Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-25391 | 1 Google | 1 Android | 2021-06-16 | 2.1 LOW | 4.0 MEDIUM |
| Intent redirection vulnerability in Secure Folder prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action. | |||||
| CVE-2021-25390 | 1 Google | 1 Android | 2021-06-16 | 1.9 LOW | 4.0 MEDIUM |
| Intent redirection vulnerability in PhotoTable prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action. | |||||
| CVE-2021-25418 | 1 Samsung | 1 Internet | 2021-06-16 | 4.4 MEDIUM | 7.8 HIGH |
| Improper component protection vulnerability in Samsung Internet prior to version 14.0.1.62 allows untrusted applications to execute arbitrary activity in specific condition. | |||||
| CVE-2021-25395 | 1 Google | 1 Android | 2021-06-16 | 4.4 MEDIUM | 6.4 MEDIUM |
| A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised. | |||||
| CVE-2021-25394 | 1 Google | 1 Android | 2021-06-16 | 4.4 MEDIUM | 6.4 MEDIUM |
| A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is compromised. | |||||
| CVE-2021-25393 | 1 Google | 1 Android | 2021-06-16 | 2.1 LOW | 5.5 MEDIUM |
| Improper sanitization of incoming intent in SecSettings prior to SMR MAY-2021 Release 1 allows local attackers to get permissions to access system uid data. | |||||
| CVE-2021-25408 | 2 Google, Samsung | 5 Android, Exynos 2100, Exynos 980 and 2 more | 2021-06-16 | 4.6 MEDIUM | 7.8 HIGH |
| A possible buffer overflow vulnerability in NPU driver prior to SMR JUN-2021 Release 1 allows arbitrary memory write and code execution. | |||||
| CVE-2020-23312 | 1 Jerryscript | 1 Jerryscript | 2021-06-16 | 5.0 MEDIUM | 7.5 HIGH |
| There is an Assertion 'context.status_flags & PARSER_SCANNING_SUCCESSFUL' failed at js-parser.c:2185 in parser_parse_source in JerryScript 2.2.0. | |||||
| CVE-2021-25415 | 2 Google, Samsung | 5 Android, Exynos 9610, Exynos 9810 and 2 more | 2021-06-16 | 2.1 LOW | 5.5 MEDIUM |
| Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to remap EL2 memory as writable. | |||||
| CVE-2021-25398 | 1 Samsung | 1 Bixby Voice | 2021-06-16 | 2.1 LOW | 3.3 LOW |
| Intent redirection vulnerability in Bixby Voice prior to version 3.1.12 allows attacker to access contacts. | |||||
| CVE-2021-25396 | 2 Google, Samsung | 5 Android, Exynos 2100, Exynos 980 and 2 more | 2021-06-16 | 4.6 MEDIUM | 6.7 MEDIUM |
| An improper input validation vulnerability in NPU firmware prior to SMR MAY-2021 Release 1 allows arbitrary memory write and code execution. | |||||
| CVE-2021-31929 | 1 Annexcloud | 1 Loyalty Experience Platform | 2021-06-16 | 4.0 MEDIUM | 4.3 MEDIUM |
| Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to modify loyalty campaigns and settings, such as fraud prevention, coupon groups, email templates, or referrals. | |||||
| CVE-2020-11266 | 1 Qualcomm | 52 Ar7420, Ar7420 Firmware, Ar9580 and 49 more | 2021-06-16 | 2.1 LOW | 6.5 MEDIUM |
| Image address is dereferenced before validating its range which can cause potential QSEE information leakage in Snapdragon Wired Infrastructure and Networking | |||||
| CVE-2021-25397 | 1 Google | 1 Android | 2021-06-16 | 2.1 LOW | 5.5 MEDIUM |
| An improper access control vulnerability in TelephonyUI prior to SMR MAY-2021 Release 1 allows local attackers to write arbitrary files of telephony process via untrusted applications. | |||||
| CVE-2020-23313 | 1 Jerryscript | 1 Jerryscript | 2021-06-16 | 5.0 MEDIUM | 7.5 HIGH |
| There is an Assertion 'scope_stack_p > context_p->scope_stack_p' failed at js-scanner-util.c:2510 in scanner_literal_is_created in JerryScript 2.2.0 | |||||
| CVE-2020-23314 | 1 Jerryscript | 1 Jerryscript | 2021-06-16 | 5.0 MEDIUM | 7.5 HIGH |
| There is an Assertion 'block_found' failed at js-parser-statm.c:2003 parser_parse_try_statement_end in JerryScript 2.2.0. | |||||
| CVE-2020-23319 | 1 Jerryscript | 1 Jerryscript | 2021-06-16 | 5.0 MEDIUM | 7.5 HIGH |
| There is an Assertion in '(flags >> CBC_STACK_ADJUST_SHIFT) >= CBC_STACK_ADJUST_BASE || (CBC_STACK_ADJUST_BASE - (flags >> CBC_STACK_ADJUST_SHIFT)) <= context_p->stack_depth' in parser_emit_cbc_backward_branch in JerryScript 2.2.0. | |||||
