Exploited Vulnerabilities Catalog 2021(179)
H 2023(64) 2022(113) 2021(179) 2020(128)
D-Link | Multiple Routers | D-Link Multiple Routers Remote Code Execution Vulnerability | 2022-04-04 | A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file. | |
Apache | Log4j2 | Apache Log4j2 Deserialization of Untrusted Data Vulnerability | 2023-05-01 | Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations. | |
Zoho | Desktop Central | Zoho Desktop Central Authentication Bypass Vulnerability | 2021-12-10 | Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server. | |
Apache | Log4j2 | Apache Log4j2 Remote Code Execution Vulnerability | 2021-12-10 | Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution. | |
Fortinet | FortiOS | Fortinet FortiOS Arbitrary File Download | 2021-12-10 | Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files. | |
Zoho | ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | 2021-12-01 | Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution | |
Microsoft | Windows | Microsoft Windows AppX Installer Spoofing Vulnerability | 2021-12-15 | Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability. | |
Microsoft | Exchange | Microsoft Exchange Server Remote Code Execution Vulnerability | 2021-11-17 | An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution. | |
Microsoft | Office | Microsoft Excel Security Feature Bypass | 2021-11-17 | A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution. | |
Microsoft | Active Directory | Microsoft Active Directory Domain Services Privilege Escalation Vulnerability | 2022-04-11 | Microsoft Active Directory Domain Services contains an unspecified vulnerability which allows for privilege escalation. | |
Microsoft | Active Directory | Microsoft Active Directory Domain Services Privilege Escalation Vulnerability | 2022-04-11 | Microsoft Active Directory Domain Services contains an unspecified vulnerability which allows for privilege escalation. | |
BQE | BillQuick Web Suite | BQE BillQuick Web Suite Versions Prior to 22.0.9.1 (from 2018 through 2021) Remote Code Execution Vulnerability | 2021-11-03 | BQE BillQuick Web Suite 2018 through 2021 prior to 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. | |
Sitecore | XP | Sitecore XP Remote Command Execution Vulnerability | 2022-03-25 | Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution. | |
Apache | HTTP Server | Apache HTTP Server 2.4.49 and 2.4.50 Path Traversal | 2021-11-03 | Apache HTTP server vulnerabilities allow an attacker to use a path traversal attack to map URLs to files outside the expected document root and perform Remote Code Execution. | |
Apache | HTTP Server | Apache HTTP Server Path Traversal Vulnerability | 2021-11-03 | A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013. | |
Microsoft | Windows | Microsoft Windows Installer Privilege Escalation Vulnerability | 2022-03-03 | Microsoft Windows Installer contains an unspecified vulnerability which allows for privilege escalation. | |
Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 2022-04-25 | Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. | |
Chromium V8 Engine | Google Chromium V8 Use-After-Free Vulnerability | 2021-12-15 | Google Chromium V8 Engine contains a use-after-free vulnerability which can allow a remote attacker to execute arbitrary code on the target system. | ||
Aviatrix | Aviatrix Controller | Aviatrix Controller Unrestricted Upload of File | 2022-01-18 | Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal. | |
Zoho | ManageEngine ADSelfServicePlus | Zoho Corp. ManageEngine ADSelfService Plus Version 6113 and Earlier Authentication Bypass | 2021-11-03 | Zoho ManageEngine ADSelfService Plus versions 6113 and earlier contain an authentication bypass vulnerability which allows for Remote Code Execution. | |
Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 2022-04-25 | Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. | |
Microsoft | Windows | Microsoft Windows Win32k Privilege Escalation Vulnerability | 2021-11-17 | Unspecified vulnerability allows for an authenticated user to escalate privileges. | |
Microsoft | Microsoft MSHTML | Microsoft Windows, Server (spec. IE) All Arbitrary Code Execution | 2021-11-03 | Microsoft MSHTML Remote Code Execution Vulnerability | |
Apache | Apache | Apache HTTP Server-Side Request Forgery (SSRF) | 2021-12-01 | A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. | |
Red Hat | Polkit | Red Hat Polkit Out-of-Bounds Read and Write Vulnerability | 2022-06-27 | The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability which allows for privilege escalation with administrative rights. | |
Pixel | Google Pixel Out-of-Bounds Write Vulnerability | 2022-04-11 | Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege. | ||
Grafana Labs | Grafana | Grafana Authentication Bypass Vulnerability | 2022-08-25 | Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss. | |
XStream | XStream | XStream Remote Code Execution Vulnerability | 2023-03-10 | XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation. | |
Microsoft | Microsoft Azure Open Management Infrastructure (OMI) | Microsoft Azure Open Management Infrastructure (OMI) Privilege Escalation Vulnerability | 2021-11-03 | Open Management Infrastructure Privilege Escalation Vulnerability | |
Microsoft | Microsoft Azure Open Management Infrastructure (OMI) | Microsoft Azure Open Management Infrastructure (OMI) Privilege Escalation Vulnerability | 2021-11-03 | Open Management Infrastructure Privilege Escalation Vulnerability | |
Microsoft | Microsoft Azure Open Management Infrastructure (OMI) | Microsoft Azure Open Management Infrastructure (OMI) Remote Code Execution Vulnerability | 2021-11-03 | Azure Open Management Infrastructure Remote Code Execution Vulnerability | |
Microsoft | Office | Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability | 2022-03-28 | Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution. | |
Microsoft | Microsoft Azure Open Management Infrastructure (OMI) | Microsoft Azure Open Management Infrastructure (OMI) Privilege Escalation Vulnerability | 2021-11-03 | Open Management Infrastructure Privilege Escalation Vulnerability | |
Delta Electronics | DOPSoft 2 | Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability | 2022-08-25 | Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation) resulting in an out-of-bounds write that allows for code execution. | |
SAP | NetWeaver | SAP NetWeaver Unrestricted File Upload Vulnerability | 2022-06-09 | SAP NetWeaver contains a vulnerability that allows unrestricted file upload. | |
Chromium V8 Engine | Google Chromium V8 Engine Memory Corruption Vulnerability | 2021-11-03 | Google Chromium V8 Engine contains a memory corruption vulnerability due to a bug in JSON.stringify. | ||
Chromium | Google Chromium Improper Input Validation Vulnerability | 2021-11-03 | Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to navigate to a malicious URL via a crafted HTML page. | ||
Chrome | Google Chrome Information Leakage | 2021-11-03 | Information disclosure in Google Chrome that exists due to excessive data output in core. | ||
Chrome | Google Chrome Use-After-Free Vulnerability | 2021-11-03 | Google Chrome use-after-free error within the V8 browser engine. | ||
Chrome | Google Chrome Use-After-Free Vulnerability | 2021-11-03 | Use-after-free weakness in Portals, Google's new web page navigation system for Chrome. Successful exploitation can let attackers to execute code. | ||
Zoho | ManageEngine ServiceDesk Plus (SDP) | Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability | 2021-12-01 | Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication | |
Microsoft | Windows | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | 2021-11-03 | Microsoft Windows Common Log File System Driver contains an unspecified vulnerability which allows for privilege escalation. | |
Microsoft | Windows | Microsoft Windows Update Medic Service Privilege Escalation Vulnerability | 2021-11-03 | Windows Update Medic Service Privilege Escalation Vulnerability | |
Microsoft | Windows | Microsoft Windows Local Security Authority (LSA) Spoofing | 2021-11-03 | Windows Local Security Authority (LSA) Spoofing Vulnerability "PetitPotam" | |
Microsoft | Windows | Microsoft Windows SAM Local Privilege Escalation Vulnerability | 2022-02-10 | If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level. | |
Trend Micro | Trend Micro Multiple Products | Trend Micro Systems Multiple Products Improper Input Validation Vulnerability | 2021-11-03 | An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security allows a local attacker to escalate privileges. | |
Trend Micro | Trend Micro Multiple Products | Trend Micro Systems Multiple Products Improper Input Validation Vulnerability | 2021-11-03 | An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security allows for upload of arbitrary files. | |
Hikvision | Security cameras web server | Hikvision Improper Input Validation | 2022-01-10 | A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation. | |
Red Hat | Polkit | Red Hat Polkit Incorrect Authorization Vulnerability | 2023-05-12 | Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation. | |
