Archive
October 2021
Vulnerabilities first published in this month (UTC), newest first.
18 results · Clear filters · Feed
-
Critical 9.8
BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code executio…
KEV Nov 3, 2021 -
High 7.8
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS…
KEV Nov 3, 2021 -
Critical 9.8
Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI,…
KEV Nov 3, 2021 -
High 7.5
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the …
KEV Sep 3, 2024 -
High 7.5
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the …
KEV Sep 3, 2024 -
High 7.8CVE-2021-41357 Exploited
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
KEV Apr 25, 2022 -
High 7.8CVE-2021-40450 Exploited
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
KEV Apr 25, 2022 -
High 7.8
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
KEV Nov 17, 2021 -
Medium 6.5
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain poten…
KEV Nov 3, 2021 -
Critical 9.6
Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the rend…
KEV Nov 3, 2021 -
Critical 9.6
Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised t…
KEV Nov 3, 2021 -
High 8.8
Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap …
KEV Nov 3, 2021 -
High 8.8
Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corru…
KEV Nov 3, 2021 -
Critical 9.8
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories a…
KEV Nov 3, 2021 -
Low 3.3CVE-2021-25489 Exploited
Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1…
KEV Jun 29, 2023 -
High 7.3CVE-2021-25487 Exploited
Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allow…
KEV Jun 29, 2023 -
Critical 9.8
Snapshot authentication bypass in grafana
Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If…
KEV Aug 25, 2022 -
High 7.5
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not…
KEV Nov 3, 2021