Archive
24 August 2021
Vulnerabilities first published on this day (UTC), newest first.
38 results · Clear filters · Feed
-
High 8.1CVE-2021-39156 Public exploit
Fragments in Path May Lead to Authorization Policy Bypass
Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitabl…
-
High 8.3
Authorization Policy Bypass Due to Case Insensitive Host Comparison
Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. According to [RFC 4343](https://datatracker.ietf.org/doc/html/rfc4343), Istio aut…
-
High 8.6
Incorrect handling of H/2 GOAWAY followed by SETTINGS frames
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions Envoy transitions a H/2 connection to the CLOSED state when it receives a GOAWAY frame without any streams outstanding. The c…
-
High 8.6
Continued processing of requests after locally generated response
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when loca…
-
High 8.6
Incorrectly handling of URI '#fragment' element as part of the path element
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the path element. Envoy is configured with an RBAC filter for …
-
High 8.6
Incorrect concatenation of multiple value request headers in ext-authz extension
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value header…
-
High 7.5CVE-2021-31010 Exploited
A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Cata…
KEV Aug 25, 2022 -
High 7.8CVE-2021-30983 Exploited
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 15.2 and iPadOS 15.2. A…
KEV Jun 27, 2022 -
High 8.8CVE-2021-30952 Exploited
An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1…
KEV Mar 5, 2026 -
High 7.8CVE-2021-30900 Exploited
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.8.1 and iPadOS …
KEV Mar 30, 2023 -
High 7.8
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.0.2 and iPadOS 15.…
KEV May 23, 2022 -
High 7.8CVE-2021-30869 Exploited
A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 12.5.5, iOS 14.4 and iPad…
KEV Nov 3, 2021 -
High 7.8
An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catal…
KEV Nov 3, 2021 -
High 8.8
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, …
KEV Nov 3, 2021 -
High 7.8
Creative Cloud Desktop installer Uncontrolled Search Path element could lead to arbitrary code execution
Adobe Creative Cloud Desktop Application (installer) version 2.4 (and earlier) is affected by an Uncontrolled Search Path Element vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context o…
-
High 7.8
Adobe Animate heap corruption vulnerability could lead to arbitrary code execution
Adobe Animate version 21.0.6 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this is…
-
High 7.8
Adobe Animate BMP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe Animate version 21.0.6 (and earlier) is affected by an Out-of-bounds Write vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue re…
-
High 7.8
Adobe Animate heap corruption vulnerability could lead to arbitrary code execution
Adobe Animate version 21.0.6 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this is…
-
High 7.8
Adobe Animate FLA File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Adobe Animate version 21.0.6 (and earlier) is affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue req…
-
High 7.5
Improper Handling of Exceptional Conditions in detect-character-encoding
detect-character-encoding is an open source character encoding inspection library. In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash. The problem has been patched in [detect-character-encoding v0.7.0…
-
High 7.8
Adobe After Effects heap corruption vulnerability could lead to arbitrary code execution
Adobe After Effects version 18.2 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of…
-
High 7.8
Adobe After Effects heap corruption vulnerability could lead to arbitrary code execution
Adobe After Effects version 18.2 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of…
-
High 7.8
Adobe After Effects heap corruption vulnerability could lead to arbitrary code execution
Adobe After Effects version 18.2 (and earlier) is affected by a heap corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the curren…
-
High 7.8
Adobe After Effects Stack Overflow vulnerability could lead to arbitrary code execution
Adobe After Effects version 18.2 (and earlier) is affected by a Stack-based Buffer Overflow vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context o…
-
High 7.8
Adobe After Effects memory corruption could lead to arbitrary code execution
Adobe After Effects version 18.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the curr…
-
High 7.8
Adobe After Effects Memory corruption could lead to code execution vulnerability
Adobe After Effects version 18.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the curr…
-
High 7.8
Adobe After Effects heap corruption vulnerability could lead to arbitrary code execution
Adobe After Effects version 18.2 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of…
-
High 7.8
Adobe After Effects heap corruption vulnerability could lead to arbitrary code execution
Adobe After Effects version 18.2 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of…
-
High 7.8
Adobe Acrobat Reader DC AcroForm Field Use-After-Free Remote Code Execution Vulnerability
Acrobat Reader DC versions versions 2021.001.20155 (and earlier), 2020.001.30025 (and earlier) and 2017.011.30196 (and earlier) are affected by an Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary…
-
High 7.8
Adobe Acrobat Pro DC JPEG2000 Editing Out-Of-Bounds Read Remote Code Execution Vulnerability
Acrobat Reader DC versions versions 2021.001.20155 (and earlier), 2020.001.30025 (and earlier) and 2017.011.30196 (and earlier) are affected by an Out-of-bounds read vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbit…
-
High 7.8
Adobe Acrobat Reader DC XFA Template Use-After-Free Remote Code Execution Vulnerability
Acrobat Reader DC versions versions 2021.001.20155 (and earlier), 2020.001.30025 (and earlier) and 2017.011.30196 (and earlier) are affected by an Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary…
-
High 7.8
ZDI-CAN-13471: Adobe Acrobat Reader DC AcroForm Field Use-After-Free Remote Code Execution Vulnerability
Acrobat Reader DC versions versions 2021.001.20155 (and earlier), 2020.001.30025 (and earlier) and 2017.011.30196 (and earlier) are affected by an Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary…
-
High 7.8CVE-2021-28554 EPSS 46%
Adobe Acrobat Reader DC Path Parsing Out-Of-Bounds Read could lead to arbitrary code execution
Acrobat Reader DC versions versions 2021.001.20155 (and earlier), 2020.001.30025 (and earlier) and 2017.011.30196 (and earlier) are affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbit…
-
High 7.4
Read buffer overruns processing ASN.1 strings
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string dat…
-
High 8.8CVE-2021-38556 EPSS 13%
Command Injection in RaspAP 2.6.6
includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.
-
High 8.8
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrit…
-
High 7.5
Directory Traversal
All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization.
-
High 8.1
Remote Code Execution (RCE)
This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintaine…