Search
Total
49350 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-28629 | 2 Adobe, Microsoft | 2 Animate, Windows | 2021-08-30 | 6.8 MEDIUM | 7.8 HIGH |
| Adobe Animate version 21.0.6 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2021-28614 | 2 Adobe, Microsoft | 2 After Effects, Windows | 2021-08-30 | 5.8 MEDIUM | 7.1 HIGH |
| Adobe After Effects version 18.2 (and earlier) is affected by an Our-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information and cause a denial of service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2021-28612 | 2 Adobe, Microsoft | 2 After Effects, Windows | 2021-08-30 | 5.8 MEDIUM | 7.1 HIGH |
| Adobe After Effects version 18.2 (and earlier) is affected by an Our-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information and cause a denial of service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2020-18917 | 1 Dedecms | 1 Dedecms | 2021-08-30 | 6.8 MEDIUM | 8.8 HIGH |
| The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control. | |||||
| CVE-2021-40083 | 1 Nic | 1 Knot Resolver | 2021-08-30 | 5.0 MEDIUM | 7.5 HIGH |
| Knot Resolver before 5.3.2 is prone to an assertion failure, triggerable by a remote attacker in an edge case (NSEC3 with too many iterations used for a positive wildcard proof). | |||||
| CVE-2021-28596 | 2 Adobe, Microsoft | 2 Framemaker, Windows | 2021-08-30 | 9.3 HIGH | 7.8 HIGH |
| Adobe Framemaker version 2020.0.1 (and earlier) and 2019.0.8 (and earlier) are affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2021-36013 | 1 Adobe | 1 Media Encoder | 2021-08-30 | 6.8 MEDIUM | 7.8 HIGH |
| Adobe Media Encoder version 15.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2021-3617 | 1 Lenovo | 6 Smart Camera C2e, Smart Camera C2e Firmware, Smart Camera X3 and 3 more | 2021-08-30 | 6.5 MEDIUM | 7.2 HIGH |
| A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted network configuration. This vulnerability is the same as CNVD-2020-68652. | |||||
| CVE-2021-37693 | 1 Discourse | 1 Discourse | 2021-08-30 | 5.0 MEDIUM | 7.5 HIGH |
| Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an existing account on a Discourse site an email token is generated as part of the email verification process. Deleting the additional email address does not invalidate an unused token which can then be used in other contexts, including reseting a password. | |||||
| CVE-2018-10790 | 1 Axiosys | 1 Bento4 | 2021-08-30 | 5.0 MEDIUM | 7.5 HIGH |
| The AP4_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4 1.5.1.0 allows remote attackers to cause a denial of service (application crash), related to a memory allocation failure, as demonstrated by mp2aac. | |||||
| CVE-2021-39160 | 1 Jupyterhub | 1 Nbgitpuller | 2021-08-30 | 6.8 MEDIUM | 8.8 HIGH |
| nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade. | |||||
| CVE-2020-18735 | 1 Eclipse | 1 Cyclone Data Distribution Service | 2021-08-30 | 5.0 MEDIUM | 7.5 HIGH |
| A heap buffer overflow in /src/dds_stream.c of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash. | |||||
| CVE-2020-18734 | 1 Eclipse | 1 Cyclone Data Distribution Service | 2021-08-30 | 5.0 MEDIUM | 7.5 HIGH |
| A stack buffer overflow in /ddsi/q_bitset.h of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash. | |||||
| CVE-2021-22357 | 1 Huawei | 8 S12700, S12700 Firmware, S5700 and 5 more | 2021-08-30 | 5.0 MEDIUM | 7.5 HIGH |
| There is a denial of service vulnerability in Huawei products. A module cannot deal with specific messages due to validating inputs insufficiently. Attackers can exploit this vulnerability by sending specific messages to affected module. This can cause denial of service. Affected product versions include: S12700 V200R013C00SPC500, V200R019C00SPC500; S5700 V200R013C00SPC500, V200R019C00SPC500; S6700 V200R013C00SPC500, V200R019C00SPC500; S7700 V200R013C00SPC500, V200R019C00SPC500. | |||||
| CVE-2021-24557 | 1 Nimble3 | 1 M-vslider | 2021-08-30 | 6.5 MEDIUM | 7.2 HIGH |
| The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role. | |||||
| CVE-2021-24497 | 1 Satollo | 1 Giveaway | 2021-08-30 | 6.5 MEDIUM | 7.2 HIGH |
| The Giveaway WordPress plugin through 1.2.2 is vulnerable to an SQL Injection issue which allows an administrative user to execute arbitrary SQL commands via the $post_id on the options.php page. | |||||
| CVE-2021-32975 | 1 Hornerautomation | 1 Cscape | 2021-08-30 | 6.8 MEDIUM | 7.8 HIGH |
| Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute code in the context of the current process. | |||||
| CVE-2020-24130 | 1 Ponzu-cms | 1 Ponzu | 2021-08-30 | 4.3 MEDIUM | 8.1 HIGH |
| A cross site request forgery (CSRF) vulnerability in the configure.html component of Ponzu 0.11.0 allows attackers to change user and administrator credentials, and add or delete administrator accounts. | |||||
