Security Radar

CVE-2021-21985 Severity under analysis Ransomware added on 11/03/2021

VMware vCenter Server Improper Input Validation Vulnerability

VMware · vCenter Server · CWE-20, CWE-470, CWE-918

VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.

CVE-2021-21972 Severity under analysis Ransomware added on 11/03/2021

VMware vCenter Server Remote Code Execution Vulnerability

VMware · vCenter Server · CWE-23

VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.

CVE-2021-21224 Severity under analysis added on 11/03/2021

Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8 · CWE-843

Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2021-21220 Severity under analysis added on 11/03/2021

Google Chromium V8 Improper Input Validation Vulnerability

Google · Chromium V8 · CWE-20, CWE-122

Google Chromium V8 Engine contains an improper input validation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2021-21206 Severity under analysis added on 11/03/2021

Google Chromium Blink Use-After-Free Vulnerability

Google · Chromium Blink · CWE-416

Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2021-21193 Severity under analysis added on 11/03/2021

Google Chromium Blink Use-After-Free Vulnerability

Google · Chromium Blink · CWE-416

Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2021-21166 Severity under analysis added on 11/03/2021

Google Chromium Race Condition Vulnerability

Google · Chromium · CWE-122, CWE-362

Google Chromium contains a race condition vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2021-21148 Severity under analysis added on 11/03/2021

Google Chromium V8 Heap Buffer Overflow Vulnerability

Google · Chromium V8 · CWE-122

Google Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2021-21017 Severity under analysis added on 11/03/2021

Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability

Adobe · Acrobat and Reader · CWE-122

Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.

CVE-2021-20023 Severity under analysis Ransomware added on 11/03/2021

SonicWall Email Security Path Traversal Vulnerability

SonicWall · SonicWall Email Security · CWE-22

SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.

CVE-2021-20022 Severity under analysis Ransomware added on 11/03/2021

SonicWall Email Security Unrestricted Upload of File Vulnerability

SonicWall · SonicWall Email Security · CWE-434

SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.

CVE-2021-20021 Severity under analysis Ransomware added on 11/03/2021

SonicWall Email Security Improper Privilege Management Vulnerability

SonicWall · SonicWall Email Security · CWE-306

SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.

CVE-2021-20016 Severity under analysis Ransomware added on 11/03/2021

SonicWall SSLVPN SMA100 SQL Injection Vulnerability

SonicWall · SSLVPN SMA100 · CWE-89

SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.

CVE-2021-1732 Severity under analysis Ransomware added on 11/03/2021

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft · Win32k · CWE-787

Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.

CVE-2021-1675 Severity under analysis Ransomware added on 11/03/2021

Microsoft Windows Print Spooler Remote Code Execution Vulnerability

Microsoft · Windows · CWE-285

Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.

CVE-2021-1647 Severity under analysis added on 11/03/2021

Microsoft Defender Remote Code Execution Vulnerability

Microsoft · Defender · CWE-122, CWE-1285

Microsoft Defender contains an unspecified vulnerability that allows for remote code execution.

CVE-2021-1498 Severity under analysis added on 11/03/2021

Cisco HyperFlex HX Data Platform Command Injection Vulnerability

Cisco · HyperFlex HX · CWE-78

Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user.

CVE-2021-1497 Severity under analysis added on 11/03/2021

Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability

Cisco · HyperFlex HX · CWE-78

Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user.

CVE-2020-8260 Severity under analysis added on 11/03/2021

Ivanti Pulse Connect Secure Code Execution Vulnerability

Ivanti · Pulse Connect Secure · CWE-434

Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction.

CVE-2020-8243 Severity under analysis added on 11/03/2021

Ivanti Pulse Connect Secure Code Execution Vulnerability

Ivanti · Pulse Connect Secure · CWE-94

Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin web interface that could allow an authenticated attacker to upload a custom template to perform code execution.

CVE-2020-8196 Severity under analysis added on 11/03/2021

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability

Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance · CWE-284

Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.

CVE-2020-8195 Severity under analysis added on 11/03/2021

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability

Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance · CWE-20

Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.

CVE-2020-8193 Severity under analysis added on 11/03/2021

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability

Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance · CWE-284

Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.

CVE-2020-6418 Severity under analysis added on 11/03/2021

Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8 · CWE-843

Google Chromium V8 Engine contains a type confusion vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.