CVE-2021-38646

CVE-2021-38646 is a Microsoft Office Access Connectivity Engine remote code execution vulnerability. The Nessus plugin confirms it affects Office products via the Access connectivity engine and ties remediation to September 2021 Office security updates (e.g., KB5001958 for Office 2013 and KB50019...

CVE-2021-38645

Open Management Infrastructure (OMI) in Azure VM Management Extensions contains CVE-2021-38645, an Elevation of Privilege vulnerability. OMI runs with root privileges; when vulnerable, it can be exploited locally to escalate privileges on affected hosts. Microsoft addressed the OMIGOD set (CVE-20...

CVE-2021-38633

CVE-2021-38633 affects Windows CLFS driver (Common Log File System). Connected sources provide concrete technical detail: the vulnerability is a local privilege escalation in clfs.sys, related to CLFS container/file creation paths and privilege checks (e.g., CClfsBaseFilePersisted::CreateContaine...

CVE-2021-36963

Technical details about CVE-2021-36963 are not provided in the supplied documents. Public disclosures among the connected items do not specify affected products, root cause, impact, or fixes beyond the general vendor advisory; monitor for official updates.

CVE-2021-36955

CVE-2021-36955 is a Windows privilege-escalation flaw in the Common Log File System (CLFS) driver. The vulnerability stems from the CLFS driver (clfs.sys) and enables local privilege escalation to SYSTEM when exploited. Connected guidance and threat intel cite this CVE alongside Windows CLFS-rela...

CVE-2021-38163

CVE-2021-38163 affects SAP NetWeaver (Visual Composer 7.0 RT) versions 7.30/7.31/7.40/7.50 with an unrestricted file upload path traversal that, when exploited by an authenticated non-administrative user, can trigger processing of a malicious file and execute OS commands under the Java Server pro...

CVE-2021-33544

CVE-2021-33544 affects Geutebrück UDP Technology IP cameras (G-Cam E2 and G-Code encoders) with affected UDP firmware (e.g., E2: 1.12.0.27 and earlier; 1.12.13.2; 1.12.14.5; G-Code: same). The issue is a command-injection vulnerability in the web-based management interface that enables remote arb...

CVE-2021-40870

Summary (CVE-2021-40870) : Aviatrix Controller 6.x before 6.5-1804.1922 is affected by an unrestricted file upload via a directory traversal flaw that enables an unauthenticated attacker to execute arbitrary code. The base vulnerability is described in the primary CVE record, which lists the affe...

CVE-2021-30663

CVE-2021-30663 relates to WebKit/WebKitGTK and involves an integer overflow when processing malicious web content, potentially allowing arbitrary code execution. Publicly documented fixes include upstream WebKitGTK and related WebKit components, with patches delivering non-exploit code paths, and...

CVE-2021-30657

CVE-2021-30657 is a Gatekeeper bypass in macOS caused by a logic/state-management issue. The vulnerability could allow a malicious, downloaded app to bypass Gatekeeper checks; Apple fixed it in macOS Big Sur 11.3 and Security Update 2021-002 Catalina. The initial advisory notes that Apple is awar...

CVE-2021-30661

CVE-2021-30661 is a use-after-free vulnerability in WebKit Storage that could lead to arbitrary code execution when processing malicious web content. Affected: WebKit/WebKitGTK/WebKit Storage components on Apple platforms (Safari/WebKit on macOS/iOS/iPadOS, and WebKitGTK implementations) as descr...

CVE-2021-30713

CVE-2021-30713 affects macOS Big Sur 11.4 and concerns the TCC (Transparency, Consent, and Control) subsystem. The vulnerability is described as a permissions issue that could allow a malicious application to bypass Privacy preferences, with the fix implemented in Big Sur 11.4. Related sources co...

CVE-2021-30666

CVE-2021-30666 is a WebKit-related buffer overflow in Apple iOS WebKit that could allow arbitrary code execution when processing malicious web content. The vulnerability affects WebKit in iOS and is fixed in iOS 12.5.3 (Apple’s advisory HT212341 lists WebKit updates and CVE-2021-30666 with impact...

CVE-2021-30665

CVE-2021-30665 is a memory corruption vulnerability in WebKitGTK/WebKit (before 2.32.3) that can lead to arbitrary code execution when processing malicious web content. It is listed in multiple advisories across WebKitGTK/WebKit and Apple platforms (watchOS/iOS/iPadOS/macOS/tvOS) with exploitatio...

CVE-2021-30762

CVE-2021-30762 is a WebKit/Apple WebKit use-after-free issue that affects this component in iOS/WebKit, caused by memory management flaws. The vulnerability could allow arbitrary code execution when processing malicious web content, with Apple noting active exploitation in the wild for related We...

CVE-2021-30761

CVE-2021-30761 is a memory corruption vulnerability in WebKit/iOS WebKit. The issue is triggered by processing malicious web content and can lead to arbitrary code execution. It is fixed in iOS 12.5.4 (WebKit updates included) and Apple notes that this issue may have been actively exploited in th...

CVE-2021-40539

CVE-2021-40539 affects Zoho ManageEngine ADSelfService Plus (6100-series and earlier) with a REST API authentication bypass that enables remote code execution. Public evidence shows active exploitation campaigns (GODZILLA webshell, NGLite backdoor, KdcSponge) and targeted activity reported by CIS...

CVE-2021-30617

CVE-2021-30617 affects Chromium’s Blink engine with a policy bypass vulnerability. Connected sources label the issue as a Blink policy bypass in Chromium and reference Chromium 93.x updates as mitigations (e.g., Fedora advisories: chromium-93.0.4577.63-1.fc34/.fc35). The core detail consistently ...

CVE-2021-28550

CVE-2021-28550 is an Adobe Acrobat/Reader Use-After-Free vulnerability that allows arbitrary code execution in the context of the current user when a user opens a crafted PDF. Affected products include Acrobat Reader DC (versions 2021.001.20150 and earlier), 2020.001.30020 and earlier, and 2017.0...

CVE-2021-38703

CVE-2021-38703 concerns Arcadyan-derived firmware used by devices such as KPN Experia WiFi (1.00.15). The issue arises from improper sanitisation of user input to the syslog configuration form, enabling an authenticated remote attacker to alter device configuration and achieve remote code executi...