Oracle | Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | 2022-11-28 | Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product. | |
ForgeRock | Access Management server | ForgeRock Access Management Remote Code Execution Vulnerability | 2021-11-03 | ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. | |
Realtek | Jungle Software Development Kit (SDK) | Realtek SDK Arbitrary Code Execution | 2021-11-03 | Realtek Jungle SDK version v2.x up to v3.4.14B arbitrary code execution. | |
Realtek | Jungle Software Development Kit (SDK) | Realtek Jungle SDK Remote Code Execution Vulnerability | 2021-12-10 | RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution. | |
SolarWinds | Serv-U | SolarWinds Serv-U Improper Input Validation Vulnerability | 2022-01-21 | SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability which allows attackers to build and send queries without sanitization. | |
SolarWinds | SolarWinds nServ-U | SolarWinds Serv-U Remote Memory Escape Vulnerability | 2021-11-03 | Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. | |
Linux | Kernel | Linux Kernel Privilege Escalation Vulnerability | 2022-10-20 | The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation. | |
Microsoft | Windows | "PrintNightmare" - Microsoft Windows Print Spooler Remote Code Execution Vulnerability | 2021-11-03 | Windows Print Spooler Remote Code Execution Vulnerability | |
Microsoft | Microsoft Exchange Server | Microsoft Exchange Server Privilege Escalation Vulnerability | 2021-11-03 | Microsoft Exchange Server Privilege Escalation Vulnerability. This CVE ID is unique from CVE-2021-33768, CVE-2021-34470. | |
Microsoft | Windows | Microsoft Windows Event Tracing Privilege Escalation Vulnerability | 2022-03-28 | Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation. | |
Microsoft | Windows | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | 2022-03-31 | Microsoft Windows User Profile Service contains an unspecified vulnerability which allows for privilege escalation. | |
Microsoft | Microsoft Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | 2021-11-03 | Microsoft Exchange Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2021-31196, CVE-2021-31206. | |
Microsoft | Scripting Engine | Microsoft Scripting Engine Memory Corruption Vulnerability | 2021-11-03 | Scripting Engine Memory Corruption Vulnerability | |
Microsoft | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | 2021-11-03 | Windows Kernel Privilege Escalation Vulnerability. This CVE ID is unique from CVE-2021-31979, CVE-2021-34514. | |
Microsoft | Exchange Server | Microsoft Exchange Server Information Disclosure | 2022-01-18 | Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target. | |
Microsoft | Microsoft MSHTML | Microsoft MSHTML Platform Remote Code Execution Vulnerability | 2021-11-03 | Microsoft MSHTML Remote Code Execution Vulnerability | |
Microsoft | Microsoft Desktop Window Manager (DWM) | Microsoft DWM Core Library Privilege Escalation Vulnerability | 2021-11-03 | Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability | |
October CMS | October CMS | October CMS Improper Authentication | 2022-01-18 | In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. | |
Microsoft | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | 2021-11-03 | Windows Kernel Privilege Escalation Vulnerability. This CVE ID is unique from CVE-2021-33771, CVE-2021-34514. | |
Microsoft | Windows | Microsoft Windows NTFS Privilege Escalation Vulnerability | 2021-11-03 | Windows NTFS Privilege Escalation Vulnerability | |
Microsoft | Windows | Microsoft Windows Kernel Information Disclosure Vulnerability | 2021-11-03 | Windows Kernel Information Disclosure Vulnerability | |
Tenda | Tenda AC11 devices | Tenda AC11 Up to 02.03.01.104_CN Stack Buffer Overflow | 2021-11-03 | Tenda AC11 devices with firmware through 02.03.01.104_CN contain a stack buffer overflow vulnerability in /goform/setmac which allows for arbitrary execution. | |
Sudo | Sudo | Sudo Heap-Based Buffer Overflow Vulnerability | 2022-04-06 | Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation. | |
Microsoft | Microsoft Exchange Server | Microsoft Exchange Server Security Feature Bypass Vulnerability | 2021-11-03 | Microsoft Exchange Server Security Feature Bypass Vulnerability | |
Microsoft | Microsoft Enhanced Cryptographic Provider | Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerabilities | 2021-11-03 | Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability. This CVE ID is unique from CVE-2021-31199. | |
