CVE-2021-1285

CVE-2021-1285 affects multiple Cisco products via the Snort Ethernet Frame Decoder. The flaw arises from improper error handling when processing Ethernet frames, enabling an unauthenticated, adjacent attacker to trigger a denial-of-service by exhausting disk space, potentially denying admin login...

CVE-2021-1232

Summary: CVE-2021-1232 describes an information-disclosure flaw in the web-based management interface of Cisco SD-WAN vManage Software. The issue stems from insufficient access control for sensitive information stored on the system, enabling an authenticated, remote attacker to read arbitrary fil...

CVE-2021-1410

CVE-2021-1410 affects Cisco Webex Meetings. The vulnerability stems from insufficient authorization enforcement for requests to update distribution lists, allowing an authenticated, remote attacker to modify a distribution list belonging to another user within the same organization. The issue is ...

CVE-2021-1425

The CVE-2021-1425 issue affects Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA)/Email Security Appliance (ESA). It enables an authenticated, remote attacker to view confidential information by inspecting raw HTTP requests exchanged with the web-based management interf...

CVE-2021-1440

Cisco IOS XR Software contains a DoS vulnerability in the RPKI feature due to incorrect handling of RTR header packets. An unauthenticated attacker can trigger BGP process crashes by sending specially crafted RTR packets (or via MITM impersonation of the RPKI validator) over RTR TCP, causing the ...

CVE-2021-1462

CVE-2021-1462 affects Cisco SD-WAN vManage Software CLI. The issue arises from an incorrect privilege assignment that lets an authenticated local attacker with a valid Administrator account create a malicious file that the system later parses, potentially granting the attacker root privileges on ...

CVE-2021-1465

The CVE-2021-1465 entry concerns Cisco SD-WAN vManage Software. The issue is in the web-based management interface caused by insufficient validation of HTTP requests, enabling a directory traversal attack. An authenticated, remote attacker could read sensitive files and, per the description, coul...

CVE-2023-43091

GNOME Maps (GNOME Maps) is affected by CVE-2023-43091 due to a code injection flaw in its service.json configuration file. A malicious configuration can cause arbitrary code execution, as documented across multiple sources in the connected data. The issue is confirmed by CVE descriptions and rela...

CVE-2023-6110

OpenStack CVE-2023-6110 describes a flaw where deleting a non-existent access rule within a scope can cause other existing access rules (not linked to any application credentials) to be deleted. The vulnerability is linked to the OpenStack component handling access rule deletion. The documented i...

CVE-2023-4639

Undertow contains a flaw in how cookies with certain value-delimiting characters are parsed from incoming requests. The issue can allow an attacker to construct a cookie value to exfiltrate HttpOnly cookies or spoof additional cookie values, leading to unauthorized data access or modification. Th...

CVE-2023-0657

The CVE-2023-0657 entries concern Keycloak, where a flaw is described as improper enforcement of token types when validating signatures locally. This could let an authenticated attacker exchange a logout token for an access token, potentially accessing data outside of enforced permissions. The co...

CVE-2020-25720

CVE-2020-25720 concerns Samba: a delegated administrator who can create objects in Active Directory can subsequently write to all attributes of the newly created object, including security-sensitive ones. The underlying cause is the absence of an ACL at creation time, resulting in the creator-own...

CVE-2020-25720

A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator...

CVE-2017-13314

CVE-2017-13314 affects Android by with a missing permission check in NetworkManagementService.setAllowOnlyVpnForUids, enabling local escalation of privilege to access non-VPN networks when VPN-only access is intended. The issue is described as a security settings bypass in NetworkManagementServic...

CVE-2017-13312

CVE-2017-13312 affects Android’s Media framework (MediaCas.java) where a parcel read/write mismatch in createFromParcel, due to improper input validation, can enable local elevation of privilege on Android 8.0 (Oreo). An app could start an activity with system privileges without extra execution p...

CVE-2017-13311

The provided connected documents confirm CVE-2017-13311 affects the Android Framework, specifically the read() function in ProcessStats.java, causing a read/write serialization issue that enables a permissions bypass. This can lead to local escalation of privilege, allowing an app to start an act...

CVE-2017-13309

CVE-2017-13309 affects ConscryptEngine.java in Android's Conscrypt implementation. In readEncryptedData, there is a plaintext leak due to improper crypto usage, enabling local information disclosure without extra privileges or user interaction. The Android security bulletin (2018-05-01) associate...

CVE-2021-1470

Cisco SD-WAN vManage Software is affected by CVE-2021-1470, an SQL injection vulnerability in the web-based management interface. The issue arises from improper input validation of SQL queries, allowing an authenticated, remote attacker to send malicious queries and potentially modify values on t...

CVE-2021-1481

Cisco SD-WAN vManage Software is affected by CVE-2021-1481, a Cypher Query Language injection via the web-based management interface caused by insufficient input validation. An authenticated attacker could exploit this by sending crafted HTTP requests to the interface to obtain sensitive informat...

CVE-2021-1482

CVE-2021-1482 concerns Cisco SD-WAN vManage Software, where the web-based management interface contains insufficient authorization checks. An authenticated, remote attacker could send crafted HTTP requests to bypass authorization and access sensitive information on the affected system. The CVSS 3...