CVE-2021-33910: Denial of Service (Stack Exhaustion) in systemd (PID 1)

The Qualys Research Team has discovered a stack exhaustion denial-of-service vulnerability in systemd, a near-ubiquitous utility available on major Linux operating systems. Any unprivileged user can exploit this vulnerability to crash systemd and hence the entire operating system a kernel panic...

Critical Juniper Bug Allows DoS, RCE Against Carrier Networks

A critical remote code-execution vulnerability in Juniper Networks’ Steel-Belted Radius SBR Carrier Edition lays open wireless carrier and fixed operator networks to tampering. The SBR Carrier server is used by telecom carriers to manage policies for how subscribers access their networks – by...

Microsoft Windows/Windows Server Denial of Service Vulnerability (CNVD-2021-66058)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation USA.Microsoft Windows is a set of operating systems for personal devices.Microsoft Windows Server is a set of server operating systems. A denial-of-service vulnerability exists in Hyper-V in Microsoft...

Microsoft Windows/Windows Server Information Disclosure Vulnerability (CNVD-2021-63290)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation USA.Microsoft Windows is a set of operating systems for personal devices.Microsoft Windows Server is a set of server operating systems. An information disclosure vulnerability exists in Win32k in Microsoft...

Windows Privilege Escalation

Vulnerabilities of Windows operating systems are related to insecure management of privileges. Exploiting these vulnerabilities can allow attackers, who operate remotely, to enhance their privileges...

Microsoft Windows 10 suffers from a denial of service vulnerability (CNVD-2021-46822)

Microsoft Windows 10 is a set of operating systems for use on personal computers. Microsoft Windows 10 has a denial of service vulnerability that can be exploited by attackers to cause a denial of service...

CVE-2021-29962

Firefox for Android would become unstable and hard-to-recover when a website opened too many popups. This bug only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox 89...

CVE-2021-29951

The Mozilla Maintenance Service granted SERVICESTART access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating if an attacker spammed the 'Stop' command; but also...

Command injection

The Mozilla Maintenance Service granted SERVICESTART access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating if an attacker spammed the 'Stop' command; but also...

CVE-2021-29951

The Mozilla Maintenance Service granted SERVICESTART access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating if an attacker spammed the 'Stop' command; but also...

CVE-2021-29963

Address bar search suggestions in private browsing mode were re-using session data from normal mode. This bug only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox 89...

operating systems such as Data Compromise

The vulnerabilities of operating systems such as iOS, iPadOS, macOS, tvOS, the browser Safari, the multimedia player iTunes, and the iCloud service are related to incorrect processing of logical operations. Exploiting these vulnerabilities allows a malicious actor to compromise the integrity of...

iOS iPhoneOS iPadOS tvOS watchOS macOS Privilege Escalation

The vulnerabilities of iOS, iPhoneOS, iPadOS, tvOS, watchOS, and macOS are related to uncontrolled resource consumption. Exploiting these vulnerabilities can allow attackers to increase their privileges and execute arbitrary code...

Remote Desktop Services Spoofing

The vulnerability of Remote Desktop Services RDS for Windows operating systems is related to resource release errors. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Mac OS Data Protection Unauthorized Access

The vulnerability of Mac OS operating systems is related to deficiencies in data protection. Exploiting this vulnerability can allow a malicious actor, acting remotely, to gain unauthorized access to protected information...

Microsoft Enhanced Cryptographic Provider Privilege Escalation

The vulnerability of Microsoft’s Enhanced Cryptographic Provider on Microsoft Windows operating systems is related to insecure management of privileges. Exploiting this vulnerability can allow attackers to enhance their privileges...

operating systems such as DoS

The vulnerabilities of operating systems such as macOS, watchOS, iOS, iPadOS, tvOS, and the iCloud for Windows service are related to resource release errors. Exploiting these vulnerabilities can allow a malicious actor to cause service failures remotely...

PT-2021-3288 · Microsoft · Intune Management Extension

Name of the Vulnerable Software and Affected Versions: Microsoft Intune Management Extension affected versions not specified Description: The issue is related to privilege management errors in the Intune management extension for Windows operating systems. Exploitation of this issue may allow a...

Understanding the threat landscape and risks of OT environments

The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager Natalia Godyla talks with Chris Sistrunk, Technical Manager in...

HTTP Protocol Stack Code Execution

The vulnerability of the HTTP Protocol Stack in Microsoft Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially created HTTP request...