Microsoft | Microsoft Enhanced Cryptographic Provider | Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerabilities | 2021-11-03 | Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability. This CVE ID is unique from CVE-2021-31201. | |
Microsoft | HTTP Protocol Stack | Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability | 2022-04-06 | Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution. | |
Apple | iOS, macOS, watchOS | Apple iOS, macOS, watchOS Sanbox Bypass Vulnerability | 2022-08-25 | In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions. | |
Apple | iOS and iPadOS | Apple iOS and iPadOS Buffer Overflow Vulnerability | 2022-06-27 | Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges. | |
Apple | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability | 2023-03-30 | Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges. | |
Apple | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 2022-05-23 | Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for remote code execution. | |
Apple | iOS, macOS, and iPadOS | Apple XNU Kernel Type Confusion | 2021-11-03 | Apple XNU kernel contains a type confusion vulnerability which allows a malicious application to execute arbitrary code with kernel privileges. | |
Apple | iOS | Apple iOS "FORCEDENTRY" Remote Code Execution Vulnerability | 2021-11-03 | An integer overflow was addressed with improved input validation vulnerability affecting iOS devices that allows for remote code execution. | |
Apple | iOS and iPadOS | Apple Apple iOS and iPadOS Use-After-Free Vulnerability | 2021-11-03 | Apple iOS and iPadOS Arbitrary Code Execution | |
Apple | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 2021-11-03 | Apple iOS, iPadOS, macOS, and watchOS, contain a memory corruption vulnerability in�IOMobileFrameBuffer�that may allow an application to execute code with kernel privileges. | |
Apple | iOS | Apple WebKit Browser Engine Use-After-Free Vulnerability | 2021-11-03 | Use after free issue. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. | |
Apple | iOS | Apple WebKit Browser Engine Memory Corruption Vulnerability | 2021-11-03 | Memory corruption issue. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. | |
Apple | macOS | Apple macOS Input Validation Error | 2021-11-03 | A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited. | |
Apple | iOS | Apple iOS12.x Buffer Overflow | 2021-11-03 | Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. | |
Apple | Safari | Apple Safari Webkit Browser Engine Buffer Overflow Vulnerability | 2021-11-03 | Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. | |
Apple | Safari | Apple Safari Webkit Browser Engine Integer Overflow Vulnerability | 2021-11-03 | Integer overflow. Processing maliciously crafted web content may lead to arbitrary code execution. | |
Apple | iOS | Apple iOS Webkit Storage Use-After-Free Remote Code Execution Vulnerability | 2021-11-03 | Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. | |
Apple | macOS | Apple macOS Policy Subsystem Gatekeeper Bypass | 2021-11-03 | A malicious application may bypass Gatekeeper checks. Apple is aware of a report that this issue may have been actively exploited. | |
Chrome | Google Chrome Use-After-Free Vulnerability | 2021-11-03 | Google Chrome Use-After-Free vulnerability | ||
Chrome | Google Chrome Out-of-bounds write | 2021-11-03 | Google Chrome out-of-bounds write that allows to execute arbitrary code on the target system. | ||
Chrome | Google Chrome Browser V8 Arbitrary Code Execution | 2021-11-03 | Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
Chrome | Google Chrome WebGL Use-After-Free Vulnerability | 2021-11-03 | Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
Chromium V8 Engine | Chromium V8 Type Confusion Vulnerability | 2021-11-03 | Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
Chromium | Google Chromium Security Bypass Vulnerability | 2022-06-27 | Insufficient policy enforcement in the PopupBlocker for Chromium allows an attacker to remotely bypass security mechanisms. This vulnerability impacts web browsers using Chromium such as Chrome and Edge. | ||
Kaseya | Kaseya VSA | Kaseya VSA Remote Code Execution Vulnerability | 2021-11-03 | Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. | |
QNAP | Network Attached Storage (NAS) | QNAP NAS Improper Authorization Vulnerability | 2022-03-31 | QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device. | |
Arm | Mali Graphics Processing Unit (GPU) | Arm Mali GPU Kernel Boundary Error Vulnerability | 2021-11-03 | The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve read/write access to read-only pages. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r8p0 through r30p0. | |
