CVEs published December 15, 2021
254 CVEs were published on December 15, 2021: 12 critical, 59 high. 4 are now in CISA KEV.
- Published
- 254
- Critical
- 12
- High
- 59
- Medium
- 21
- Low
- 0
- Unrated
- 162
- Now in CISA KEV
- 4
- Fix available
- 82
Most affected products
- Android
- 129
- Microsoft Windows
- 33
- Microsoft Defender for IoT
- 10
- FatPipe WARP · FatPipe IPVPN +1
- 5
- Enalean tuleap
- 3
- Microsoft HEVC Video Extensions
- 3
- Microsoft SharePoint Enterprise Server · Microsoft Share… +1
- 3
- yetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm
- 3
- elabftw
- 2
- Microsoft Office · Microsoft 365 Apps for Enterprise
- 2
Critical 12
- CVE-2021-43834Incorrect Authentication in elabftwelabftw
- CVE-2021-36888WordPress Image Hover Effects Ultimate plugin <= 9.6.1 - Unauthenticated Arbitrary Options Update leading to full website compromiseOxilab Image Hover Effects Ultimate
- CVE-2021-27856FatPipe software administrative account with no passwordFatPipe WARP · FatPipe IPVPN +1
- CVE-2021-43907Visual Studio Code WSL Extension Remote Code Execution VulnerabilityMicrosoft Visual Studio Code WSL Extension
- CVE-2021-43905Microsoft Office app Remote Code Execution VulnerabilityMicrosoft Office app
- CVE-2021-43899Microsoft 4K Wireless Display Adapter Remote Code Execution VulnerabilityMicrosoft 4K Wireless Display Adapter
- CVE-2021-43882Microsoft Defender for IoT Remote Code Execution VulnerabilityMicrosoft Defender for IoT
- CVE-2021-43215iSNS Server Memory Corruption Vulnerability Can Lead to Remote Code ExecutionMicrosoft Windows
- CVE-2021-42313Microsoft Defender for IoT Remote Code Execution VulnerabilityMicrosoft Defender for IoT
- CVE-2021-42311Microsoft Defender for IoT Remote Code Execution VulnerabilityMicrosoft Defender for IoT
- CVE-2021-4110NULL Pointer Dereference in mruby/mrubymruby/mruby
- CVE-2021-43113iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (com.itextpdf:itext7-core · com.itextpdf:itextpdf
High 59
- CVE-2021-43833Account takeover in eLabFTWelabftw
- CVE-2021-43836PHP file inclusion in the Sulu admin panelsulu · sulu/sulu
- CVE-2021-43835Privilege escalation in the Sulu Admin panelsulu · sulu/sulu
- CVE-2021-43831Files on the host computer can be accessed from the Gradio interfacegradio-app gradio · gradio
- CVE-2021-43806SQL injection in TuleapEnalean tuleap
- CVE-2021-1048In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free.Android
- CVE-2021-43935ICSMA-21-343-01 Hillrom Welch Allyn Cardio ProductsHillrom Welch Allyn Q-Stress Cardiac Stress Testing Syst… +5
- CVE-2021-27859Missing authorization vulnerability in FatPipe softwareFatPipe WARP · FatPipe IPVPN +1
- CVE-2021-27857FatPipe software allows unauthenticated configuration downloadFatPipe WARP · FatPipe IPVPN +1
- CVE-2021-27855FatPipe software allows privilege escalationFatPipe WARP · FatPipe IPVPN +1
- CVE-2021-4117Business Logic Errors in yetiforcecompany/yetiforcecrmyetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm
- CVE-2021-43892Microsoft BizTalk ESB Toolkit Spoofing VulnerabilityMicrosoft BizTalk ESB Toolkit
- CVE-2021-43893Windows Encrypting File System (EFS) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-43891Visual Studio Code Remote Code Execution VulnerabilityMicrosoft Visual Studio Code
- CVE-2021-43889Microsoft Defender for IoT Remote Code Execution VulnerabilityMicrosoft Defender for IoT
- CVE-2021-43890Windows AppX Installer Spoofing VulnerabilityMicrosoft App Installer
- CVE-2021-43888Microsoft Defender for IoT Information Disclosure VulnerabilityMicrosoft Defender for IoT
- CVE-2021-43883Windows Installer Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-43877ASP.NET Core and Visual Studio Elevation of Privilege VulnerabilityMicrosoft Visual Studio · Microsoft ASP.NET Core
- CVE-2021-43875Microsoft Office Graphics Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2021-43256Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Office Online Server · Microsoft Office +2
