cve.bz

Matching records, newest first, page 19

Filter
  1. 7.3CVE-2021-39226KEVExploitEPSS >99.9%

    Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /ap…

  2. 9.8CVE-2021-41773KEVExploitEPSS >99.9%

    A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these…

  3. 6.5CVE-2021-20035KEVEPSS 4.4%

    Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.

  4. 7.5CVE-2021-40655KEVExploitEPSS 87%

    An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page

  5. 9.8CVE-2021-22941KEVEPSS 54%

    Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller.

  6. 5.3CVE-2021-22017KEVExploitEPSS 49%

    Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to interna…

  7. 9.8CVE-2021-22005KEVExploitEPSS >99.9%

    The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specia…

  8. 9.8CVE-2021-36260KEVExploitEPSS 99.8%

    A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious co…

  9. 7.8CVE-2021-38406KEVEPSS 76%

    Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerab…

  10. 9.0CVE-2021-40438KEVExploitEPSS >99.9%

    A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

  11. 9.8CVE-2021-33045KEVExploitEPSS 99.5%

    The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

  12. 9.8CVE-2021-33044KEVExploitEPSS >99.9%

    The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

  13. 8.8CVE-2021-40444KEVExploitEPSS 98%

    Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Of…

  14. 7.0CVE-2021-38649KEVEPSS 2.9%

    Open Management Infrastructure Elevation of Privilege Vulnerability

  15. 7.8CVE-2021-38648KEVExploitEPSS 11%

    Open Management Infrastructure Elevation of Privilege Vulnerability

  16. 9.8CVE-2021-38647KEVExploitEPSS >99.9%

    Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

  17. 7.8CVE-2021-38646KEVEPSS 8.0%

    Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

  18. 7.8CVE-2021-38645KEVEPSS 2.7%

    Open Management Infrastructure Elevation of Privilege Vulnerability

  19. 7.8CVE-2021-36955KEVEPSS 4.1%

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

  20. 8.8CVE-2021-38163KEVEPSS 37%

    SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable o…

  21. 9.8CVE-2021-40870KEVExploitEPSS 93%

    An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.

  22. 7.8CVE-2021-30713KEVEPSS 7.0%

    A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exp…

  23. 8.8CVE-2021-30666KEVEPSS 3.0%

    A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have be…

  24. 8.8CVE-2021-30665KEVEPSS 3.7%

    A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to…

  25. 8.8CVE-2021-30663KEVEPSS 3.5%

    An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbit…

  26. 8.8CVE-2021-30661KEVEPSS 4.5%

    A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously crafted web content may lead…

  27. 5.5CVE-2021-30657KEVExploitEPSS 69%

    A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekeeper checks. Apple is aware of a report that this issue may …

  28. 8.8CVE-2021-30762KEVEPSS 11%

    A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have b…

  29. 8.8CVE-2021-30761KEVEPSS 11%

    A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have…

  30. 9.8CVE-2021-40539KEVExploitEPSS 99%

    Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

  31. 8.8CVE-2021-28550KEVEPSS 52%

    Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability t…

  32. 9.8CVE-2021-37415KEVExploitEPSS 99.8%

    Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.

  33. 9.8CVE-2021-26084KEVExploitEPSS >99.9%

    In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions …

  34. 9.1CVE-2021-32648KEVExploitEPSS 91%

    octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. Th…

  35. 7.5CVE-2021-31010KEVEPSS 3.7%

    A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circum…

  36. 7.8CVE-2021-30983KEVEPSS 2.9%

    A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 15.2 and iPadOS 15.2. An application may be able to execute arbitrary code with kernel privileges.

  37. 7.8CVE-2021-30952KEVEPSS 7.0%

    An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary c…

  38. 7.8CVE-2021-30900KEVEPSS 5.2%

    An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.8.1 and iPadOS 14.8.1, iOS 15.1 and iPadOS 15.1. A malicious application may be able to execute arbitrary code with kernel privileges.

  39. 7.8CVE-2021-30883KEVEPSS 15%

    A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.0.2 and iPadOS 15.0.2, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1, macOS Big Sur 11.6.1. An application m…

  40. 7.8CVE-2021-30869KEVEPSS 4.2%

    A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 12.5.5, iOS 14.4 and iPadOS 14.4, macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, Security Update 2021-00…

  41. 7.8CVE-2021-30860KEVEPSS 76%

    An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbit…

  42. 8.8CVE-2021-30858KEVEPSS 13%

    A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a…

  43. 8.5CVE-2021-39144KEVExploitEPSS 98%

    XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stre…

  44. 9.8CVE-2021-35395KEVExploitEPSS 98%

    Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface exists: one based on Go-Ahead named webs a…

  45. 9.8CVE-2021-35394KEVExploitEPSS 99.8%

    Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command inje…

  46. 5.3CVE-2021-26086KEVExploitEPSS >99.9%

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8…

  47. 9.8CVE-2021-36380KEVExploitEPSS 98%

    Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi.

  48. 7.8CVE-2021-36948KEVEPSS 23%

    Windows Update Medic Service Elevation of Privilege Vulnerability

  49. 7.5CVE-2021-36942KEVExploitEPSS 66%

    Windows LSA Spoofing Vulnerability

  50. 7.8CVE-2021-34486KEVEPSS 9.3%

    Windows Event Tracing Elevation of Privilege Vulnerability