Arm | Mali Graphics Processing Unit (GPU) | Arm Mali GPU Kernel Use-After-Free Vulnerability | 2021-11-03 | The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0. | |
Adobe | Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | 2021-11-03 | Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |
Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 2021-11-03 | Win32k Privilege Escalation Vulnerability. This CVE ID is unique from CVE-2021-27072. | |
Veritas | Backup Exec Agent | Veritas Backup Exec Agent Command Execution Vulnerability | 2023-04-07 | Veritas Backup Exec (BE) Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine. | |
Veritas | Backup Exec Agent | Veritas Backup Exec Agent Improper Authentication Vulnerability | 2023-04-07 | Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme. | |
Veritas | Backup Exec Agent | Veritas Backup Exec Agent File Access Vulnerability | 2023-04-07 | Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine. | |
FatPipe | WARP, IPVPN, and MPVPN software | FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit | 2022-01-10 | A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. | |
Checkbox | Checkbox Survey | Checkbox Survey Deserialization of Untrusted Data Vulnerability | 2022-04-11 | Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. | |
Arm | Arm Trusted Firmware | Arm Trusted Firmware M through 1.2 Denial-of-Service | 2021-11-03 | In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode. This vulnerability has known active exploitation against Yealink Device Management servers. It is assessed this product utilizes the affected Arm firmware. | |
Yealink | Device Management Platform | Yealink Device Management Server Pre-Authorization SSRF | 2021-11-03 | Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication | |
Accellion | FTA | Accellion FTA OS Command Injection Vulnerability | 2021-11-03 | Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. | |
Accellion | FTA | Accellion FTA SSRF Vulnerability | 2021-11-03 | Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. | |
Accellion | FTA | Accellion FTA OS Command Injection Vulnerability | 2021-11-03 | Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. | |
Accellion | FTA | Accellion FTA SQL Injection Vulnerability | 2021-11-03 | Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. | |
Microsoft | Internet Explorer | Internet Explorer 11 Remote Code Execution Vulnerability | 2021-11-03 | Internet Explorer Remote Code Execution Vulnerability | |
Microsoft | Microsoft Exchange Server | Microsoft OWA Exchange Control Panel (ECP) Exploit Chain | 2021-11-03 | Microsoft Exchange Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27078. | |
Microsoft | Office | Microsoft Office Remote Code Execution Vulnerability | 2021-11-03 | Microsoft Office Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2021-24108, CVE-2021-27057. | |
Microsoft | Microsoft Exchange Server | Microsoft OWA Exchange Control Panel (ECP) Exploit Chain | 2021-11-03 | Microsoft Exchange Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26857, CVE-2021-27065, CVE-2021-27078. | |
Microsoft | Microsoft Exchange Server | Microsoft Unified Messaging Deserialization Vulnerability | 2021-11-03 | Microsoft Exchange Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078. | |
Microsoft | Microsoft Exchange Server | Microsoft OWA Exchange Control Panel (ECP) Exploit Chain | 2021-11-03 | Microsoft Exchange Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078. | |
Microsoft | Microsoft Edge, Internet Explorer | Microsoft Internet Explorer and Edge Memory Corruption Vulnerability | 2021-11-03 | Internet Explorer Memory Corruption Vulnerability | |
Atlassian | Confluence Server | Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability | 2022-03-28 | Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint. | |
Atlassian | Confluence Server | Atlassian Confluence Server < 6.13.23, 6.14.0 - 7.12.5 Arbitrary Code Execution | 2021-11-03 | Atlassian Confluence Server The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5 contains an OGNL injection vulnerability which allows an attacker to execute arbitrary code. | |
Samsung | Mobile Devices | Samsung Mobile Devices Memory Corruption Vulnerability | 2022-11-08 | Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369. | |
Samsung | Mobile Devices | Samsung Mobile Devices Improper Access Control Vulnerability | 2022-11-08 | Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370. | |
