Vulnerabilities fixed in McAfee Endpoint Security

McAfee has fixed vulnerabilities in Endpoint Security for Windows. A local malicious agent could exploit the vulnerabilities to obtain elevated privileges and to execute arbitrary code with user privileges through a cross-site scripting XSS attack. In addition, the vulnerabilities can be exploite...

McAfee Total Protection Directory Junction Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of McAfee Total Protection. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists...

QEMU Plan 9 File System Time-Of-Check Time-Of-Use Privilege Escalation Vulnerability

This vulnerability allows local attackers to execute arbitrary code on affected installations of QEMU. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the handling of file...

CVE-2020-27257

This vulnerability allows local attackers to execute arbitrary code due to the lack of proper validation of user-supplied data, which can result in a type-confusion condition in the Omron CX-One Version 4.60 and prior devices...

Type confusion

This vulnerability allows local attackers to execute arbitrary code due to the lack of proper validation of user-supplied data, which can result in a type-confusion condition in the Omron CX-One Version 4.60 and prior devices...

CVE-2020-27257 Omron CX-One

This vulnerability allows local attackers to execute arbitrary code due to the lack of proper validation of user-supplied data, which can result in a type-confusion condition in the Omron CX-One Version 4.60 and prior devices...

CVE-2020-27257

CVE-2020-27257 concerns a type-confusion in Omron CX-One’s CX-Protocol/PSW file parsing, affecting CX-One 4.60 and earlier. ZDI confirms a remote-code-execution route via PSW parsing with user interaction required (visit a malicious page/open a crafted file). The ICS advisory lists updates: CX-Pr...

Google Android VPU elevation of privilege vulnerability (CNVD-2021-09904)

Google Android is an open source operating system based on Linux. Google Android VPU has a security vulnerability that can be exploited by local attackers to submit special requests that can elevate privileges...

CVE-2021-22307

There is a weak algorithm vulnerability in Mate 3010.0.0.203C00E201R7P2. The protection is insufficient for the modules that should be protected. Local attackers can exploit this vulnerability to affect the integrity of certain module...

CVE-2021-22307

There is a weak algorithm vulnerability in Mate 3010.0.0.203C00E201R7P2. The protection is insufficient for the modules that should be protected. Local attackers can exploit this vulnerability to affect the integrity of certain module...

Design/Logic Flaw

There is a weak algorithm vulnerability in Mate 3010.0.0.203C00E201R7P2. The protection is insufficient for the modules that should be protected. Local attackers can exploit this vulnerability to affect the integrity of certain module...

CVE-2021-22307

There is a weak algorithm vulnerability in Mate 3010.0.0.203C00E201R7P2. The protection is insufficient for the modules that should be protected. Local attackers can exploit this vulnerability to affect the integrity of certain module...

CVE-2021-22307

There is a weak algorithm vulnerability in Mate 3010.0.0.203C00E201R7P2. The protection is insufficient for the modules that should be protected. Local attackers can exploit this vulnerability to affect the integrity of certain module...

CVE-2021-22307

CVE-2021-22307 affects Huawei Mate 30 smartphones with firmware 10.0.0.203 (C00E201R7P2). The issue is a weak algorithm that leaves protection for certain modules insufficient, allowing local attackers to compromise module integrity. CVSS indicates LOCAL access, low attack complexity, with HIGH i...

Cisco IOS XR Software Unauthorized Information Disclosure (cisco-sa-ios-infodisc-4mtm9Gyt)

According to its self-reported version, IOS-XR is affected by an information disclosure vulnerability in its CLI parser component due to insufficient application of restrictions for a specific command. An authenticated, local attacker can exploit this, by issuing a crafted command at the command...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2021-9001)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9001 advisory. - fbdev, newportcon: Move FONTEXTRAWORDS macros into linux/font.h Peilin Ye Orabug: 32176267 CVE-2020-28915 Tenable has extracted the preceding...

Apple iOS FairplayIOKit Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Apple iOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the FairplayIOK...

Apport 输入验证错误漏洞

Apport is a toolkit for collecting and feeding back error messages information that the operating system considers useful when an application crashes. Apport is vulnerable to input validation errors, which can be exploited by local attackers to escalate privileges and run arbitrary code...

CVE-2021-3348

nbdaddsocket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndbqueuerq use-after-free that could be triggered by local attackers with access to the nbd device via an I/O request at a certain point during device setup, aka CID-b98e762e3d71...

CVE-2021-3348

nbdaddsocket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndbqueuerq use-after-free that could be triggered by local attackers with access to the nbd device via an I/O request at a certain point during device setup, aka CID-b98e762e3d71...