Security Radar

CVE-2021-22506 Severity under analysis added on 11/03/2021

Micro Focus Access Manager Information Leakage Vulnerability

Micro Focus · Micro Focus Access Manager

Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.

CVE-2021-22502 Severity under analysis added on 11/03/2021

Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability

Micro Focus · Operation Bridge Reporter (OBR) · CWE-20, CWE-78

Micro Focus Operation Bridge Report (OBR) contains an unspecified vulnerability that allows for remote code execution.

CVE-2021-22205 Severity under analysis Ransomware added on 11/03/2021

GitLab Community and Enterprise Editions Remote Code Execution Vulnerability

GitLab · Community and Enterprise Editions · CWE-20, CWE-95

GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.

CVE-2021-22005 Severity under analysis Ransomware added on 11/03/2021

VMware vCenter Server File Upload Vulnerability

VMware · vCenter Server · CWE-23

VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.

CVE-2021-21985 Severity under analysis Ransomware added on 11/03/2021

VMware vCenter Server Improper Input Validation Vulnerability

VMware · vCenter Server · CWE-20, CWE-470, CWE-918

VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.

CVE-2021-21972 Severity under analysis Ransomware added on 11/03/2021

VMware vCenter Server Remote Code Execution Vulnerability

VMware · vCenter Server · CWE-23

VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.

CVE-2021-21224 Severity under analysis added on 11/03/2021

Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8 · CWE-843

Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2021-21220 Severity under analysis added on 11/03/2021

Google Chromium V8 Improper Input Validation Vulnerability

Google · Chromium V8 · CWE-20, CWE-122

Google Chromium V8 Engine contains an improper input validation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2021-21206 Severity under analysis added on 11/03/2021

Google Chromium Blink Use-After-Free Vulnerability

Google · Chromium Blink · CWE-416

Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2021-21193 Severity under analysis added on 11/03/2021

Google Chromium Blink Use-After-Free Vulnerability

Google · Chromium Blink · CWE-416

Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2021-21166 Severity under analysis added on 11/03/2021

Google Chromium Race Condition Vulnerability

Google · Chromium · CWE-122, CWE-362

Google Chromium contains a race condition vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2021-21148 Severity under analysis added on 11/03/2021

Google Chromium V8 Heap Buffer Overflow Vulnerability

Google · Chromium V8 · CWE-122

Google Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2021-21017 Severity under analysis added on 11/03/2021

Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability

Adobe · Acrobat and Reader · CWE-122

Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.

CVE-2021-20090 Severity under analysis added on 11/03/2021

Arcadyan Buffalo Firmware Path Traversal Vulnerability

Arcadyan · Buffalo Firmware · CWE-22

Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several different vendors.

CVE-2021-20023 Severity under analysis Ransomware added on 11/03/2021

SonicWall Email Security Path Traversal Vulnerability

SonicWall · SonicWall Email Security · CWE-22

SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.

CVE-2021-20022 Severity under analysis Ransomware added on 11/03/2021

SonicWall Email Security Unrestricted Upload of File Vulnerability

SonicWall · SonicWall Email Security · CWE-434

SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.

CVE-2021-20021 Severity under analysis Ransomware added on 11/03/2021

SonicWall Email Security Improper Privilege Management Vulnerability

SonicWall · SonicWall Email Security · CWE-306

SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.

CVE-2021-20016 Severity under analysis Ransomware added on 11/03/2021

SonicWall SSLVPN SMA100 SQL Injection Vulnerability

SonicWall · SSLVPN SMA100 · CWE-89

SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.

CVE-2021-1906 Severity under analysis added on 11/03/2021

Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability

Qualcomm · Multiple Chipsets · CWE-390

Multiple Qualcomm chipsets contain a detection of error condition without action vulnerability when improper handling of address deregistration on failure can lead to new GPU address allocation failure.

CVE-2021-1905 Severity under analysis added on 11/03/2021

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Qualcomm · Multiple Chipsets · CWE-416

Multiple Qualcomm Chipsets contain a use after free vulnerability due to improper handling of memory mapping of multiple processes simultaneously.

CVE-2021-1879 Severity under analysis added on 11/03/2021

Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability

Apple · iOS, iPadOS, and watchOS · CWE-79

Apple iOS, iPadOS, and watchOS WebKit contain an unspecified vulnerability that allows for universal cross-site scripting (XSS) when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

CVE-2021-1871 Severity under analysis added on 11/03/2021

Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability

Apple · iOS, iPadOS, and macOS · CWE-1173

Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

CVE-2021-1870 Severity under analysis added on 11/03/2021

Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability

Apple · iOS, iPadOS, and macOS · CWE-1173

Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

CVE-2021-1782 Severity under analysis added on 11/03/2021

Apple Multiple Products Race Condition Vulnerability

Apple · Multiple Products · CWE-362, CWE-667

Apple iOS, iPadOs, macOS, watchOS, and tvOS contain a race condition vulnerability that may allow a malicious application to elevate privileges.