3040 1.13B03. A specially craf…
-
Medium 5.3
Open Redirect in medialize/URI.js
URI.js is vulnerable to URL Redirection to Untrusted Site
-
Medium 6.1
Possible RCE vulnerability in mailing action using mailutils (mail-whois)
fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 through 0.11.2, there is a vulnerability that leads to possible remote code execution in the mailing action mail-whois.…
-
Medium 6.1
Junos OS: QFX10K Series: Denial of Service (DoS) upon receipt of DVMRP packets received on multi-homing ESI in VXLAN.
A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) of Juniper Networks Junos OS on the QFX10K Series switches allows an attacker to trigger a packet forwarding loop, leading to a partial Denial of Service (DoS). The issue is caused by D…
-
Medium 5.3
Junos OS: QFX5000 Series and EX4600 Series: Enhanced storm control might not work leading to partial Denial of Service
A vulnerability in Juniper Networks Junos OS, which only affects the release 18.4R2-S5, where a function is inconsistently implemented on Juniper Networks Junos QFX5000 Series and EX4600 Series, and if "storm-control enhanced" is configured, can lead to the e…
-
Medium 5.5
Junos OS: Out-of-memory condition and crashes can occur after executing a certain CLI command repeatedly
A vulnerability in Juniper Networks Junos OS caused by Missing Release of Memory after Effective Lifetime leads to a memory leak each time the CLI command 'show system connections extensive' is executed. The amount of memory leaked on each execution depends o…
-
Medium 6.5
Junos OS Evolved: Memory leak in arpd or ndp processes can lead to Denial of Service (DoS)
An Uncontrolled Resource Consumption vulnerability in the ARP daemon (arpd) and Network Discovery Protocol (ndp) process of Juniper Networks Junos OS Evolved allows a malicious attacker on the local network to consume memory resources, ultimately resulting in…
-
Medium 6.5
Junos OS and Junos OS Evolved: A vulnerability allows a network based unauthenticated attacker which sends a high rate of specific traffic to cause a partial Denial of Service
An Exposure of System Data vulnerability in Juniper Networks Junos OS and Junos OS Evolved, where a sensitive system-level resource is not being sufficiently protected, allows a network-based unauthenticated attacker to send specific traffic which partially r…
-
Medium 6.5
Junos OS: MX Series, EX9200 Series, SRX4600: Ethernet interface vulnerable to specially crafted frames
Improper Handling of Exceptional Conditions in Ethernet interface frame processing of Juniper Networks Junos OS allows an attacker to send specially crafted frames over the local Ethernet segment, causing the interface to go into a down state, resulting in a …
-
Medium 6.5
Junos OS: User-defined ARP Policer isn't applied on Aggregated Ethernet (AE) interface until firewall process is restarted
When user-defined ARP Policer is configured and applied on one or more Aggregated Ethernet (AE) interface units, a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability between the Device Control Daemon (DCD) and firewall process (dfwd) daemons of J…
-
Medium 6.5
Junos OS: MX Series, EX9200 Series: FPC may crash upon receipt of specific MPLS packet affecting Trio-based MPCs
A vulnerability in the processing of specific MPLS packets in Juniper Networks Junos OS on MX Series and EX9200 Series devices with Trio-based MPCs (Modular Port Concentrators) may cause FPC to crash and lead to a Denial of Service (DoS) condition. Continued …
-
Medium 6.5
Junos OS and Junos OS Evolved: RPD could crash in SR-ISIS/MPLS environment due to a flap of an ISIS link in the network
In a Segment Routing ISIS (SR-ISIS)/MPLS environment, on Juniper Networks Junos OS and Junos OS Evolved devices, configured with ISIS Flexible Algorithm for Segment Routing and sensor-based statistics, a flap of a ISIS link in the network, can lead to a routi…
-
Medium 5.9
Junos OS and Junos OS Evolved: Specific packets can trigger rpd crash when BGP Origin Validation is configured with RPKI
On Juniper Networks Junos OS devices configured with BGP origin validation using Resource Public Key Infrastructure (RPKI) receipt of a specific packet from the RPKI cache server may cause routing process daemon (RPD) to crash and restart, creating a Denial o…
-
Medium 6.6
IBM Security Verify Access Docker 10.0.0 could allow a remote priviled user to upload arbitrary files with a dangerous …
-
Medium 6.5
IBM Security Verify Access Docker 10.0.0 contains hard-coded credentials, such as a password or cryptographic key, whic…
-
Medium 4.5
IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to conduct phishing attacks, using an open redir…
-
Medium 4.8
IBM Security Verify Access Docker 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embe…
-
Medium 5.2
IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to traverse directories on the system. An attack…
-
Medium 6.8
IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by a local user.…
-
Medium 4.4
IBM Security Verify Access Docker 10.0.0 could reveal highly sensitive information to a local privileged user. IBM X-Fo…
-
Medium 5.3
IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further att…
-
Medium 5.9
IBM Security Verify Access Docker 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacke…
-
Medium 5.3
Encoded URIs can access WEB-INF directory in Eclipse Jetty
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reporte…