CVE-2021-27245

CVE-2021-27245 affects TP-Link Archer A7 family (A7 AC1750; Archer C7 US variants) prior to the specified V5 firmwares. Root cause: improper filtering of IPv6 SSH connections during IPv6 handling enables a firewall bypass by unauthenticated attackers, who could leverage this in conjunction with o...

CVE-2021-27245

This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 prior to Archer C7USV5210125 and Archer A7USV5200220 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of IPv6 connections. The issue...

CVE-2021-27244

Parallels Desktop 16.0.1-48919 contains a local, information-disclosure vulnerability in the Toolgate component. The flaw arises from improper validation of user-supplied data, leading to a read past the end of an allocated buffer. An attacker who can execute low-privileged code on the guest OS c...

CVE-2021-27243

This entry concerns CVE-2021-27243 affecting Parallels Desktop (Toolgate). The impact is local privilege escalation via an integer overflow in Toolgate caused by insufficient validation of user-supplied data, which can lead to buffer overflow and arbitrary code execution in the hypervisor context...

CVE-2021-27243

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

CVE-2021-27241

This CVE-2021-27241 affects Avast Premium Security 20.8.2429 (Build 20.8.5653.561). The flaw exists in the AvastSvc.exe module and is triggered by creating a directory junction, allowing a local attacker to delete arbitrary directories via abusing the service, which can lead to a denial-of-servic...

CVE-2021-27242

CVE-2021-27242 affects Parallels Desktop 16.0.1-48919. The issue is a memory corruption flaw in the Toolgate component that can be triggered by processing user-supplied data, enabling local attackers to escalate privileges and execute code with hypervisor context. Public sources (ZDI-21-209) desc...

CVE-2021-27241

This vulnerability allows local attackers to delete arbitrary directories on affected installations of Avast Premium Security 20.8.2429 Build 20.8.5653.561. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The...

CVE-2021-27240

SolarWinds Patch Manager 2020.2.1 is affected by CVE-2021-27240 due to deserialization of untrusted data in the DataGridService WCF service. The vulnerability enables local attackers who can execute low-privileged code on the target to escalate privileges to Administrator and run arbitrary code. ...

CVE-2021-27239

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400 and R6700 firmware version 1.0.4.98 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the upnpd service, which listens on...

CVE-2021-27276

CVE-2021-27276 affects NETGEAR ProSAFE Network Management System 1.6.0.26. The vulnerability is a directory traversal issue in the MibController class: during parsing the realName parameter, user-supplied paths are not properly validated before file operations, enabling an attacker to delete arbi...

CVE-2021-27275

CVE-2021-27275 affects NETGEAR ProSAFE Network Management System 1.6.0.26. The flaw resides in ConfigFileController realName handling, where user-supplied paths are not properly validated before file operations, enabling directory traversal. Consequences include disclosure of sensitive informatio...

CVE-2021-27275

This vulnerability allows remote attackers to disclose sensitive information and delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be...

CVE-2021-27273

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists...

CVE-2021-27273

CVE-2021-27273 affects NETGEAR ProSAFE Network Management System 1.6.0.26. A flaw in SettingConfigController.fileName handling allows an unauthenticated-by-default? (authentication bypass noted) remote code execution with SYSTEM privileges by abusing an unsafely-validated user-supplied string to ...

CVE-2021-27274

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MFileUploadController class. The issue results fr...

CVE-2021-27274

NETGEAR ProSAFE Network Management System 1.6.0.26 is impacted by CVE-2021-27274 due to an unchecked user-supplied path in MFileUploadController, enabling pre-auth remote code execution with SYSTEM privileges. The vulnerability stems from insufficient validation of file paths used in file operati...

CVE-2021-27272

This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists...

CVE-2021-27272

CVE-2021-27272 affects NETGEAR ProSAFE Network Management System 1.6.0.26. A flaw in the ReportTemplateController when parsing a path parameter allows a remote attacker to delete arbitrary files by abusing file operations, even though authentication is required—this authentication can be bypassed...

CVE-2021-27381

A vulnerability has been identified in Solid Edge SE2020 All Versions SE2020MP13, Solid Edge SE2021 All Versions SE2021MP3. Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds read past the end of an allocated structure...