cve.bz

Matching records, newest first, page 21

Filter
  1. 9.8CVE-2021-32030KEVExploitEPSS 99.3%

    The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access …

  2. 9.8CVE-2021-1498KEVExploitEPSS >99.9%

    Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerab…

  3. 9.8CVE-2021-1497KEVExploitEPSS >99.9%

    Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerab…

  4. 7.8CVE-2021-21551KEVExploitEPSS 80%

    Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.

  5. 9.8CVE-2021-20090KEVExploitEPSS >99.9%

    A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.

  6. 8.8CVE-2021-21224KEVEPSS 84%

    Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

  7. 8.8CVE-2021-21220KEVExploitEPSS 70%

    Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

  8. 8.8CVE-2021-21206KEVEPSS 9.3%

    Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

  9. 10.0CVE-2021-22205KEVExploitEPSS 99.7%

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

  10. 7.8CVE-2021-22204KEVExploitEPSS >99.9%

    Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

  11. 10.0CVE-2021-22893KEVEPSS 47%

    Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated…

  12. 4.9CVE-2021-20023KEVEPSS 52%

    SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.

  13. 7.8CVE-2021-3493KEVExploitEPSS 49%

    The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along…

  14. 9.8CVE-2020-2509KEVEPSS 34%

    A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the …

  15. 7.8CVE-2021-28310KEVEPSS 8.4%

    Win32k Elevation of Privilege Vulnerability

  16. 7.2CVE-2021-20022KEVEPSS 17%

    SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.

  17. 9.8CVE-2021-20021KEVExploitEPSS 89%

    A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.

  18. 6.1CVE-2021-1879KEVEPSS 7.1%

    This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing maliciously crafted web content may lead to universal cross site scripting. App…

  19. 9.8CVE-2021-1871KEVEPSS 7.0%

    A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitra…

  20. 9.8CVE-2021-1870KEVEPSS 7.7%

    A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitra…

  21. 8.8CVE-2021-1789KEVEPSS 14%

    A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0…

  22. 7.0CVE-2021-1782KEVEPSS 2.2%

    A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application …

  23. 9.8CVE-2021-22991KEVEPSS 62%

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Micr…

  24. 7.5CVE-2021-21975KEVExploitEPSS 78%

    Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal a…

  25. 9.8CVE-2021-22986KEVExploitEPSS 99.8%

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an un…

  26. 6.7CVE-2021-25372KEVEPSS 0.8%

    An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.

  27. 6.7CVE-2021-25371KEVEPSS 0.8%

    A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.

  28. 4.4CVE-2021-25370KEVEPSS 0.9%

    An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.

  29. 5.5CVE-2021-25369KEVEPSS 1.1%

    An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace.

  30. 7.5CVE-2021-22506KEVEPSS 26%

    Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage.

  31. 8.8CVE-2021-21193KEVEPSS 10.0%

    Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

  32. 8.8CVE-2021-27085KEVEPSS 5.4%

    Internet Explorer Remote Code Execution Vulnerability

  33. 7.6CVE-2021-27059KEVEPSS 6.1%

    Microsoft Office Remote Code Execution Vulnerability

  34. 8.8CVE-2021-26411KEVEPSS 82%

    Internet Explorer Memory Corruption Vulnerability

  35. 8.8CVE-2021-21166KEVEPSS 24%

    Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

  36. 7.1CVE-2021-25337KEVEPSS 2.8%

    Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.

  37. 9.8CVE-2021-22681KEVEPSS 64%

    Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: Contr…

  38. 7.8CVE-2021-27065KEVExploitEPSS 99.8%

    Microsoft Exchange Server Remote Code Execution Vulnerability

  39. 7.8CVE-2021-26858KEVEPSS 94%

    Microsoft Exchange Server Remote Code Execution Vulnerability

  40. 7.8CVE-2021-26857KEVEPSS 96%

    Microsoft Exchange Server Remote Code Execution Vulnerability

  41. 9.1CVE-2021-26855KEVExploitEPSS >99.9%

    Microsoft Exchange Server Remote Code Execution Vulnerability

  42. 8.8CVE-2021-27878KEVExploitEPSS 24%

    An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability i…

  43. 9.8CVE-2021-27877KEVExploitEPSS 65%

    An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet be…

  44. 8.1CVE-2021-27876KEVExploitEPSS 14%

    An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability i…

  45. 7.8CVE-2021-1732KEVExploitEPSS 78%

    Windows Win32k Elevation of Privilege Vulnerability

  46. 5.3CVE-2021-21973KEVExploitEPSS 88%

    The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a PO…

  47. 9.8CVE-2021-21972KEVExploitEPSS 99.8%

    The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlyi…

  48. 9.8CVE-2021-27104KEVEPSS 57%

    Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.

  49. 9.8CVE-2021-27103KEVEPSS 11%

    Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.

  50. 7.8CVE-2021-27102KEVEPSS 3.7%

    Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.