| CVE-2020-11262 | 1 Qualcomm | 778 Apq8009, Apq8009 Firmware, Apq8009w and 775 more | 2021-06-16 | 4.4 MEDIUM | 7.0 HIGH |
| A race between command submission and destroying the context can cause an invalid context being added to the list leads to use after free issue. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | |||||
| CVE-2020-23311 | 1 Jerryscript | 1 Jerryscript | 2021-06-16 | 5.0 MEDIUM | 7.5 HIGH |
| There is an Assertion 'context_p->token.type == LEXER_RIGHT_BRACE || context_p->token.type == LEXER_ASSIGN || context_p->token.type == LEXER_COMMA' failed at js-parser-expr.c:3230 in parser_parse_object_initializer in JerryScript 2.2.0. | |||||
| CVE-2020-11261 | 1 Qualcomm | 798 Apq8009, Apq8009 Firmware, Apq8009w and 795 more | 2021-06-16 | 7.2 HIGH | 7.8 HIGH |
| Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | |||||
| CVE-2020-23322 | 1 Jerryscript | 1 Jerryscript | 2021-06-16 | 5.0 MEDIUM | 7.5 HIGH |
| There is an Assertion in 'context_p->token.type == LEXER_RIGHT_BRACE || context_p->token.type == LEXER_ASSIGN || context_p->token.type == LEXER_COMMA' in parser_parse_object_initializer in JerryScript 2.2.0. | |||||
| CVE-2020-11258 | 1 Qualcomm | 52 Ar7420, Ar7420 Firmware, Ar9580 and 49 more | 2021-06-16 | 7.2 HIGH | 8.8 HIGH |
| Memory corruption due to lack of validation of pointer arguments passed to Trustzone BSP in Snapdragon Wired Infrastructure and Networking | |||||
| CVE-2020-11257 | 1 Qualcomm | 52 Ar7420, Ar7420 Firmware, Ar9580 and 49 more | 2021-06-16 | 7.2 HIGH | 8.8 HIGH |
| Memory corruption due to lack of validation of pointer arguments passed to TrustZone BSP in Snapdragon Wired Infrastructure and Networking | |||||
| CVE-2020-11256 | 1 Qualcomm | 52 Ar7420, Ar7420 Firmware, Ar9580 and 49 more | 2021-06-16 | 7.2 HIGH | 8.8 HIGH |
| Memory corruption due to lack of check of validation of pointer to buffer passed to trustzone in Snapdragon Wired Infrastructure and Networking | |||||
| CVE-2020-11259 | 1 Qualcomm | 52 Ar7420, Ar7420 Firmware, Ar9580 and 49 more | 2021-06-16 | 7.2 HIGH | 8.8 HIGH |
| Memory corruption due to lack of validation of pointer arguments passed to Trustzone BSP in Snapdragon Wired Infrastructure and Networking | |||||
| CVE-2021-26199 | 1 Jerryscript | 1 Jerryscript | 2021-06-16 | 4.3 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in JerryScript 2.4.0. There is a heap-use-after-free in ecma_bytecode_ref in ecma-helpers.c file. | |||||
| CVE-2021-26198 | 1 Jerryscript | 1 Jerryscript | 2021-06-16 | 4.3 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in JerryScript 2.4.0. There is a SEVG in ecma_deref_bigint in ecma-helpers.c file. | |||||
| CVE-2021-26197 | 1 Jerryscript | 1 Jerryscript | 2021-06-16 | 4.3 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in JerryScript 2.4.0. There is a SEGV in main_print_unhandled_exception in main-utils.c file. | |||||
| CVE-2020-14380 | 1 Redhat | 1 Satellite | 2021-06-16 | 6.0 MEDIUM | 7.5 HIGH |
| An account takeover flaw was found in Red Hat Satellite 6.7.2 onward. A potential attacker with proper authentication to the relevant external authentication source (SSO or Open ID) can claim the privileges of already existing local users of Satellite. | |||||
| CVE-2021-26195 | 1 Jerryscript | 1 Jerryscript | 2021-06-16 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in JerryScript 2.4.0. There is a heap-buffer-overflow in lexer_parse_number in js-lexer.c file. | |||||
| CVE-2021-26194 | 1 Jerryscript | 1 Jerryscript | 2021-06-16 | 4.3 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in JerryScript 2.4.0. There is a heap-use-after-free in ecma_is_lexical_environment in the ecma-helpers.c file. | |||||
| CVE-2020-23323 | 1 Jerryscript | 1 Jerryscript | 2021-06-16 | 7.5 HIGH | 9.8 CRITICAL |
| There is a heap-buffer-overflow at re-parser.c in re_parse_char_escape in JerryScript 2.2.0. | |||||
| CVE-2020-23321 | 1 Jerryscript | 1 Jerryscript | 2021-06-16 | 7.5 HIGH | 9.8 CRITICAL |
| There is a heap-buffer-overflow at lit-strings.c:431 in lit_read_code_unit_from_utf8 in JerryScript 2.2.0. | |||||
