Security Radar

CVE-2021-28663 Severity under analysis added on 11/03/2021

Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability

Arm · Mali Graphics Processing Unit (GPU) · CWE-416

Arm Mali Graphics Processing Unit (GPU) kernel driver contains a use-after-free vulnerability that may allow a non-privileged user to make improper operations on GPU memory to gain root privilege, and/or disclose information.

CVE-2021-28550 Severity under analysis added on 11/03/2021

Adobe Acrobat and Reader Use-After-Free Vulnerability

Adobe · Acrobat and Reader · CWE-416

Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.

CVE-2021-28310 Severity under analysis added on 11/03/2021

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft · Win32k · CWE-787

Microsoft Windows Win32k contains an unspecified vulnerability that allows for privilege escalation.

CVE-2021-27562 Severity under analysis added on 11/03/2021

Arm Trusted Firmware Out-of-Bounds Write Vulnerability

Arm · Trusted Firmware · CWE-787

Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink Device Management servers.

CVE-2021-27561 Severity under analysis added on 11/03/2021

Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability

Yealink · Device Management · CWE-78

Yealink Device Management contains a server-side request forgery (SSRF) vulnerability that allows for unauthenticated remote code execution.

CVE-2021-27104 Severity under analysis Ransomware added on 11/03/2021

Accellion FTA OS Command Injection Vulnerability

Accellion · FTA · CWE-20, CWE-78

Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints.

CVE-2021-27103 Severity under analysis Ransomware added on 11/03/2021

Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability

Accellion · FTA · CWE-918

Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html.

CVE-2021-27102 Severity under analysis Ransomware added on 11/03/2021

Accellion FTA OS Command Injection Vulnerability

Accellion · FTA · CWE-20, CWE-78

Accellion FTA contains an OS command injection vulnerability exploited via a local web service call.

CVE-2021-27101 Severity under analysis Ransomware added on 11/03/2021

Accellion FTA SQL Injection Vulnerability

Accellion · FTA · CWE-89, CWE-138

Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html.

CVE-2021-27085 Severity under analysis added on 11/03/2021

Microsoft Internet Explorer Remote Code Execution Vulnerability

Microsoft · Internet Explorer

Microsoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution.

CVE-2021-27065 Severity under analysis Ransomware added on 11/03/2021

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server · CWE-39

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

CVE-2021-27059 Severity under analysis added on 11/03/2021

Microsoft Office Remote Code Execution Vulnerability

Microsoft · Office

Microsoft Office contains an unspecified vulnerability that allows for remote code execution.

CVE-2021-26858 Severity under analysis Ransomware added on 11/03/2021

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

CVE-2021-26857 Severity under analysis Ransomware added on 11/03/2021

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server · CWE-502

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

CVE-2021-26855 Severity under analysis Ransomware added on 11/03/2021

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server · CWE-918

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

CVE-2021-26411 Severity under analysis Ransomware added on 11/03/2021

Microsoft Internet Explorer Memory Corruption Vulnerability

Microsoft · Internet Explorer · CWE-416

Microsoft Internet Explorer contains an unspecified vulnerability that allows for memory corruption.

CVE-2021-26084 Severity under analysis Ransomware added on 11/03/2021

Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

Atlassian · Confluence Server and Data Center · CWE-917

Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.

CVE-2021-23874 Severity under analysis added on 11/03/2021

McAfee Total Protection (MTP) Improper Privilege Management Vulnerability

McAfee · McAfee Total Protection (MTP) · CWE-284

McAfee Total Protection (MTP) contains an improper privilege management vulnerability that allows a local user to gain elevated privileges and execute code, bypassing MTP self-defense.

CVE-2021-22986 Severity under analysis Ransomware added on 11/03/2021

F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability

F5 · BIG-IP and BIG-IQ Centralized Management · CWE-863

F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.

CVE-2021-22900 Severity under analysis added on 11/03/2021

Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability

Ivanti · Pulse Connect Secure · CWE-94

Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability that allows an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.

CVE-2021-22899 Severity under analysis added on 11/03/2021

Ivanti Pulse Connect Secure Command Injection Vulnerability

Ivanti · Pulse Connect Secure · CWE-77

Ivanti Pulse Connect Secure contains a command injection vulnerability that allows remote authenticated users to perform remote code execution via Windows File Resource Profiles.

CVE-2021-22894 Severity under analysis added on 11/03/2021

Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability

Ivanti · Pulse Connect Secure · CWE-94

Ivanti Pulse Connect Secure Collaboration Suite contains a buffer overflow vulnerabilities that allows a remote authenticated users to execute code as the root user via maliciously crafted meeting room.

CVE-2021-22893 Severity under analysis Ransomware added on 11/03/2021

Ivanti Pulse Connect Secure Use-After-Free Vulnerability

Ivanti · Pulse Connect Secure · CWE-287

Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services.

CVE-2021-22506 Severity under analysis added on 11/03/2021

Micro Focus Access Manager Information Leakage Vulnerability

Micro Focus · Micro Focus Access Manager

Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.