CVEs published February 22, 2021
66 CVEs were published on February 22, 2021: 1 critical, 2 high.
- Published
- 66
- Critical
- 1
- High
- 2
- Medium
- 0
- Low
- 0
- Unrated
- 63
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 24
- Google Chrome
- 9
- Nozomi Networks Guardian · Nozomi Networks CMC
- 2
- Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- 2
- Qualcomm Snapdragon Compute, Snapdragon Industrial IOT, Sna…
- 2
- smarty/smarty
- 2
- Atlassian Gadgets
- 1
- channels
- 1
- mantisbt/mantisbt
- 1
- Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- 1
Critical 1
High 2
- CVE-2021-26724Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2021-26725Authenticated command path traversal on timezone settings in Guardian/CMC before 20.0.7.4Nozomi Networks Guardian · Nozomi Networks CMC
Medium, low and unrated 63
- CVE-2021-27189The CIRA Canadian Shield app before 4.0.13 for iOS lacks SSL Certificate Validation.
- CVE-2021-23827Keybase Desktop Client before 5.6.0 on Windows and macOS, and before 5.6.1 on Linux, allows an attacker to obtain potentially sensitive medi
- CVE-2021-21156Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2021-21157Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruptGoogle Chrome
- CVE-2021-21155Heap buffer overflow in Tab Strip in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker who had compromised the rendeGoogle Chrome
- CVE-2021-21153Stack buffer overflow in GPU Process in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially perform out oGoogle Chrome
- CVE-2021-21154Heap buffer overflow in Tab Strip in Google Chrome prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer processGoogle Chrome
- CVE-2021-21152Heap buffer overflow in Media in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruptGoogle Chrome
- CVE-2021-21150Use after free in Downloads in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer prGoogle Chrome
- CVE-2021-21151Use after free in Payments in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to potentially perform a sandbox escape via a cGoogle Chrome
- CVE-2021-21149Stack buffer overflow in Data Transfer in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to perform out of bounds mGoogle Chrome
- CVE-2020-36232The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4Atlassian Gadgets
- CVE-2021-27279MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode).
- CVE-2021-27549Genymotion Desktop through 3.2.0 leaks the host's clipboard data to the Android application by default.
- CVE-2021-27228An issue was discovered in Shinobi through ocean version 1.
- CVE-2020-22475"Tasks" application version before 9.7.3 is affected by insecure permissions.
- CVE-2020-22474In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local file inclusion.
- CVE-2021-27564A stored XSS issue exists in Appspace 6.2.4.
- CVE-2020-24175Buffer overflow in Yz1 0.30 and 0.32, as used in IZArc 4.4, ZipGenius 6.3.2.3116, and Explzh (extension) 8.14, allows attackers to execute a
- CVE-2020-21224A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0.
- CVE-2020-19762Automated Logic Corporation (ALC) WebCTRL System 6.5 and prior allows remote attackers to execute any JavaScript code via a XSS payload for
- CVE-2021-27368The Contact page in Monica 2.19.1 allows stored XSS via the First Name field.
- CVE-2021-27370The Contact page in Monica 2.19.1 allows stored XSS via the Last Name field.
- CVE-2021-27371The Contact page in Monica 2.19.1 allows stored XSS via the Description field.
- CVE-2021-27559The Contact page in Monica 2.19.1 allows stored XSS via the Nickname field.
- CVE-2021-27369The Contact page in Monica 2.19.1 allows stored XSS via the Middle Name field.
- CVE-2020-3664Out of bound read access in hypervisor due to an invalid read access attempt by passing invalid addresses in Snapdragon Auto, Snapdragon ComQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11297Denial of service in WLAN module due to improper check of subtypes in logic where excessive frames are dropped in Snapdragon Auto, SnapdragoQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11287Allowing RTT frames to be linked with non randomized MAC address by comparing the sequence numbers can lead to information disclosure.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11296Arithmetic overflow can happen while processing NOA IE due to improper error handling in Snapdragon Auto, Snapdragon Compute, Snapdragon ConQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11283A buffer overflow can occur when playing an MKV clip due to lack of input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11286An Untrusted Pointer Dereference can occur while doing USB control transfers, if multiple requests of different standard request categories Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- CVE-2020-11282Improper access control when using mmap with the kgsl driver with a special offset value that can be provided to map the memstore of the GPUQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11280Denial of service while processing fine timing measurement request (FTMR) frame with reserved bits set in the FTM parameter IE due to impropQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11281Allowing RTT frames to be linked with non randomized MAC address by comparing the sequence numbers can lead to information disclosure.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11278Possible denial of service while handling host WMI command due to improper validation in Snapdragon Auto, Snapdragon Compute, Snapdragon ConQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11276Possible buffer over read while processing P2P IE and NOA attribute of beacon and probe response frames due to improper validation of P2P IEQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11277Possible race condition during async fastrpc session after sending RPC message due to the fastrpc ctx gets free during async session in SnapQualcomm Snapdragon Compute, Snapdragon Industrial IOT, Sna…
- CVE-2020-11275Possible buffer over-read while parsing quiet IE in Rx beacon frame due to improper check of IE length in received beacon in Snapdragon AutoQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11271Possible out of bounds while accessing global control elements due to race condition in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11272Before enqueuing a frame to the PE queue for further processing, an entry in a hash table can be deleted and using a stale version later canQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11270Possible denial of service due to RTT responder consistently rejects all FTMR by transmitting FTM1 with failure status in the FTM parameter Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11253Arbitrary memory write issue in video driver while setting the internal buffers in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectivQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11269Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Auto, SnapdraQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11223Out of bound in camera driver due to lack of check of validation of array index before copying into array in Snapdragon Auto, Snapdragon ComQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11203Stack overflow may occur if GSM/WCDMA broadcast config size received from user is larger than variable length array in Snapdragon Auto, SnapQualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- CVE-2020-11204Possible memory corruption and information leakage in sub-system due to lack of check for validity and boundary compliance for parameters thQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11195Out of bound write and read in TA while processing command from NS side due to improper length check on command and response buffers in SnapQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11198Key material used for TZ diag buffer encryption and other data related to log buffer is not wiped securely due to improper usage of memset iQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11194Possible out of bound access in TA while processing a command from NS side due to improper length check of response buffer in Snapdragon AutQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11177User can overwrite Security Code NV item without knowing current SPC due to improper validation of SPC code setting and device lock in SnapdQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11187Possible memory corruption in BSI module due to improper validation of parameter count in Snapdragon Auto, Snapdragon Connectivity, SnapdragQualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- CVE-2020-11170Out of bound memory access while playing music playbacks with crafted vorbis content due to improper checks in header extraction in SnapdragQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11147Use after free issue in audio modules while removing and freeing objects during list iteration due to incorrect usage of macro in SnapdragonQualcomm Snapdragon Compute, Snapdragon Industrial IOT, Sna…
- CVE-2020-11163Possible buffer overflow while updating ikev2 parameters due to lack of check of input validation for certain parameters received from the eQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-35571An issue was discovered in MantisBT through 2.24.3.mantisbt/mantisbt
- CVE-2020-35556An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172.
- CVE-2020-35664An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172.
- CVE-2020-35681Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope.channels
- CVE-2021-24115In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and he
- CVE-2021-3149On Netshield NANO 25 10.2.18 devices, /usr/local/webmin/System/manual_ping.cgi allows OS command injection (after authentication by the atta
- CVE-2021-26120Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.smarty/smarty
- CVE-2021-26119Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.smarty/smarty