Search
Total
3203 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-30611 | 2 Fedoraproject, Microsoft | 3 Fedora, Edge, Edge Chromium | 2021-11-18 | 6.8 MEDIUM | 8.8 HIGH |
| Chromium: CVE-2021-30611 Use after free in WebRTC | |||||
| CVE-2021-30610 | 2 Fedoraproject, Microsoft | 3 Fedora, Edge, Edge Chromium | 2021-11-18 | 6.8 MEDIUM | 8.8 HIGH |
| Chromium: CVE-2021-30610 Use after free in Extensions API | |||||
| CVE-2021-30607 | 2 Fedoraproject, Microsoft | 3 Fedora, Edge, Edge Chromium | 2021-11-18 | 6.8 MEDIUM | 8.8 HIGH |
| Chromium: CVE-2021-30607 Use after free in Permissions | |||||
| CVE-2017-18017 | 1 Linux | 1 Linux Kernel | 2021-11-17 | 10.0 HIGH | 9.8 CRITICAL |
| The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action. | |||||
| CVE-2020-12901 | 2 Amd, Microsoft | 2 Radeon Software, Windows 10 | 2021-11-17 | 2.1 LOW | 5.5 MEDIUM |
| Arbitrary Free After Use in AMD Graphics Driver for Windows 10 may lead to KASLR bypass or information disclosure. | |||||
| CVE-2021-43275 | 1 Opendesign | 1 Drawings Software Development Kit | 2021-11-17 | 6.8 MEDIUM | 7.8 HIGH |
| A Use After Free vulnerability exists in the DGN file reading procedure in Open Design Alliance Drawings SDK before 2022.8. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. | |||||
| CVE-2021-42706 | 1 Advantech | 1 Webaccess Hmi Designer | 2021-11-17 | 4.6 MEDIUM | 7.8 HIGH |
| This vulnerability could allow an attacker to disclose information and execute arbitrary code on affected installations of WebAccess/MHI Designer | |||||
| CVE-2021-43274 | 1 Opendesign | 1 Drawings Software Development Kit | 2021-11-17 | 6.8 MEDIUM | 7.8 HIGH |
| A Use After Free Vulnerability exists in the Open Design Alliance Drawings SDK before 2022.11. The specific flaw exists within the parsing of DWF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. | |||||
| CVE-2021-36086 | 2 Fedoraproject, Selinux Project | 2 Fedora, Selinux | 2021-11-17 | 2.1 LOW | 3.3 LOW |
| The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list). | |||||
| CVE-2021-36085 | 2 Fedoraproject, Selinux Project | 2 Fedora, Selinux | 2021-11-17 | 2.1 LOW | 3.3 LOW |
| The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map). | |||||
| CVE-2021-36084 | 2 Fedoraproject, Selinux Project | 2 Fedora, Selinux | 2021-11-17 | 2.1 LOW | 3.3 LOW |
| The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper). | |||||
| CVE-2021-30266 | 1 Qualcomm | 408 Apq8009, Apq8009 Firmware, Apq8053 and 405 more | 2021-11-16 | 4.6 MEDIUM | 6.7 MEDIUM |
| Possible use after free due to improper memory validation when initializing new interface via Interface add command in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking | |||||
| CVE-2021-30264 | 1 Qualcomm | 388 Apq8009, Apq8009 Firmware, Apq8053 and 385 more | 2021-11-16 | 4.6 MEDIUM | 6.7 MEDIUM |
| Possible use after free due improper validation of reference from call back to internal store table in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking | |||||
| CVE-2021-30263 | 1 Qualcomm | 54 Aqt1000, Aqt1000 Firmware, Ar8031 and 51 more | 2021-11-16 | 4.4 MEDIUM | 7.8 HIGH |
| Possible race condition can occur due to lack of synchronization mechanism when On-Device Logging node open twice concurrently in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music | |||||
| CVE-2012-1180 | 3 Debian, F5, Fedoraproject | 3 Debian Linux, Nginx, Fedora | 2021-11-10 | 5.0 MEDIUM | N/A |
| Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obtain sensitive information from process memory via a crafted backend response, in conjunction with a client request. | |||||
| CVE-2021-41220 | 1 Google | 1 Tensorflow | 2021-11-10 | 4.6 MEDIUM | 7.8 HIGH |
| TensorFlow is an open source platform for machine learning. In affected versions the async implementation of `CollectiveReduceV2` suffers from a memory leak and a use after free. This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected. | |||||
| CVE-2021-42074 | 1 Barrier Project | 1 Barrier | 2021-11-09 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Barrier before 2.3.4. An unauthenticated attacker can cause a segmentation fault in the barriers component (aka the server-side implementation of Barrier) by quickly opening and closing TCP connections while sending a Hello message for each TCP session. | |||||
| CVE-2021-43412 | 1 Gnu | 1 Hurd | 2021-11-09 | 7.2 HIGH | 7.8 HIGH |
