Apple Warns of 3 iOS Zero-Day Security Vulnerabilities Exploited in the Wild

Apple on Tuesday released updates for iOS, iPadOS, and tvOS with fixes for three security vulnerabilities that it says may have been actively exploited in the wild. Reported by an anonymous researcher, the three zero-day flaws — CVE-2021-1782, CVE-2021-1870, and CVE-2021-1871 — could have allowed...

CVE-2021-26134

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Recent assessments: femkebolle at November 22, 2023 3:56pm UTC reported: As ...

CVE-2020-35749

creationtimestamp| type| source ---|---|--- 2021-01-21 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/49450 2021-05-31 04:04:51+00:00| seen| https://t.me/pwnwikizhchannel/559 2022-02-07 20:19:03+00:00| published-proof-of-concept| https://t.me/intelexch/7752 2024-11-14...

CVE-2020-25684

creationtimestamp| type| source ---|---|--- 2021-01-20 11:02:54+00:00| seen| https://www.kyberturvallisuuskeskus.fi/fi/dnspooq-haavoittuvuusjoukko-laajalti-kaytossa-olevassa-dnsmasq-ohjelmistossa 2021-01-20 14:02:00+00:00| seen| https://t.me/truesecator/1346 2021-01-20 18:27:29+00:00| seen|...

The story of ZeroLogon

This is the story of a vulnerability that was brought about by the incorrect use of an encryption technique. After it was discovered by researchers, the vulnerability was patched and that should have been the end of the story. Unfortunately the patch caused problems of its own, which made it very...

Vulnerability in gencore affects AIX,Vulnerability in gencore affects VIOS

IBM SECURITY ADVISORY First Issued: Tue Jan 19 16:15:13 CST 2021 |Updated: Tue Mar 30 09:09:39 CDT 2021 |Update: iFix now provided for AIX 7200-04-03 and VIOS 3.1.1.30. The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/gencoreadvisory.asc...

Huawei Emui and Honor Magic Ui buffer overflow vulnerability (CNVD-2022-52826)

Huawei Emui is an Android-based mobile operating system from Huawei, China.Honor Magic Ui is an Android-based mobile operating system from Honor, China. A buffer overflow vulnerability exists in Huawei Emui and Honor Magic Ui, which can be exploited by an attacker who can exploit the vulnerabilit...

Pillow Buffer Overflow Vulnerability (CNVD-2021-54038)

Pillow is a Python-based image processing library. buffer overflow vulnerability exists in versions of Pillow prior to 8.1.0, which can be exploited by attackers to cause a buffer over read...

Microsoft Issues Patches for Defender Zero-Day and 82 Other Windows Flaws

For the first patch Tuesday of 2021, Microsoft released security updates addressing a total of 83 flaws spanning as many as 11 products and services, including an actively exploited zero-day vulnerability. The latest security patches cover Microsoft Windows, Edge browser, ChakraCore, Office and...

Microsoft Windows Defender Antimalware Platform RCE Vulnerability (Jan 2021)

This host is missing a critical security update according to Microsoft Security Updates released for Microsoft Windows Defender Protection Engine dated 12-01-2021 SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by...

Security Update for Windows Defender (January 2021)

The Malware Protection Engine version of Microsoft Windows Defender installed on the remote Windows host is prior to 1.1.17600.5. It is, therefore, affected by an unspecified remote code execution vulnerability. An authenticated, local attacker can exploit this to bypass authentication and execut...

CVE-2020-16013

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Recent assessments: gwillcox-r7 at November 22, 2020 2:37am UTC reported: Reported as exploited in the wild as part of Google’s 2020...

CVE-2020-16017

Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Recent assessments: gwillcox-r7 at November 22, 2020 2:37am UTC reported: Reported as...

CVE-2020-17519

creationtimestamp| type| source ---|---|--- 2021-01-08 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/49398 2021-02-23 15:29:39+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/apacheflinkjobmanagertraversal.rb 2021-03-17...

Cross site scripting

Cross Site Scripting XSS vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Time and "Keyword" in URL Filter...

Design/Logic Flaw

A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 iLO 5 and Integrated Lights-Out 4 iLO 4 firmware. The vulnerability could be remotely exploited to disclose the serial number and other information...

PT-2021-10097 · Apache · Apache Flink

Name of the Vulnerable Software and Affected Versions: Apache Flink versions 1.11.0 through 1.11.2 Description: A change introduced in Apache Flink allows attackers to read any file on the local filesystem of the JobManager through the REST interface. Access is restricted to files accessible by t...

CVE-2020-36112

creationtimestamp| type| source ---|---|--- 2021-01-04 19:10:47+00:00| seen| https://t.me/cibsecurity/21547 2024-11-04 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2024-11-04 2025-01-26 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities -...

CVE-2020-6862

creationtimestamp| type| source ---|---|--- 2020-12-29 19:51:33+00:00| exploited| https://t.me/CyberSecurityTechnologies/1729...

SolarWinds Orion Platform < 2019.4 HF6 / 2020.2 < 2020.2.1 HF2 Authentication Bypass (SUPERNOVA)

The version of SolarWinds Orion Platform running on the remote host is prior to 2019.4 HF6 or 2020.2 prior to 2020.2.1 HF 2. It is, therefore, affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this, via a specially crafted web request, to bypass...