Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-3757 | 6 Adobe, Apple, Google and 3 more | 10 Flash Player, Macos, Chrome Os and 7 more | 2021-09-16 | 9.3 HIGH | 8.8 HIGH |
| Adobe Flash Player versions 32.0.0.321 and earlier, 32.0.0.314 and earlier, 32.0.0.321 and earlier, and 32.0.0.255 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution. | |||||
| CVE-2020-6402 | 7 Apple, Debian, Fedoraproject and 4 more | 10 Macos, Debian Linux, Fedora and 7 more | 2021-09-16 | 6.8 MEDIUM | 8.8 HIGH |
| Insufficient policy enforcement in downloads in Google Chrome on OS X prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. | |||||
| CVE-2019-6147 | 1 Forcepoint | 1 Next Generation Firewall Security Management Center | 2021-09-16 | 4.3 MEDIUM | 5.9 MEDIUM |
| Forcepoint NGFW Security Management Center (SMC) versions lower than 6.5.12 or 6.7.1 have a rare issue that in specific circumstances can corrupt the internal configuration database. When the database is corrupted, the SMC might produce an incorrect IPsec configuration for the Forcepoint Next Generation Firewall (NGFW), possibly resulting in settings that are weaker than expected. All SMC versions lower than 6.5.12 or 6.7.1 are vulnerable. | |||||
| CVE-2020-22403 | 1 Express-cart Project | 1 Express-cart | 2021-09-16 | 6.8 MEDIUM | 8.8 HIGH |
| The express-cart package through 1.1.10 for Node.js allows CSRF. | |||||
| CVE-2021-34480 | 1 Microsoft | 8 Windows 10, Windows 7, Windows 8.1 and 5 more | 2021-09-16 | 6.8 MEDIUM | 8.8 HIGH |
| Scripting Engine Memory Corruption Vulnerability | |||||
| CVE-2021-30756 | 1 Apple | 3 Ipados, Iphone Os, Macos | 2021-09-16 | 2.1 LOW | 5.5 MEDIUM |
| A local attacker may be able to view Now Playing information from the lock screen. This issue is fixed in macOS Big Sur 11.4, iOS 14.6 and iPadOS 14.6. A privacy issue in Now Playing was addressed with improved permissions. | |||||
| CVE-2021-30290 | 1 Qualcomm | 82 Qca6174a, Qca6174a Firmware, Qca6574 and 79 more | 2021-09-16 | 4.4 MEDIUM | 7.0 HIGH |
| Possible null pointer dereference due to race condition between timeline fence signal and time line fence destroy in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile | |||||
| CVE-2021-35223 | 1 Solarwinds | 1 Serv-u | 2021-09-16 | 6.5 MEDIUM | 8.8 HIGH |
| The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, allowing remote code execution. | |||||
| CVE-2021-33019 | 1 Deltaww | 1 Dopsoft | 2021-09-16 | 6.8 MEDIUM | 7.8 HIGH |
| A stack-based buffer overflow vulnerability in Delta Electronics DOPSoft Version 4.00.11 and prior may be exploited by processing a specially crafted project file, which may allow an attacker to execute arbitrary code. | |||||
| CVE-2021-25218 | 2 Fedoraproject, Isc | 2 Fedora, Bind | 2021-09-16 | 5.0 MEDIUM | 7.5 HIGH |
| In BIND 9.16.19, 9.17.16. Also, version 9.16.19-S1 of BIND Supported Preview Edition When a vulnerable version of named receives a query under the circumstances described above, the named process will terminate due to a failed assertion check. The vulnerability affects only BIND 9 releases 9.16.19, 9.17.16, and release 9.16.19-S1 of the BIND Supported Preview Edition. | |||||
| CVE-2021-30294 | 1 Qualcomm | 82 Qca6174a, Qca6174a Firmware, Qca6574 and 79 more | 2021-09-15 | 4.9 MEDIUM | 5.5 MEDIUM |
| Potential null pointer dereference in KGSL GPU auxiliary command due to improper validation of user input in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile | |||||
| CVE-2021-30295 | 1 Qualcomm | 248 Apq8017, Apq8017 Firmware, Apq8053 and 245 more | 2021-09-15 | 7.2 HIGH | 7.8 HIGH |
| Possible heap overflow due to improper validation of local variable while storing current task information locally in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables | |||||
| CVE-2021-30793 | 1 Apple | 2 Mac Os X, Macos | 2021-09-15 | 10.0 HIGH | 9.8 CRITICAL |
| A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. An application may be able to execute arbitrary code with kernel privileges. | |||||
| CVE-2021-30755 | 1 Apple | 3 Macos, Tvos, Watchos | 2021-09-15 | 4.3 MEDIUM | 6.5 MEDIUM |
| Processing a maliciously crafted font may result in the disclosure of process memory. This issue is fixed in macOS Big Sur 11.4, tvOS 14.6, watchOS 7.5. An out-of-bounds read was addressed with improved input validation. | |||||
| CVE-2020-19766 | 1 Tokenerc20 Project | 1 Tokenerc20 | 2021-09-15 | 5.0 MEDIUM | 7.5 HIGH |
| The time check operation of PepeAuctionSale 1.0 can be rendered ineffective by assigning a large number to the _duration variable, compromising access control to the application. | |||||
| CVE-2021-30787 | 1 Apple | 2 Mac Os X, Macos | 2021-09-15 | 6.8 MEDIUM | 7.8 HIGH |
| This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. An application may be able to cause unexpected system termination or write kernel memory. | |||||
| CVE-2021-38341 | 1 Dreamfoxmedia | 1 Woocommerce Payment Gateway Per Category | 2021-09-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/includes/plugin_settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.10. | |||||
| CVE-2021-38353 | 1 Webodid | 1 Dropdown And Scrollable Text | 2021-09-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the ~/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0. | |||||
| CVE-2021-30788 | 1 Apple | 5 Iphone Os, Mac Os X, Macos and 2 more | 2021-09-15 | 5.8 MEDIUM | 7.1 HIGH |
| This issue was addressed with improved checks. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7, Security Update 2021-005 Mojave, Security Update 2021-004 Catalina. Processing a maliciously crafted tiff file may lead to a denial-of-service or potentially disclose memory contents. | |||||
| CVE-2021-37145 | 1 Poly | 4 Cx5100, Cx5100 Firmware, Cx5500 and 1 more | 2021-09-15 | 6.5 MEDIUM | 7.2 HIGH |
| ** UNSUPPORTED WHEN ASSIGNED ** A command-injection vulnerability in an authenticated Telnet connection in Poly (formerly Polycom) CX5500 and CX5100 1.3.5 leads an attacker to Privilege Escalation and Remote Code Execution capability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | |||||