- CVE-2021-43248Windows Digital Media Receiver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-43247Windows TCP/IP Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-43245Windows Digital TV Tuner Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-43242Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2021-43239Windows Recovery Environment Agent Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-43240NTFS Set Short Name Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-43238Windows Remote Access Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-43237Windows Setup Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-43236Microsoft Message Queuing Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-43234Windows Fax Service Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-43233Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-43231Windows NTFS Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-43232Windows Event Tracing Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-43230Windows NTFS Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-43229Windows NTFS Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-43228SymCrypt Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-43226Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-43225Bot Framework SDK Remote Code Execution VulnerabilityMicrosoft Bot Framework SDK for .NET Framework
- CVE-2021-43222Microsoft Message Queuing Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-43223Windows Remote Access Connection Manager Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-43219DirectX Graphics Kernel File Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-43217Windows Encrypting File System (EFS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-43214Web Media Extensions Remote Code Execution VulnerabilityMicrosoft Raw Image Extension
- CVE-2021-43207Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-42320Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2021-42315Microsoft Defender for IoT Remote Code Execution VulnerabilityMicrosoft Defender for IoT
- CVE-2021-42314Microsoft Defender for IoT Remote Code Execution VulnerabilityMicrosoft Defender for IoT
- CVE-2021-42312Microsoft Defender for IoT Elevation of Privilege VulnerabilityMicrosoft Defender for IoT
- CVE-2021-42310Microsoft Defender for IoT Remote Code Execution VulnerabilityMicrosoft Defender for IoT
- CVE-2021-42309Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2021-42294Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2021-41365Microsoft Defender for IoT Remote Code Execution VulnerabilityMicrosoft Defender for IoT
- CVE-2021-41360HEVC Video Extensions Remote Code Execution VulnerabilityMicrosoft HEVC Video Extensions
- CVE-2021-40453HEVC Video Extensions Remote Code Execution VulnerabilityMicrosoft HEVC Video Extensions
- CVE-2021-41333Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-40452HEVC Video Extensions Remote Code Execution VulnerabilityMicrosoft HEVC Video Extensions
- CVE-2021-40441Windows Media Center Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-4111Business Logic Errors in yetiforcecompany/yetiforcecrmyetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm
Medium, low and unrated 183
- CVE-2021-45018Cross Site Scripting (XSS) vulnerability exists in Catfish <=6.3.0 via a Google search in url:/catfishcms/index.php/admin/Index/addmenu.html
- CVE-2021-45017Cross Site Request Forgery (CSRF) vulnerability exits in Catfish <=6.1.* when you upload an html file containing CSRF on the website that us
- CVE-2020-18985An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website o
- CVE-2020-18984A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 al
- CVE-2021-44350SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.topthink/framework
- CVE-2021-44116Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php.anchorcms/anchor-cms
- CVE-2021-35490Thruk before 2.44 allows XSS for a quick command.