| An issue was discovered in GNU Hurd before 0.9 20210404-9. libports accepts fake notification messages from any client on any port, which can lead to port use-after-free. This can be exploited for local privilege escalation to get full root access. | |||||
| CVE-2021-43400 | 1 Bluez | 1 Bluez | 2021-11-08 | 6.4 MEDIUM | 9.1 CRITICAL |
| An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call. | |||||
| CVE-2021-36008 | 2 Adobe, Microsoft | 2 Illustrator, Windows | 2021-11-06 | 4.3 MEDIUM | 5.5 MEDIUM |
| Adobe Illustrator version 25.2.3 (and earlier) is affected by an Use-after-free vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to read arbitrary file system information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2021-40726 | 3 Adobe, Apple, Microsoft | 4 Acrobat Dc, Acrobat Reader Dc, Macos and 1 more | 2021-11-06 | 6.8 MEDIUM | 7.8 HIGH |
| Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability when processing AcroForm field that could result in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. | |||||
| CVE-2021-40725 | 3 Adobe, Apple, Microsoft | 4 Acrobat Dc, Acrobat Reader Dc, Macos and 1 more | 2021-11-06 | 6.8 MEDIUM | 7.8 HIGH |
| Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability when processing AcroForm listbox that could result in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. | |||||
| CVE-2021-38498 | 1 Mozilla | 3 Firefox, Firefox Esr, Thunderbird | 2021-11-04 | 5.0 MEDIUM | 7.5 HIGH |
| During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2. | |||||
| CVE-2020-14351 | 3 Debian, Linux, Redhat | 3 Debian Linux, Linux Kernel, Enterprise Linux | 2021-11-04 | 4.6 MEDIUM | 7.8 HIGH |
| A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. | |||||
| CVE-2021-28562 | 3 Adobe, Apple, Microsoft | 4 Acrobat Dc, Acrobat Reader Dc, Macos and 1 more | 2021-11-04 | 6.8 MEDIUM | 8.8 HIGH |
| Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability when executing search queries through Javascript. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2020-6492 | 1 Google | 1 Chrome | 2021-11-03 | 6.8 MEDIUM | 9.6 CRITICAL |
| Use after free in ANGLE in Google Chrome prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. | |||||
| CVE-2021-30902 | 1 Apple | 2 Ipad Os, Iphone Os | 2021-11-02 | 4.6 MEDIUM | 7.8 HIGH |
| A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8.1 and iPadOS 14.8.1, iOS 15.1 and iPadOS 15.1. A local attacker may be able to cause unexpected application termination or arbitrary code execution. | |||||
| CVE-2021-22463 | 1 Huawei | 1 Harmonyos | 2021-11-01 | 2.1 LOW | 5.5 MEDIUM |
| A component of the HarmonyOS has a Use After Free vulnerability . Local attackers may exploit this vulnerability to cause Kernel Information disclosure. | |||||
| CVE-2021-22466 | 1 Huawei | 1 Harmonyos | 2021-11-01 | 2.1 LOW | 5.5 MEDIUM |
| A component of the HarmonyOS has a Use After Free vulnerability. Local attackers may exploit this vulnerability to cause kernel crash. | |||||
| CVE-2021-30886 | 1 Apple | 5 Ipad Os, Iphone Os, Macos and 2 more | 2021-11-01 | 9.3 HIGH | 7.8 HIGH |
| A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. An application may be able to execute arbitrary code with kernel privileges. | |||||
| CVE-2019-13511 | 1 Rockwellautomation | 1 Arena Simulation Software | 2021-10-28 | 4.3 MEDIUM | 3.3 LOW |
| Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200. A maliciously crafted Arena file opened by an unsuspecting user may result in the limited exposure of information related to the targeted workstation. | |||||
| CVE-2021-37122 | 1 Huawei | 8 Cloudengine 12800, Cloudengine 12800 Firmware, Cloudengine 5800 and 5 more | 2021-10-28 | 3.3 LOW | 6.5 MEDIUM |
| There is a use-after-free (UAF) vulnerability in Huawei products. An attacker may craft specific packets to exploit this vulnerability. Successful exploitation may cause the service abnormal. Affected product versions include:CloudEngine 12800 V200R005C10SPC800,V200R019C00SPC800;CloudEngine 5800 V200R005C10SPC800,V200R019C00SPC800;CloudEngine 6800 V200R005C10SPC800,V200R005C20SPC800,V200R019C00SPC800;CloudEngine 7800 V200R005C10SPC800,V200R019C00SPC800. | |||||
| CVE-2021-38467 | 1 Auvesy | 1 Versiondog | 2021-10-27 | 5.5 MEDIUM | 8.1 HIGH |
| A specific function code receives a raw pointer supplied by the user and deallocates this pointer. The user can then control what memory regions will be freed and cause use-after-free condition. | |||||