| CVE-2021-36005 | 3 Adobe, Apple, Microsoft | 3 Photoshop, Macos, Windows | 2021-08-30 | 9.3 HIGH | 7.8 HIGH |
| Adobe Photoshop versions 21.2.9 (and earlier) and 22.4.2 (and earlier) is affected by a stack overflow vulnerability due to insecure handling of a crafted PSD file, potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted PSD file in Photoshop. | |||||
| CVE-2021-36000 | 2 Adobe, Microsoft | 2 Character Animator, Windows | 2021-08-30 | 9.3 HIGH | 7.8 HIGH |
| Adobe Character Animator version 4.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2021-35999 | 2 Adobe, Microsoft | 2 Prelude, Windows | 2021-08-30 | 9.3 HIGH | 7.8 HIGH |
| Adobe Prelude version 10.0 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2021-35997 | 2 Adobe, Microsoft | 2 Premiere Pro, Windows | 2021-08-30 | 9.3 HIGH | 7.8 HIGH |
| Adobe Premiere Pro version 15.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2021-28595 | 3 Adobe, Apple, Microsoft | 3 Dimension, Macos, Windows | 2021-08-30 | 9.3 HIGH | 7.8 HIGH |
| Adobe Dimension version 3.4 (and earlier) is affected by an Uncontrolled Search Path Element element. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2017-11774 | 1 Microsoft | 1 Outlook | 2021-08-30 | 6.8 MEDIUM | 7.8 HIGH |
| Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability." | |||||
| CVE-2017-8663 | 1 Microsoft | 1 Outlook | 2021-08-30 | 9.3 HIGH | 7.8 HIGH |
| Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows a remote code execution vulnerability due to the way Microsoft Outlook parses specially crafted email messages, aka "Microsoft Office Outlook Memory Corruption Vulnerability" | |||||
| CVE-2017-8571 | 1 Microsoft | 1 Outlook | 2021-08-30 | 6.8 MEDIUM | 7.8 HIGH |
| Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows a security feature bypass vulnerability due to the way that it handles input, aka "Microsoft Office Outlook Security Feature Bypass Vulnerability". | |||||
| CVE-2020-27461 | 1 Seopanel | 1 Seopanel | 2021-08-30 | 6.5 MEDIUM | 8.8 HIGH |
| A remote code execution vulnerability in SEOPanel 4.6.0 has been fixed for 4.7.0. This vulnerability allowed for remote code execution through an authenticated file upload via the Settings Panel>Import website function. | |||||
| CVE-2021-36748 | 1 Prestahome | 1 Blog | 2021-08-30 | 5.0 MEDIUM | 7.5 HIGH |
| A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote attacker to extract data from the database via the sb_category parameter. | |||||
| CVE-2016-10081 | 1 Shutter-project | 1 Shutter | 2021-08-29 | 9.3 HIGH | 7.8 HIGH |
| /usr/bin/shutter in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandled during a "Run a plugin" action. | |||||
| CVE-2020-18754 | 1 Plc Mac1100 Project | 2 Plc Mac1100, Plc Mac1100 Firmware | 2021-08-28 | 5.0 MEDIUM | 7.5 HIGH |
| An information disclosure vulnerability exists within Dut Computer Control Engineering Co.'s PLC MAC1100. | |||||
| CVE-2020-18477 | 1 Hucart | 1 Hucart | 2021-08-27 | 6.5 MEDIUM | 8.8 HIGH |
| SQL Injection vulnerability in Hucart CMS 5.7.4 via the purchase enquiry field found in the Message con_content field. | |||||
| CVE-2020-18476 | 1 Hucart | 1 Hucart | 2021-08-27 | 6.5 MEDIUM | 8.8 HIGH |
| SQL Injection vulnerability in Hucart CMS 5.7.4 via the basic information field found in the avatar usd_image field. | |||||
| CVE-2021-34398 | 1 Nvidia | 1 Data Center Gpu Manager | 2021-08-27 | 7.2 HIGH | 7.8 HIGH |
| NVIDIA DCGM, all versions prior to 2.2.9, contains a vulnerability in the DIAG module where any user can inject shared libraries into the DCGM server, which is usually running as root, which may lead to privilege escalation, total loss of confidentiality and integrity, and complete denial of service. | |||||
| CVE-2021-24562 | 1 Lifterlms | 1 Lifterlms | 2021-08-27 | 5.0 MEDIUM | 7.5 HIGH |
| The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see other student answers and grades | |||||
| CVE-2021-24602 | 1 Hmplugin | 1 Hm Multiple Roles | 2021-08-27 | 6.5 MEDIUM | 8.8 HIGH |
| The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page | |||||
| CVE-2019-18822 | 1 Eleveo | 1 Call Recording | 2021-08-27 | 9.0 HIGH | 8.8 HIGH |
| A privilege escalation vulnerability in ZOOM Call Recording 6.3.1 allows its user account (i.e., the account under which the program runs - by default, the callrec account) to elevate privileges to root by abusing the callrec-rs@.service. The callrec-rs@.service starts the /opt/callrec/bin/rs binary with root privileges, and this binary is owned by callrec. It can be replaced by a Trojan horse. | |||||