- CVE-2021-45078stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) o
- CVE-2021-41276Indirect LDAP injection in TuleapEnalean tuleap
- CVE-2021-43782Indirect LDAP injection in TuleapEnalean tuleap
- CVE-2021-1038In UserDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack.Android
- CVE-2021-1039In NotificationAccessActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack.Android
- CVE-2021-1040In onCreate of BluetoothPairingSelectionFragment.java, there is a possible EoP due to a tapjacking/overlay attack.Android
- CVE-2021-39646Product: AndroidVersions: Android kernelAndroid ID: A-201537251References: N/AAndroid
- CVE-2021-39644Product: AndroidVersions: Android kernelAndroid ID: A-199809304References: N/AAndroid
- CVE-2021-0976In toBARK of floor0.c, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-39645Product: AndroidVersions: Android kernelAndroid ID: A-199805112References: N/AAndroid
- CVE-2021-39647In mon_smc_load_sp of gs101-sc/plat/samsung/exynos/soc/exynos9845/smc_booting.S, there is a possible reinitialization of TEE due to improperAndroid
- CVE-2021-39639In TBD of fvp.c, there is a possible way to glitch CPU behavior due to a missing permission check.Android
- CVE-2021-1047In valid_ipc_dram_addr of cm_access_control.c, there is a possible out of bounds read due to an integer overflow.Android
- CVE-2021-0995In registerSuggestionConnectionStatusListener of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, witAndroid
- CVE-2021-1004In getConfiguredNetworks of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissionAndroid
- CVE-2021-0973In isFileUri of UriUtil.java, there is a possible way to bypass ignoring file://URI attachment due to improper handling of case sensitivity.Android
- CVE-2021-1008In addSubInfo of SubscriptionController.java, there is a possible way to force the user to make a factory reset due to a logic error in the Android
- CVE-2021-0999In the broadcast definition in AndroidManifest.xml, there is a possible way to set the A2DP bluetooth device connection state due to a missiAndroid
- CVE-2021-1023In onCreate of RequestIgnoreBatteryOptimizations.java, there is a possible way to determine whether an app is installed, without query permiAndroid
- CVE-2021-39642In synchronous_process_io_entries of lwis_ioctl.c, there is a possible out of bounds write due to a race condition.Android
- CVE-2021-1046In lwis_dpm_update_clock of lwis_device_dpm.c, there is a possible out of bounds read due to an incorrect bounds check.Android
- CVE-2021-39638In periodic_io_work_func of lwis_periodic_io.c, there is a possible out of bounds write due to a use after free.Android
- CVE-2021-39643In ic_startRetrieveEntryValue of acropora/app/identity/ic.c, there is a possible bypass of defense-in-depth due to missing validation of theAndroid
- CVE-2021-1012In onResume of NotificationAccessDetails.java, there is a possible way to determine whether an app is installed, without query permissions, Android
- CVE-2021-1020In snoozeNotification of NotificationListenerService.java, there is a possible way to disable notification for an arbitrary user due to imprAndroid
- CVE-2021-1021In snoozeNotificationInt of NotificationManagerService.java, there is a possible way to disable notification for an arbitrary user due to imAndroid
- CVE-2021-1019In snoozeNotification of NotificationListenerService.java, there is a possible permission confusion due to a misleading user consent dialog.Android
- CVE-2021-1026In startRanging of RttServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to Android
- CVE-2021-1031In cancelNotificationsFromListener of NotificationManagerService.java, there is a possible way to determine whether an app is installed, witAndroid
- CVE-2021-1030In setNotificationsShownFromListener of NotificationManagerService.java, there is a possible way to determine whether an app is installed, wAndroid
- CVE-2021-39657In ufshcd_eh_device_reset_handler of ufshcd.c, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-1002In WT_Interpolate of eas_wtengine.c, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-39652In sec_ts_parsing_cmds of (TBD), there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2021-0989In hasManageOngoingCallsPermission of TelecomServiceImpl.java, there is a possible way to determine whether an app is installed, without queAndroid
- CVE-2021-1018In adjustStreamVolume of AudioService.java, there is a possible way to determine whether an app is installed, without query permissions, dueAndroid
