CVE-2021-2397

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIO...

grub2: Heap out-of-bounds write in short form option parser

A flaw was found in grub2. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. The highest threat from this vulnerability is to data confidentiality and integrity as well as syste...

CVE-2021-33676

A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with high privileges to compromise confidentiality, integrity, or availability of the system...

libxml2: Use-after-free in xmlEncodeEntitiesInternal() in entities.c

There's a flaw in libxml2's xmllint. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability...

The vulnerability of the VMware Carbon Black App Control server is related to authentication errors, which allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the VMware Carbon Black App Control server is related to authentication errors. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information...

The vulnerability of the CODESYS V2.3 web server component of the CODESYS industrial automation software suite allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the CODESYS V2.3 web server component of the CODESYS industrial automation software system arises due to an overflow in the buffer in the dynamic memory. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of...

CVE-2021-33669

Under certain conditions, SAP Mobile SDK Certificate Provider allows a local unprivileged attacker to exploit an insecure temporary file storage. For a successful exploitation user interaction from another user is required and could lead to complete impact of confidentiality integrity and...

UBUNTU-CVE-2021-3516

There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability...

PT-2021-3337 · 3S Smart Software Solutions · Codesys V2 Web-Server

Name of the Vulnerable Software and Affected Versions: CODESYS V2 Web-Server versions prior to 1.1.9.20 Description: The issue is caused by a buffer overflow in the dynamic memory of the CODESYS V2.3 web server, which is part of the CODESYS industrial automation software complex. This can allow a...

Libwebp Reuse After Release Vulnerability

Libwebp is a WebP image format encoding and decoding library . A post-release reuse vulnerability exists in Libwebp versions prior to 1.0.1. An attacker could exploit this vulnerability to affect confidentiality, integrity, and availability...

CVE-2021-3445

A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability...

sudo: symbolic link attack in SELinux-enabled sudoedit

A race condition vulnerability was found in the temporary file handling of sudoedit's SELinux RBAC support. On systems where SELinux is enabled, this flaw allows a malicious user with sudoedit permissions to set the owner of an arbitrary file to the user ID of the target user, potentially leading...

CVE-2021-3518

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability...

CVE-2021-20181

A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to confidentiality,...

ALPINE-CVE-2020-27823

A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...

kernel: heap buffer overflow in the iSCSI subsystem

A flaw was found in the Linux kernel. A heap buffer overflow in the iSCSI subsystem is triggered by setting an iSCSI string attribute to a value larger than one page and then trying to read it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a crafted file could trigger a stack buffer overflow out-of-bounds write of arbitrary data supplied by the attacker. The highest impact of this flaw is to confidentiality integrity and availability.

...

CVE-2021-20204

A heap memory corruption problem use after free can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library. This vulnerability may lead to...

The vulnerability of the Microsoft Azure Active Directory cloud platform’s software, related to security configuration errors, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Microsoft Azure Active Directory software platform is related to security configuration errors. Exploiting this vulnerability could allow attackers to compromise the confidentiality, integrity, and accessibility of protected information...

CVE-2021-2192

Vulnerability in the Oracle Solaris product of Oracle Systems component: Kernel. The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful...