Archive
8 September 2021
Vulnerabilities first published on this day (UTC), newest first.
276 results · Feed
-
Unscored —
An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4…
-
Unscored —
A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Saf…
-
Unscored —
This issue was addressed with improved checks. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6, tvOS 1…
-
Unscored —
A logic issue was addressed with improved validation. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, Security Upd…
-
Unscored —
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.5, Secu…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 14.7, macOS …
-
Unscored —
A logic issue was addressed with improved state management. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchO…
-
Unscored —
A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.5. A malicious appl…
-
Unscored —
This issue was addressed with improved checks. This issue is fixed in iOS 14.7. Joining a malicious Wi-Fi network may r…
-
High 7.3
Adobe Creative Cloud Desktop uncontrolled search path element vulnerability could lead to local privilege escalation
Adobe Creative Cloud Desktop 3.5 (and earlier) is affected by an uncontrolled search path vulnerability that could result in elevation of privileges. Exploitation of this issue requires user interaction in that a victim must log on to the attacker's local mac…
-
High 8.8
Medium by Adobe file parsing buffer overflow vulnerability could lead to arbitrary code execution
Medium by Adobe version 2.4.5.331 (and earlier) is affected by a buffer overflow vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve remote code execution in the context of the current user. Expl…
-
High 8.9CVE-2021-35217 EPSS 73%
Insecure Deserialization of untrusted data causing Remote code execution vulnerability.
Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserializat…
-
Unscored —
Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The …
-
Critical 9.8
Possible buffer overflow due to improper validation of device types during P2P search in Snapdragon Auto, Snapdragon Co…
-
Medium 5.5
Possible out of bounds read due to incorrect validation of incoming buffer length in Snapdragon Auto, Snapdragon Comput…
-
Medium 6.2
Lack of strict validation of bootmode can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdr…
-
Medium 4.6
Buffer over read could occur due to incorrect check of buffer size while flashing emmc devices in Snapdragon Connectivi…
-
High 7.8
Incorrect pointer argument passed to trusted application TA could result in un-intended memory operations in Snapdragon…
-
Critical 9.8
Integer underflow can occur due to improper handling of incoming RTCP packets in Snapdragon Auto, Snapdragon Compute, S…
-
Critical 9.8
Integer underflow can occur when the RTCP length is lesser than than the actual blocks present in Snapdragon Auto, Snap…
-
Critical 9.8
Possible buffer underflow due to lack of check for negative indices values when processing user provided input in Snapd…
-
High 7.5
Loop with unreachable exit condition may occur due to improper handling of unsupported input in Snapdragon Auto, Snapdr…
-
Medium 6.2
Child process can leak information from parent process due to numeric pids are getting compared and these pid can be re…
-
Critical 9.1CVE-2020-11301 EPSS 11%
Improper authentication of un-encrypted plaintext Wi-Fi frames in an encrypted network can lead to information disclosu…
-
Critical 9.1CVE-2020-11264 EPSS 13%
Improper authentication of Non-EAPOL/WAPI plaintext frames during four-way handshake can lead to arbitrary network pack…
-
Unscored —
Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulne…
-
Unscored —
SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus a…
-
High 7.6
Cross-site Request Forgery (CSRF)
This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions u…
-
Medium 5.6
An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reus…
-
High 8.8
A Improper neutralization of special elements used in a command ('Command Injection') in Fortinet FortiWeb version 6.3.…
-
High 8.0
A stack-based buffer overflow in Fortinet FortiWeb version 6.3.14 and below, 6.2.4 and below allows attacker to execute…
-
Medium 5.3
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via a…
-
Unscored —
Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys o…
-
Unscored —
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availabil…
-
Medium 6.5
The GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read because of the lack of certain gdGetBuf and…
-
High 7.5
Exposure of Resource to Wrong Sphere in salt
An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.