- CVE-2021-0993In getOffsetBeforeAfter of TextLine.java, there is a possible denial of service due to resource exhaustion.Android
- CVE-2021-0994In requestRouteToHostAddress of ConnectivityService.java, there is a possible way to determine whether an app is installed, without query peAndroid
- CVE-2021-1025In hasNamedWallpaper of WallpaperManagerService.java, there is a possible way to determine whether an app is installed, without query permisAndroid
- CVE-2021-39637In CreateDeviceInfo of trusty_remote_provisioning_context.cpp, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-39653In (TBD) of (TBD), there is a possible way to boot with a hidden debug policy due to a missing warning to the user.Android
- CVE-2021-0998In 'ih264e_find_bskip_params()' of ih264e_me.c, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2021-1034In getLine1NumberForDisplay of PhoneInterfaceManager.java, there is apossible way to determine whether an app is installed, without queryperAndroid
- CVE-2021-1028In setClientStateLocked of SurfaceFlinger.cpp, there is a possible out of bounds write due to a use after free.Android
- CVE-2021-39651In TBD of TBD, there is a possible way to access PIN protected settings bypassing PIN confirmation due to a missing permission check.Android
- CVE-2021-1029In setClientStateLocked of SurfaceFlinger.cpp, there is a possible out of bounds write due to a use after free.Android
- CVE-2021-1027In setTransactionState of SurfaceFlinger, there is possible arbitrary code execution in a privileged process due to improper casting.Android
- CVE-2021-39655Product: AndroidVersions: Android kernelAndroid ID: A-192641593References: N/AAndroid
- CVE-2021-0978In getSerialForPackage of DeviceIdentifiersPolicyService.java, there is a possible way to determine whether an app is installed, without queAndroid
- CVE-2021-0984In onNullBinding of ManagedServices.java, there is a possible permission bypass due to an incorrectly unbound service.Android
- CVE-2021-0982In getOrganizationNameForUser of DevicePolicyManagerService.java, there is a possible organization name disclosure due to a missing permissiAndroid
- CVE-2021-0986In hasGrantedPolicy of DevicePolicyManagerService.java, there is a possible information disclosure about the device owner, profile owner, orAndroid
- CVE-2021-0983In createAdminSupportIntent of DevicePolicyManagerService.java, there is a possible disclosure of information about installed device/profileAndroid
- CVE-2021-0981In enqueueNotificationInternal of NotificationManagerService.java, there is a possible way to run a foreground service without showing a notAndroid
- CVE-2021-0988In getLaunchedFromUid and getLaunchedFromPackage of ActivityClientController.java, there is a possible way to determine whether an app is inAndroid
- CVE-2021-0979In isRequestPinItemSupported of ShortcutService.java, there is a possible cross-user leak of packages in which the default launcher supportsAndroid
- CVE-2021-1024In onEventReceived of EventResultPersister.java, there is a possible intent redirection due to a confused deputy.Android
- CVE-2021-0987In getNeighboringCellInfo of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query perAndroid
- CVE-2021-0997In handleUpdateNetworkState of GnssNetworkConnectivityHandler.java , there is a possible APN disclosure due to log information disclosure.Android
- CVE-2021-1001In PVInitVideoEncoder of mp4enc_api.cpp, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2021-0985In onReceive of AlertReceiver.java, there is a possible way to dismiss system dialog due to a missing permission check.Android
- CVE-2021-1009In setApplicationCategoryHint of PackageManagerService.java, there is a possible way to determine whether an app is installed, without queryAndroid
- CVE-2021-1010In getSigningKeySet of PackageManagerService.java, there is a missing permission check.Android
- CVE-2021-1003In adjustStreamVolume of AudioService.java, there is a possible way for unprivileged app to change audio stream volume due to a confused depAndroid
- CVE-2021-1011In setPackageStoppedState of PackageManagerService.java, there is a missing permission check.Android
- CVE-2021-1014In getNetworkTypeForSubscriber of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without querAndroid
- CVE-2021-1005In getDeviceIdWithFeature of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query perAndroid
- CVE-2021-1015In getMeidForSlot of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissionsAndroid
- CVE-2021-0990In getDeviceId of PhoneSubInfoController.java, there is a possible way to determine whether an app is installed, without query permissions, Android
- CVE-2021-1013In checkExistsAndEnforceCannotModifyImmutablyRestrictedPermission of PermissionManagerService.java, there is a possible way to determine wheAndroid
- CVE-2021-1032In getMimeGroup of PackageManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, Android
- CVE-2021-0769In onCreate of AllowBindAppWidgetActivity.java, there is a possible bypass of user interaction requirements due to unclear UI.Android
- CVE-2021-1006In several functions of DatabaseManager.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure.Android
- CVE-2021-1016In onCreate of UsbPermissionActivity.java, there is a possible way to grant an app access to USB without informed user consent due to a tapjAndroid
- CVE-2021-0977In phNxpNHal_DtaUpdate of phNxpNciHal_dta.cc, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2021-1017In AdapterService and GattService definition of AndroidManifest.xml, there is a possible way to disable bluetooth connection due to a missinAndroid
- CVE-2021-0991In OnMetadataChangedListener of AdvancedBluetoothDetailsHeaderController.java, there is a possible leak of Bluetooth MAC addresses due to loAndroid
- CVE-2021-0996In nfaHciCallback of HciEventManager.cpp, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-1022In btif_in_hf_client_generic_evt of btif_hf_client.cc, there is a possible Bluetooth service crash due to a missing null check.Android
- CVE-2021-0992In onCreate of PaymentDefaultDialog.java, there is a possible way to change a default payment app without user consent due to tapjack overlaAndroid
- CVE-2021-39656In __configfs_open_file of file.c, there is a possible use-after-free due to improper locking.Android
- CVE-2021-39649In regmap_exit of regmap.c, there is a possible use-after-free due to improper locking.Android
- CVE-2021-39650In (TBD) of (TBD), there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-1007In btu_hcif_process_event of btu_hcif.cc, there is a possible out of bounds read due to an incorrect bounds check.Android
- CVE-2021-39648In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a race condition.Android
- CVE-2021-39640In __dwc3_gadget_ep0_queue of ep0.c, there is a possible out of bounds write due to improper locking.Android
- CVE-2021-39641Product: AndroidVersions: Android kernelAndroid ID: A-126949257References: N/AAndroid
- CVE-2021-39636In do_ipt_get_ctl and do_ipt_set_ctl of ip_tables.c, there is a possible way to leak kernel information due to uninitialized data.Android
- CVE-2021-0675In alac decoder, there is a possible out of bounds write due to an incorrect bounds check.MT6570, MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, MT…
- CVE-2021-0904In SRAMROM, there is a possible permission bypass due to an insecure permission setting.MT6771, MT8183, MT8385, MT8788
- CVE-2021-0958In update of km_compat.cpp, there is a possible loss of potentially sensitive data due to a logic error in the code.Android
- CVE-2021-0969In getTitle of AccessPoint.java, there is a possible unhandled exception due to a missing null check.Android
- CVE-2021-0963In onCreate of KeyChainActivity.java, there is a possible way to use an app certificate stored in keychain due to a tapjacking/overlay attacAndroid
- CVE-2021-0967In vorbis_book_decodev_set of codebook.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0966In code generated by BuildParcelFields of generate_cpp.cpp, there is a possible way for a crafted parcelable to reveal uninitialized memory Android
- CVE-2021-0968In osi_malloc and osi_calloc of allocator.cc, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2021-0961In quota_proc_write of xt_quota2.c, there is a possible way to read kernel memory due to uninitialized data.Android
- CVE-2021-0970In createFromParcel of GpsNavigationMessage.java, there is a possible Parcel serialization/deserialization mismatch.Android
- CVE-2021-0952In doCropPhoto of PhotoSelectionHandler.java, there is a possible permission bypass due to a confused deputy.Android
- CVE-2021-0965In AndroidManifest.xml of Settings, there is a possible pairing of a Bluetooth device without user's consent due to a missing permission cheAndroid
- CVE-2021-0955In pf_write_buf of FuseDaemon.cpp, there is possible memory corruption due to a race condition.Android