| CVE-2020-23310 | 1 Jerryscript | 1 Jerryscript | 2021-06-16 | 5.0 MEDIUM | 7.5 HIGH |
| There is an Assertion 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' failed at js-parser-statm.c:733 in parser_parse_function_statement in JerryScript 2.2.0. | |||||
| CVE-2020-23309 | 1 Jerryscript | 1 Jerryscript | 2021-06-16 | 5.0 MEDIUM | 7.5 HIGH |
| There is an Assertion 'context_p->stack_depth == context_p->context_stack_depth' failed at js-parser-statm.c:2756 in parser_parse_statements in JerryScript 2.2.0. | |||||
| CVE-2020-26136 | 1 Silverstripe | 1 Silverstripe | 2021-06-16 | 4.0 MEDIUM | 6.5 MEDIUM |
| In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication. | |||||
| CVE-2020-26138 | 1 Silverstripe | 1 Silverstripe | 2021-06-16 | 5.0 MEDIUM | 5.3 MEDIUM |
| In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation. | |||||
| CVE-2020-23308 | 1 Jerryscript | 1 Jerryscript | 2021-06-16 | 5.0 MEDIUM | 7.5 HIGH |
| There is an Assertion 'context_p->stack_top_uint8 == LEXER_EXPRESSION_START' at js-parser-expr.c:3565 in parser_parse_expression in JerryScript 2.2.0. | |||||
| CVE-2020-23306 | 1 Jerryscript | 1 Jerryscript | 2021-06-16 | 7.5 HIGH | 9.8 CRITICAL |
| There is a stack-overflow at ecma-regexp-object.c:535 in ecma_regexp_match in JerryScript 2.2.0. | |||||
| CVE-2020-27384 | 1 Arena | 1 Guild Wars 2 | 2021-06-16 | 4.6 MEDIUM | 7.8 HIGH |
| The Gw2-64.exe in Guild Wars 2 launcher version 106916 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the existing executable file with a binary of his choice. The vulnerability exist due to the improper permissions, with the 'F' flag (Full Control) for 'Everyone' group, making the entire directory 'Guild Wars 2' and its files and sub-dirs world-writable. | |||||
| CVE-2020-24662 | 1 Smartstream | 1 Transaction Lifecycle Management Reconciliations-premium | 2021-06-16 | 3.5 LOW | 5.4 MEDIUM |
| SmartStream Transaction Lifecycle Management (TLM) Reconciliation Premium (RP) <3.1.0 allows XSS. This was fixed in TLM RP 3.1.0. | |||||
| CVE-2021-20731 | 1 Buffalo | 4 Wsr-1166dhp3, Wsr-1166dhp3 Firmware, Wsr-1166dhp4 and 1 more | 2021-06-16 | 8.3 HIGH | 8.8 HIGH |
| WSR-1166DHP3 firmware Ver.1.16 and prior and WSR-1166DHP4 firmware Ver.1.02 and prior allow an attacker to execute arbitrary OS commands with root privileges via unspecified vectors. | |||||
| CVE-2016-4570 | 2 Debian, Mini-xml Project | 2 Debian Linux, Mini-xml | 2021-06-16 | 7.1 HIGH | 5.5 MEDIUM |
| The mxmlDelete function in mxml-node.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via crafted xml file. | |||||
| CVE-2021-25383 | 1 Google | 1 Android | 2021-06-16 | 7.5 HIGH | 9.8 CRITICAL |
| An improper input validation vulnerability in scmn_mfal_read() in libsapeextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute arbitrary code on mediaextractor process. | |||||
| CVE-2020-23303 | 1 Jerryscript | 1 Jerryscript | 2021-06-16 | 7.5 HIGH | 9.8 CRITICAL |
| There is a heap-buffer-overflow at jmem-poolman.c:165 in jmem_pools_collect_empty in JerryScript 2.2.0. | |||||
| CVE-2021-20095 | 2021-06-16 | N/A | N/A | ||
| ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none. | |||||
| CVE-2021-22214 | 1 Gitlab | 1 Gitlab | 2021-06-16 | 4.3 MEDIUM | 8.6 HIGH |
| When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited | |||||
| CVE-2021-31701 | 1 Mintty Project | 1 Mintty | 2021-06-16 | 5.0 MEDIUM | 7.5 HIGH |
| Mintty before 3.4.7 mishandles Bracketed Paste Mode. | |||||
| CVE-2021-32641 | 1 Auth0 | 1 Lock | 2021-06-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including `11.30.0` are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's `flashMessage` feature is utilized and user input or data from URL parameters is incorporated into the `flashMessage` or the library's `languageDictionary` feature is utilized and user input or data from URL parameters is incorporated into the `languageDictionary`. The vulnerability is patched in version 11.30.1. | |||||
| CVE-2020-1719 | 1 Redhat | 1 Wildfly | 2021-06-16 | 5.5 MEDIUM | 5.4 MEDIUM |
| A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before wildfly 20.0.0.Final are affected. | |||||