| CVE-2019-11868 | 1 Softether | 1 See.sys | 2021-08-27 | 4.6 MEDIUM | 7.8 HIGH |
| See.sys, up to version 4.25, in SoftEther VPN Server versions 4.29 or older, allows a user to call an IOCTL specifying any kernel address to which arbitrary bytes are written to. | |||||
| CVE-2021-39131 | 1 Ced Project | 1 Ced | 2021-08-27 | 5.0 MEDIUM | 7.5 HIGH |
| ced detects character encoding using Google’s compact_enc_det library. In ced v0.1.0, passing data types other than `Buffer` causes the Node.js process to crash. The problem has been patched in ced v1.0.0. As a workaround, before passing an argument to ced, verify it’s a `Buffer` using `Buffer.isBuffer(obj)`. | |||||
| CVE-2021-24038 | 1 Oculus | 1 Desktop | 2021-08-27 | 4.6 MEDIUM | 7.8 HIGH |
| Due to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle to an unprivileged process, leading to local privilege escalation. This issue affects Oculus Desktop versions after 1.39 and prior to 31.1.0.67.507. | |||||
| CVE-2021-20592 | 1 Mitsubishielectric | 7 Got2000 Gt23, Got2000 Gt23 Firmware, Got2000 Gt25 and 4 more | 2021-08-27 | 7.8 HIGH | 7.5 HIGH |
| Missing synchronization vulnerability in GOT2000 series GT27 model communication driver versions 01.19.000 through 01.39.010, GT25 model communication driver versions 01.19.000 through 01.39.010 and GT23 model communication driver versions 01.19.000 through 01.39.010 and GT SoftGOT2000 versions 1.170C through 1.256S allows a remote unauthenticated attacker to cause DoS condition on the MODBUS/TCP slave communication function of the products by rapidly and repeatedly connecting and disconnecting to and from the MODBUS/TCP communication port on a target. Restart or reset is required to recover. | |||||
| CVE-2021-20594 | 1 Mitsubishielectric | 16 R08psfcpu, R08psfcpu Firmware, R08sfcpu and 13 more | 2021-08-27 | 5.0 MEDIUM | 7.5 HIGH |
| Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R08/16/32/120SFCPU all versions, R08/16/32/120PSFCPU all versions) allows a remote unauthenticated attacker to acquire legitimate user names registered in the module via brute-force attack on user names. | |||||
| CVE-2021-1513 | 1 Cisco | 22 Sd-wan Vbond Orchestrator, Sd-wan Vmanage, Vedge-100b and 19 more | 2021-08-27 | 7.8 HIGH | 7.5 HIGH |
| A vulnerability in the vDaemon process of Cisco SD-WAN Software could allow an unauthenticated, remote attacker to cause a device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient handling of malformed packets. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. | |||||
| CVE-2021-1514 | 1 Cisco | 22 Sd-wan Vbond Orchestrator, Sd-wan Vmanage, Vedge-100b and 19 more | 2021-08-27 | 4.6 MEDIUM | 7.8 HIGH |
| A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with Administrator privileges on the underlying operating system. This vulnerability is due to insufficient input validation on certain CLI commands. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI. The attacker must be authenticated as a low-privileged user to execute the affected commands. A successful exploit could allow the attacker to execute commands with Administrator privileges. | |||||
| CVE-2021-33403 | 1 Blocklancertoken Project | 1 Blocklancertoken | 2021-08-27 | 5.0 MEDIUM | 7.5 HIGH |
| An integer overflow in the transfer function of a smart contract implementation for Lancer Token, an Ethereum ERC20 token, allows the owner to cause unexpected financial losses between two large accounts during a transaction. | |||||
| CVE-2020-7823 | 1 Hmtalk | 1 Daviewindy | 2021-08-27 | 6.8 MEDIUM | 7.8 HIGH |
| DaviewIndy has a Memory corruption vulnerability, triggered when the user opens a malformed image file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution. | |||||
| CVE-2021-28641 | 1 Adobe | 2 Acrobat Dc, Acrobat Reader Dc | 2021-08-27 | 6.8 MEDIUM | 7.8 HIGH |
| Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2021-28642 | 1 Adobe | 2 Acrobat Dc, Acrobat Reader Dc | 2021-08-26 | 6.8 MEDIUM | 7.8 HIGH |
| Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Out-of-bounds write vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2021-29704 | 1 Ibm | 1 Resilient Security Orchestration Automation And Response | 2021-08-26 | 5.0 MEDIUM | 7.5 HIGH |
| IBM Security SOAR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. | |||||
| CVE-2021-29802 | 1 Ibm | 1 Resilient Security Orchestration Automation And Response | 2021-08-26 | 5.0 MEDIUM | 7.5 HIGH |
| IBM Security SOAR performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. | |||||
| CVE-2021-28640 | 1 Adobe | 2 Acrobat Dc, Acrobat Reader Dc | 2021-08-26 | 6.0 MEDIUM | 7.3 HIGH |
| Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability. An authenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||