Samsung | Mobile Devices | Samsung Mobile Devices Improper Access Control Vulnerability | 2022-11-08 | Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370. | |
Nagios | Nagios XI | Nagios XI OS Command Injection | 2022-01-18 | Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. | |
Nagios | Nagios XI | Nagios XI OS Command Injection | 2022-01-18 | Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. | |
Nagios | Nagios XI | Nagios XI OS Command Injection | 2022-01-18 | Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. | |
McAfee | McAfee Total Protection (MTP) | McAfee Total Protection MTP Arbitrary Process Execution | 2021-11-03 | Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP self-defense. | |
F5 | BIG-IP Traffic Management Microkernel | F5 BIG-IP Traffic Management Microkernel Buffer Overflow | 2022-01-18 | The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls. | |
F5 | BIG-IP | F5 iControl REST unauthenticated Remote Code Execution Vulnerability | 2021-11-03 | The iControl REST interface has an unauthenticated remote command execution vulnerability. | |
Citrix | ShareFile | Citrix ShareFile Improper Access Control Vulnerability | 2022-03-25 | Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller. | |
Pulse Secure | Pulse Connect Secure | Pulse Connect Secure Arbitrary File Upload Vulnerability | 2021-11-03 | A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface. | |
Pulse Secure | Pulse Connect Secure | Pulse Connect Secure Remote Code Execution Vulnerability | 2021-11-03 | Allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature. | |
Pulse Secure | Pulse Connect Secure | Pulse Connect Secure Collaboration Suite Remote Code Execution Vulnerability | 2021-11-03 | A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room. | |
Pulse Secure | Pulse Connect Secure | Pulse Connect Secure Remote Code Execution Vulnerability | 2021-11-03 | Vulnerability to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. | |
Linux | Kernel | Linux Kernel Privilege Escalation Vulnerability | 2022-04-11 | Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service or possibly for privilege escalation. | |
Micro Focus | Micro Focus Access Manager | Micro Focus Access Manager Earlier Than 5.0 Information Leakage | 2021-11-03 | Micro Focus Access Manager versions prior to 5.0 contain a vulnerability which allows for information leakage. | |
Micro Focus | Micro Focus Operation Bridge Reporter (OBR) | Micro Focus Operation Bridge Report (OBR) Server Remote Code Execution Vulnerability | 2021-11-03 | Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server. | |
ExifTool | ExifTool | GitLab Community and Enterprise Editions From 11.9 Remote Code Execution Vulnerability | 2021-11-03 | Anyone with the ability to upload an image that goes through the GitLab Workhorse could achieve Remote Code Execution via a specially crafted file. | |
Perl | Exiftool | ExifTool Remote Code Execution Vulnerability | 2021-11-17 | Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image | |
VMware | vCenter Server | VMware vCenter Server Improper Access Control | 2022-01-10 | Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. | |
VMware | vCenter Server | VMware vCenter Server File Upload | 2021-11-03 | VMware vCenter Server file upload vulnerability in the VMware-analytics service that allows to execute code on vCenter Server. | |
VMware | vCenter Server | VMware vCenter Server Remote Code Execution Vulnerability | 2021-11-03 | The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. | |
VMware | vRealize Operations Manager API | VMware Server Side Request Forgery in vRealize Operations Manager API | 2022-01-18 | Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials. | |
VMware | vCenter Server and Cloud Foundation | VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability | 2022-03-07 | VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure. | |
VMware | vCenter Server | VMware vCenter Server Remote Code Execution Vulnerability | 2021-11-03 | The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. | |
Dell | dbutil Driver | Dell dbutil Driver Insufficient Access Control Vulnerability | 2022-03-31 | Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service, or information disclosure. | |
Npm package | System Information Library for Node.JS | System Information Library for Node.JS Command Injection | 2022-01-18 | In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote. | |
Chromium V8 Engine | Chromium V8 JavaScript Engine Remote Code Execution Vulnerability | 2021-11-03 | Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. | ||
