Archive
5 August 2021
Vulnerabilities first published on this day (UTC), newest first.
93 results · Feed
-
Unscored —CVE-2021-3679 Public exploit
A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the …
-
Unscored —
A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping…
-
Unscored —
ZTE's big video business platform has two reflective cross-site scripting (XSS) vulnerabilities. Due to insufficient in…
-
Unscored —
A ZTE's product of the transport network access layer has a security vulnerability. Because the system does not suffici…
-
Unscored —
If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses pr…
-
Unscored —
A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. *Thi…
-
Unscored —
If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host - irrespecti…
-
Unscored —
A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library. Updating the library …
-
Unscored —
Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This was corrected …
-
Unscored —
When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page woul…
-
Unscored —
Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or forma…
-
Unscored —
Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bu…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence of memory corr…
-
Unscored —
Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd p…
-
Unscored —
Improper access control vulnerability in Smart Touch Call prior to version 1.0.0.5 allows arbitrary webpage loading in …
-
Unscored —
Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause …
-
Unscored —
Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause …
-
Unscored —
Unprotected component vulnerability in Samsung Internet prior to version 14.2 allows untrusted application to access in…
-
Unscored —
An IV reuse vulnerability in keymaster prior to SMR AUG-2021 Release 1 allows decryption of custom keyblob with privile…
-
Unscored —
A use after free vulnerability in conn_gadget driver prior to SMR AUG-2021 Release 1 allows malicious action by an atta…
-
High 7.1
Reflected XSS in OAuth Flow
Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost.
-
Low 3.5
Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the SAVAPI component used in certain F-Secure products can crash while scanning fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will resu…
-
High 8.8
NewsPlugin <= 1.0.18 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handle_save_style function found in the ~/news-plugin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.18.
-
Critical 9.8
Deserialization of Untrusted Data in Neo4j
Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadg…
-
Unscored —
In certain Progress MOVEit Transfer versions before 2021.0.3 (aka 13.0.3), SQL injection in the MOVEit Transfer web app…
-
High 8.7
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a st…
-
Low 3.5
Fake Apple login prompt in F-Secure SAFE browser for iOS
Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit domain. Exploiting the vulnerability requires the user to click on a specially crafted, seemingly legi…
-
Medium 4.2
Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign o…
-
High 7.5
Cross Site Request Forgery (CSRF) vulnerability in web based management interface
A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link …
-
Unscored —
Acronis True Image prior to 2021 Update 5 for Windows allowed local privilege escalation due to insecure folder permiss…
-
Unscored —
Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac, Acronis Agent…
-
Unscored —
Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link hand…
-
Unscored —
An issue was discovered in GPAC 1.0.1. There is a heap-based buffer overflow in the function gp_rtp_builder_do_tx3g fun…
-
Unscored —
An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the AP4_DescriptorFinder::Te…
-
Unscored —
An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the function AP4_StszAtom::W…
-
Unscored —
Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link hand…
-
Unscored —
Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to DLL hijacking.
-
Unscored —
Acronis True Image prior to 2021 Update 4 for Windows and Acronis True Image prior to 2021 Update 5 for macOS allowed a…
-
High 7.5
Incorrect Check of Function Return Value in Skytable
Skytable is an open source NoSQL database. In versions prior to 0.6.4 an incorrect check of return value of the accept function in the run-loop for a TCP socket/TLS socket/TCP+TLS multi-socket causes an early exit from the run loop that should continue infini…
-
Medium —
Arbitrary Command Injection due to Improper Command Sanitization
### Summary There exists a command injection vulnerability in `npmcli/git` versions <2.0.8 which may result in arbitrary shell command execution due to improper argument sanitization when `npmcli/git` is used to execute Git commands based on user controlled i…