- CVE-2021-0964In C2SoftMP3::process() of C2SoftMp3Dec.cpp, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2021-0956In NfcTag::discoverTechnologies (activation) of NfcTag.cpp, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2021-0953In setOnClickActivityIntent of SearchWidgetProvider.java, there is a possible way to access contacts and history bookmarks without permissioAndroid
- CVE-2021-0971In MPEG4Source::read of MPEG4Extractor.cpp, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0704In createNoCredentialsPermissionNotification and related functions of AccountManagerService.java, there is a possible way to retrieve accounAndroid
- CVE-2021-0954In ResolverActivity, there is a possible user interaction bypass due to a tapjacking/overlay attack.Android
- CVE-2021-1044In eicOpsDecryptAes128Gcm of acropora/app/identity/identity_support.c, there is a possible out of bounds write due to a missing bounds checkAndroid
- CVE-2021-1045Product: AndroidVersions: Android kernelAndroid ID: A-195580473References: N/AAndroid
- CVE-2021-1043In TBD of TBD, there is a possible downgrade attack due to under utilized anti-rollback protections.Android
- CVE-2021-1042In dsi_panel_debugfs_read_cmdset of dsi_panel.c, there is a possible disclosure of freed kernel heap memory due to a use after free.Android
- CVE-2021-1041In (TBD) of (TBD), there is a possible out of bounds read due to memory corruption.Android
- CVE-2021-0799In ActivityThread.java, there is a possible way to collide the content provider's authorities.Android
- CVE-2021-0918In gatt_process_notification of gatt_cl.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0919In getService of IServiceManager.cpp, there is a possible unhandled exception due to an integer overflow.Android
- CVE-2021-0920In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition.Android
- CVE-2021-0921In ParsingPackageImpl of ParsingPackageImpl.java, there is a possible parcel serialization/deserialization mismatch due to improper input vaAndroid
- CVE-2021-0922In enforceCrossUserOrProfilePermission of PackageManagerService.java, there is a possible bypass of INTERACT_ACROSS_PROFILES permission due Android
- CVE-2021-0923In createOrUpdate of Permission.java, there is a possible way to gain internal permissions due to a missing permission check.Android
- CVE-2021-0924In xhci_vendor_get_ops of xhci.c, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0925In rw_t4t_sm_detect_ndef of rw_t4t.cc, there is a possible out of bounds read due to an incorrect bounds check.Android
- CVE-2021-0649In stopVpnProfile of Vpn.java, there is a possible VPN profile reset due to a permissions bypass.Android
- CVE-2021-0650In WT_InterpolateNoLoop of eas_wtengine.c, there is a possible out of bounds read due to an incorrect bounds check.Android
- CVE-2021-0926In onCreate of NfcImportVCardActivity.java, there is a possible way to add a contact without user's consent due to a missing permission checAndroid
- CVE-2021-0927In requestChannelBrowsable of TvInputManagerService.java, there is a possible permission bypass due to a logic error in the code.Android
- CVE-2021-0928In createFromParcel of OutputConfiguration.java, there is a possible parcel serialization/deserialization mismatch due to improper input valAndroid
- CVE-2021-0929In ion_dma_buf_end_cpu_access and related functions of ion.c, there is a possible way to corrupt memory due to a use after free.Android
- CVE-2021-0930In phNxpNciHal_process_ext_rsp of phNxpNciHal_ext.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0931In getAlias of BluetoothDevice.java, there is a possible way to create misleading permission dialogs due to missing data filtering.Android
- CVE-2021-0889In Android TV , there is a possible silent pairing due to lack of rate limiting in the pairing flow.Android
- CVE-2021-0653In enqueueNotification of NetworkPolicyManagerService.java, there is a possible way to retrieve a trackable identifier due to a missing permAndroid
- CVE-2021-0932In showNotification of NavigationModeController.java, there is a possible confused deputy due to an unsafe PendingIntent.Android
- CVE-2021-0933In onCreate of CompanionDeviceActivity.java or DeviceChooserActivity.java, there is a possible way for HTML tags to interfere with a consentAndroid
- CVE-2021-0434In onReceive of BluetoothPermissionRequest.java, there is a possible phishing attack allowing a malicious Bluetooth device to acquire permisAndroid
- CVE-2021-42216A Broken or Risky Cryptographic Algorithm exists in AnonAddy 0.8.5 via VerificationController.php.