Chromium V8 Engine | Chromium V8 Input Validation Vulnerability | 2021-11-03 | Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
Chromium Blink | Chromium Blink Use-After-Free Vulnerability | 2021-11-03 | Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
Chromium V8 Engine | Chromium V8 Use-After-Free Vulnerability | 2021-11-03 | Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
Chrome | Google Chrome Heap Buffer Overflow in WebAudio Vulnerability | 2021-11-03 | Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
Chromium V8 Engine | Chromium V8 JavaScript Rendering Engine Heap Buffer Overflow Vulnerability | 2021-11-03 | Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
Adobe | Acrobat and Reader | Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability | 2021-11-03 | Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |
Arcadyan | Buffalo WSR-2533DHPL2 and WSR-2533DHP3 firmware | Arcadyan Buffalo Firmware Multiple Versions Path Traversal | 2021-11-03 | A path traversal vulnerability in Arcadyan firmware could allow unauthenticated remote attackers to bypass authentication. It impacts many routers. | |
SonicWall | SMA 100 Appliances | SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability | 2022-01-28 | SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution. | |
SonicWall | Secure Remote Access (SRA) | SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability | 2022-03-28 | SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection. | |
SonicWall | SonicWall Email Security | SonicWall Email Security Privilege Escalation Exploit Chain | 2021-11-03 | SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host. | |
SonicWall | SonicWall Email Security | SonicWall Email Security Privilege Escalation Exploit Chain | 2021-11-03 | SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host. | |
SonicWall | SonicWall Email Security | SonicWall Email Security Privilege Escalation Exploit Chain | 2021-11-03 | A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. | |
SonicWall | SonicWall SSLVPN SMA100 | SonicWall SSL VPN SMA100 SQL Injection Vulnerability | 2021-11-03 | Allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information in SMA100 build version 10.x. | |
Qualcomm | Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | Qualcomm Improper Error Handling Vulnerability | 2021-11-03 | Improper handling of address deregistration on failure can lead to new GPU address allocation failure. | |
Qualcomm | Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | Qualcomm Use-After-Free Vulnerability | 2021-11-03 | Possible use after free due to improper handling of memory mapping of multiple processes simultaneously | |
Apple | iOS | Apple iOS Webkit Browser Engine XSS | 2021-11-03 | Processing maliciously crafted web content may lead to universal cross site scripting. Apple is aware of a report that this issue may have been actively exploited. | |
Apple | iOS | Apple iOS Privilege Escalation and Code Execution Chain | 2021-11-03 | A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. | |
Apple | iOS | Apple iOS Privilege Escalation and Code Execution Chain | 2021-11-03 | A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. | |
Apple | Multiple Products | Apple Multiple Products Type Confusion Vulnerability | 2022-05-04 | A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution. | |
Apple | iOS | Apple iOS Privilege Escalation and Code Execution Chain | 2021-11-03 | A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited. | |
Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 2021-11-03 | Windows Win32k Privilege Escalation Vulnerability. This CVE ID is unique from CVE-2021-1698. | |
Microsoft | Windows | Microsoft Windows Print Spooler Remote Code Execution Vulnerability | 2021-11-03 | Windows Print Spooler Privilege Escalation Vulnerability | |
Microsoft | Microsoft Defender | Microsoft Defender Remote Code Execution Vulnerability | 2021-11-03 | Microsoft Defender Remote Code Execution Vulnerability | |
Cisco | HyperFlex HX | Cisco HyperFlex HX Command Injection Vulnerabilities | 2021-11-03 | Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. | |
Cisco | HyperFlex HX | Cisco HyperFlex HX Command Injection Vulnerabilities | 2021-11-03 | Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. | |
Android | Kernel | Android Kernel Use-After-Free Vulnerability | 2022-05-23 | Android kernel contains a use-after-free vulnerability that allows for privilege escalation. | |
Android | Kernel | Android Kernel Race Condition Vulnerability | 2022-05-23 | Android kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation. |