Total
2926 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-3820 | 3 Canonical, Gnome, Opensuse | 3 Ubuntu Linux, Gnome-shell, Leap | 2021-09-29 | 4.6 MEDIUM | 4.3 MEDIUM |
| It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions. | |||||
| CVE-2021-39215 | 1 8x8 | 1 Jitsi Meet | 2021-09-28 | 5.0 MEDIUM | 7.5 HIGH |
| Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue is fixed in Jitsi Meet 2.0.5963. There are no known workarounds aside from updating. | |||||
| CVE-2021-41317 | 1 Xss Hunter Express Project | 1 Xss Hunter Express | 2021-09-28 | 7.5 HIGH | 9.8 CRITICAL |
| XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths. | |||||
| CVE-2021-33700 | 1 Sap | 1 Business One | 2021-09-28 | 4.6 MEDIUM | 7.8 HIGH |
| SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the victim without knowing his/her password. The attacker could so obtain highly sensitive information which the attacker could use to take substantial control of the vulnerable application. | |||||
| CVE-2021-3145 | 1 Ionic | 1 Identity Vault | 2021-09-23 | 7.2 HIGH | 6.7 MEDIUM |
| In Ionic Identity Vault before 5, a local root attacker on an Android device can bypass biometric authentication. | |||||
| CVE-2021-25466 | 1 Samsung | 1 Internet | 2021-09-23 | 5.0 MEDIUM | 5.9 MEDIUM |
| Improper scheme check vulnerability in Samsung Internet prior to version 15.0.2.47 allows attackers to perform Man-in-the-middle attack and obtain Samsung Account token. | |||||
| CVE-2021-25451 | 1 Google | 1 Android | 2021-09-23 | 4.3 MEDIUM | 3.3 LOW |
| A PendingIntent hijacking in NetworkPolicyManagerService prior to SMR Sep-2021 Release 1 allows attackers to get IMSI data. | |||||
| CVE-2021-28495 | 1 Arista | 2 7130, Metamako Operating System | 2021-09-22 | 6.8 MEDIUM | 9.8 CRITICAL |
| In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, user authentication can be bypassed when API access is enabled via the JSON-RPC APIs. This issue affects: Arista Metamako Operating System All releases in the MOS-0.1x train MOS-0.13 and post releases in the MOS-0.1x train MOS-0.26.6 and below releases in the MOS-0.2x train MOS-0.31.1 and below releases in the MOS-0.3x train | |||||
| CVE-2021-28494 | 1 Arista | 2 7130, Metamako Operating System | 2021-09-22 | 6.5 MEDIUM | 8.8 HIGH |
| In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, authentication is bypassed by unprivileged users who are accessing the Web UI. This issue affects: Arista Metamako Operating System MOS-0.34.0 and prior releases | |||||
| CVE-2021-28493 | 1 Arista | 2 7130, Metamako Operating System | 2021-09-22 | 4.6 MEDIUM | 7.8 HIGH |
| In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, a user may be able to execute commands despite not having the privileges to do so. This issue affects: Arista Metamako Operating System All releases in the MOS-0.1x train MOS-0.32.0 and prior releases | |||||
| CVE-2021-34786 | 1 Cisco | 1 Broadworks Commpilot Application Software | 2021-09-17 | 4.0 MEDIUM | 4.9 MEDIUM |
| Multiple vulnerabilities in Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to delete arbitrary user accounts or gain elevated privileges on an affected system. | |||||
| CVE-2021-1863 | 1 Apple | 2 Ipados, Iphone Os | 2021-09-16 | 2.1 LOW | 2.4 LOW |
| An issue existed with authenticating the action triggered by an NFC tag. The issue was addressed with improved action authentication. This issue is fixed in iOS 14.5 and iPadOS 14.5. A person with physical access to an iOS device may be able to place phone calls to any phone number. | |||||
| CVE-2021-30668 | 1 Apple | 1 Macos | 2021-09-16 | 2.1 LOW | 4.6 MEDIUM |
| This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4. A person with physical access to a Mac may be able to bypass Login Window during a software update. | |||||
| CVE-2021-30667 | 1 Apple | 2 Ipados, Iphone Os | 2021-09-16 | 4.8 MEDIUM | 5.4 MEDIUM |
| A logic issue was addressed with improved validation. This issue is fixed in iOS 14.6 and iPadOS 14.6. An attacker in WiFi range may be able to force a client to use a less secure authentication mechanism. | |||||
| CVE-2021-1862 | 1 Apple | 2 Ipados, Iphone Os | 2021-09-16 | 2.1 LOW | 2.4 LOW |
| Description: A person with physical access may be able to access contacts. This issue is fixed in iOS 14.5 and iPadOS 14.5. Impact: An issue with Siri search access to information was addressed with improved logic. | |||||
| CVE-2021-30702 | 1 Apple | 2 Mac Os X, Macos | 2021-09-16 | 2.1 LOW | 4.6 MEDIUM |
| A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A person with physical access to a Mac may be able to bypass Login Window. | |||||
| CVE-2021-30769 | 1 Apple | 3 Iphone Os, Tvos, Watchos | 2021-09-15 | 4.3 MEDIUM | 5.5 MEDIUM |
| A logic issue was addressed with improved state management. This issue is fixed in iOS 14.7, tvOS 14.7, watchOS 7.6. A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. | |||||
| CVE-2021-30770 | 1 Apple | 3 Iphone Os, Tvos, Watchos | 2021-09-15 | 4.9 MEDIUM | 5.5 MEDIUM |
| A logic issue was addressed with improved validation. This issue is fixed in iOS 14.7, tvOS 14.7, watchOS 7.6. An attacker that has already achieved kernel code execution may be able to bypass kernel memory mitigations. | |||||
| CVE-2021-30605 | 2 Google, Microsoft | 4 Chrome Os Readiness Tool, Windows 10, Windows 7 and 1 more | 2021-09-15 | 4.6 MEDIUM | 7.8 HIGH |
| Inappropriate implementation in the ChromeOS Readiness Tool installer on Windows prior to 1.0.2.0 loosens DCOM access rights on two objects allowing an attacker to potentially bypass discretionary access controls. | |||||
| CVE-2020-11264 | 1 Qualcomm | 252 Apq8053, Apq8053 Firmware, Apq8064au and 249 more | 2021-09-14 | 10.0 HIGH | 9.8 CRITICAL |
| Improper authentication of Non-EAPOL/WAPI plaintext frames during four-way handshake can lead to arbitrary network packet injection in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music | |||||