- CVE-2021-4119Improper Access Control in bookstackapp/bookstackbookstackapp/bookstack · ssddanbrown/bookstack
- CVE-2021-29847BMC firmware (IBM Power System S821LC Server (8001-12C) OP825.50) configuration changed to allow an authenticated user to open an insecure cIBM Power System S821LC Server
- CVE-2021-27858Missing authorization vulnerability in FatPipe softwareFatPipe WARP · FatPipe IPVPN +1
- CVE-2021-44655Online Pre-owned/Used Car Showroom Management System 1.0 contains a SQL injection authentication bypass vulnerability.
- CVE-2021-44653Online Magazine Management System 1.0 contains a SQL injection authentication bypass vulnerability.
- CVE-2021-43675Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php.
- CVE-2021-43518Teeworlds up to and including 0.7.5 is vulnerable to Buffer Overflow.
- CVE-2021-44657In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands
- CVE-2021-43908Visual Studio Code Spoofing VulnerabilityMicrosoft Visual Studio Code
- CVE-2021-43896Microsoft PowerShell Spoofing VulnerabilityMicrosoft CBL Mariner 2.0 x64 · Microsoft CBL Mariner 2.… +3
- CVE-2021-43880Windows Mobile Device Management Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-43255Microsoft Office Trust Center Spoofing VulnerabilityMicrosoft Office LTSC · Microsoft Office +1
- CVE-2021-43246Windows Hyper-V Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-43244Windows Kernel Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-43243VP9 Video Extensions Information Disclosure VulnerabilityMicrosoft VP9 Video Extensions
- CVE-2021-43235Storage Spaces Controller Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-43227Storage Spaces Controller Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-43224Windows Common Log File System Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-43216Microsoft Local Security Authority (LSA) Server Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-42295Visual Basic for Applications Information Disclosure VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2021-42293Microsoft Jet Red Database Engine and Access Connectivity Engine Elevation of Privilege VulnerabilityMicrosoft Office LTSC · Microsoft Office +1
- CVE-2021-4116Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmyetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm
- CVE-2021-20330Specific replication command with malformed oplog entries can crash secondariesMongoDB Server
- CVE-2021-45043HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter.
- CVE-2019-19138Ivanti Workspace Control before 10.4.50.0 allows attackers to degrade integrity.
- CVE-2020-23545IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ReadXPM_W+0x0000000000000531.
- CVE-2021-26787A cross site scripting (XSS) vulnerability in Genesys Workforce Management 8.5.214.20 can occur (during record deletion) via the Time-off pa
- CVE-2021-36450Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter.
- CVE-2021-38701Certain Motorola Solutions Avigilon devices allow XSS in the administrative UI.
- CVE-2021-40170An RF replay attack vulnerability in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-ITR-F1-BD_BL.A30.20181117, allows an
- CVE-2021-40171The absence of notifications regarding an ongoing RF jamming attack in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-IT
- CVE-2021-40826Clementine Music Player through 1.3.1 is vulnerable to a User Mode Write Access Violation, affecting the MP3 file parsing functionality at c
- CVE-2021-40827Clementine Music Player through 1.3.1 (when a GLib 2.0.0 DLL is used) is vulnerable to a Read Access Violation on Block Data Move, affecting
- CVE-2021-41560OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php.
- CVE-2021-42220A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow.dolibarr/dolibarr
- CVE-2021-42945A SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask.php.
- CVE-2021-43326Automox Agent before 32 on Windows incorrectly sets permissions on a temporary directory.
- CVE-2021-43325Automox Agent 33 on Windows incorrectly sets permissions on a temporary directory.
- CVE-2021-41557Sofico Miles RIA 2020.2 Build 127964T is affected by Stored Cross Site Scripting (XSS).
- CVE-2021-41844Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data.
- CVE-2021-41871An issue was discovered in Socomec REMOTE VIEW PRO 2.0.41.4.
- CVE-2021-41870An issue was discovered in the firmware update form in Socomec REMOTE VIEW PRO 2.0.41.4.