| CVE-2021-36055 | 1 Adobe | 1 Xmp Toolkit Software Development Kit | 2021-10-27 | 9.3 HIGH | 7.8 HIGH |
| XMP Toolkit SDK versions 2020.1 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2021-0703 | 1 Google | 1 Android | 2021-10-26 | 7.2 HIGH | 6.8 MEDIUM |
| In SecondStageMain of init.cpp, there is a possible use after free due to incorrect shared_ptr usage. This could lead to local escalation of privilege if the attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-184569329 | |||||
| CVE-2021-30315 | 1 Qualcomm | 30 Mdm9628, Mdm9628 Firmware, Qca6564a and 27 more | 2021-10-26 | 7.2 HIGH | 7.8 HIGH |
| Improper handling of sensor HAL structure in absence of sensor can lead to use after free in Snapdragon Auto | |||||
| CVE-2021-0483 | 1 Google | 1 Android | 2021-10-26 | 4.4 MEDIUM | 7.8 HIGH |
| In multiple methods of AAudioService, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-153358911 | |||||
| CVE-2021-3455 | 1 Zephyrproject | 1 Zephyr | 2021-10-26 | 5.0 MEDIUM | 7.5 HIGH |
| Disconnecting L2CAP channel right after invalid ATT request leads freeze. Zephyr versions >= 2.4.0, >= 2.5.0 contain Use After Free (CWE-416). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7g38-3x9v-v7vp | |||||
| CVE-2021-0936 | 1 Google | 1 Android | 2021-10-26 | 4.6 MEDIUM | 7.8 HIGH |
| In acc_read of f_accessory.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-173789633References: Upstream kernel | |||||
| CVE-2021-0935 | 1 Google | 1 Android | 2021-10-26 | 7.2 HIGH | 6.7 MEDIUM |
| In ip6_xmit of ip6_output.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-168607263References: Upstream kernel | |||||
| CVE-2021-0941 | 1 Google | 1 Android | 2021-10-26 | 7.2 HIGH | 6.7 MEDIUM |
| In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-154177719References: Upstream kernel | |||||
| CVE-2021-40728 | 3 Adobe, Apple, Microsoft | 6 Acrobat, Acrobat Dc, Acrobat Reader and 3 more | 2021-10-21 | 6.8 MEDIUM | 7.8 HIGH |
| Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a use-after-free vulnerability in the processing of the GetURL function on a global object window that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2021-38438 | 1 Fatek | 1 Winproladder | 2021-10-21 | 6.8 MEDIUM | 7.8 HIGH |
| A use after free vulnerability in FATEK Automation WinProladder versions 3.30 and prior may be exploited when a valid user opens a malformed project file, which may allow arbitrary code execution. | |||||
| CVE-2021-40730 | 3 Adobe, Apple, Microsoft | 6 Acrobat, Acrobat Dc, Acrobat Reader and 3 more | 2021-10-21 | 4.3 MEDIUM | 3.3 LOW |
| Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a use-after-free that allow a remote attacker to disclose sensitive information on affected installations of of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG2000 images. | |||||
| CVE-2021-29657 | 1 Linux | 1 Linux Kernel | 2021-10-18 | 6.9 MEDIUM | 7.4 HIGH |
| arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when there are nested guests, aka CID-a58d9166a756. This occurs because of a TOCTOU race condition associated with a VMCB12 double fetch in nested_svm_vmrun. | |||||
| CVE-2020-22617 | 1 Ardour | 1 Ardour | 2021-10-15 | 7.5 HIGH | 9.8 CRITICAL |
| Ardour v5.12 contains a use-after-free vulnerability in the component ardour/libs/pbd/xml++.cc when using xmlFreeDoc and xmlXPathFreeContext. | |||||
| CVE-2021-39835 | 2 Adobe, Microsoft | 2 Framemaker, Windows | 2021-10-08 | 4.3 MEDIUM | 4.3 MEDIUM |
| Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by a use-after-free vulnerability in the processing of a malformed PDF file that could result in disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file. | |||||
| CVE-2021-0695 | 1 Google | 1 Android | 2021-10-08 | 2.1 LOW | 5.5 MEDIUM |
| In get_sock_stat of xt_qtaguid.c, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-184018316References: Upstream kernel | |||||
| CVE-2021-0684 | 1 Google | 1 Android | 2021-10-08 | 4.6 MEDIUM | 7.8 HIGH |
| In TouchInputMapper::sync of TouchInputMapper.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-179839665 | |||||
| CVE-2021-39839 | 3 Adobe, Apple, Microsoft | 6 Acrobat, Acrobat Dc, Acrobat Reader and 3 more | 2021-10-06 | 6.8 MEDIUM | 7.8 HIGH |
| Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm getItem action that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||