CVE-2021-3708

CVE-2021-3708 affects the D-Link DSL-2750U router (firmware ME1.16 and earlier). The vulnerability is an OS command injection that an unauthenticated, local-network attacker can trigger to execute arbitrary commands. Remediation: upgrade to firmware vME_1.22 (as indicated by JVN/CNVD references)....

CVE-2021-26086

CVE-2021-26086 affects Atlassian Jira Server/Data Center via a path traversal in /WEB-INF/web.xml. Affected versions are pre-8.5.14, 8.6.0–8.13.6, and 8.14.0–8.16.1. Impact is read access to arbitrary files (remote attacker). Fixed versions are 8.5.14, 8.13.6, 8.16.1, and 8.17.0; mitigations incl...

CVE-2021-36380

Sunhillo SureLine

CVE-2021-36948

Technical details are not publicly provided in the available documents. The CVE is described as Windows Update Medic Service EoP, with some sources noting exploitation in the wild, but there is no concrete root cause, affected versions, or fix details here.

CVE-2021-36942

CVE-2021-36942 corresponds to Windows LSA Spoofing vulnerability (LSARPC) that can coerce a domain controller to authenticate to an attacker host via NTLM. In August 2021 Microsoft Patch Tuesday released fixes (KB5005413) and mitigations; multiple sources note patching as a priority. CISA’s KEV c...

CVE-2021-34487

Technical details for CVE-2021-34487 are not publicly available in the provided connected documents. Monitor for updates from Microsoft and CVE records; no concrete affected products, root cause, or fixes are described here.

CVE-2021-34486

CVE-2021-34486 is a Windows Event Tracing Elevation of Privilege vulnerability. The referenced data identify ETW as the affected component with a local attack vector and privilege escalation impact (CVE severity up to HIGH in CVSS‑3.1). Microsoft and related catalogs describe this as a Windows ET...

CVE-2021-34484

CVE-2021-34484 is a Windows User Profile Service local privilege escalation caused by a race condition in CreateDirectoryJunction() that allowed a logged-on user to influence profile handling and load a malicious DLL with SYSTEM privileges. The vulnerability was initially patched but later bypass...

CVE-2021-36276

CVE-2021-36276 impacts the Dell DBUtilDrv2.sys driver (versions 2.5 and 2.6) with insufficient access control, allowing local privilege escalation, DoS, or information disclosure when a local authenticated user loads the vulnerable driver. In practice, ToddyCat attackers used BYOVD to install DBU...

CVE-2021-36798

CVE-2021-36798 affects HelpSystems Cobalt Strike Team Server (versions 4.2 and 4.3). The DoS arises when a beacon registers with the C2/Team Server, enabling a remote attacker to crash the C2 server thread and disrupt beacon communications. Publicly available exploit/ PoC details exist (e.g., a G...

Information Leakage Vulnerability in SSL VPN of Beijing NetGalaxy Information Technology Co.

Beijing Nethub Information Technology Co., Ltd. was renamed from Lenovo Nethub Technology Beijing Co., Ltd. and its business covers network border security protection, application and data security protection, network-wide security risk management, professional security solutions and professional...

CVE-2021-24499

The CVE affects WordPress Workreap theme prior to 2.2.2. The AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader do not perform nonce checks or validate the requester, allowing unauthenticated uploads to uploads/workreap-temp. Uploaded files were not sanitized, enabling...

CVE-2021-26605

CVE-2021-26605 is a real, concrete vulnerability in ezPDFReader where the ezPDF launcher processes crafted input over JSON-RPC, allowing remote code execution due to improper input validation. The issue enables an attacker to run arbitrary commands on affected systems. Public sources confirm the ...

CVE-2021-21805

CVE-2021-21805 affects Advantech R-SeeNet v2.4.12. The ping.php script is vulnerable to remote OS command injection via specially crafted HTTP requests, enabling arbitrary commands execution without credentials. The Nuclei template and Red Hat/other feeds corroborate remote execution risk; report...

CVE-2021-20028

CVE-2021-20028 is an SQL injection in SonicWall Secure Remote Access (SRA) appliances and SRA/SMA endpoints due to improper neutralization of SQL commands. Affected products include end-of-life SRA appliances with 8.x firmware and 9.0.0.9-26sv or earlier. The vulnerability has a high/critical imp...

CVE-2021-30563

CVE-2021-30563 is a Type Confusion in the V8 engine used by Google Chrome (and Chromium-based browsers) prior to version 91.0.4472.164. The vulnerability arises from V8 type confusion which could allow a remote attacker to trigger heap corruption via a crafted HTML page. Public disclosures indica...

CVE-2021-26085

CVE-2021-26085 affects Atlassian Confluence Server. It is a Pre-Authorization Arbitrary File Read via the /s/ endpoint, allowing remote attackers to view restricted resources. Affected versions are before 7.4.10, and 7.5.0 before 7.12.3; fixes are in 7.4.10 and 7.12.3. Public PoCs and demonstrati...

CVE-2021-36742

CVE-2021-36742 is an improper input validation vulnerability that affects Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1. The root cause is flawed input validation that lets a local attacker escalate privileges after obtaining the ability to r...

CVE-2021-36741

CVE-2021-36741 affects Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1. The root cause is an improper input validation that enables a remote attacker, who must have access to log in to the product management console, to upload arbitrary files ...

CVE-2021-21538

Dell EMC iDRAC9 (Dell EMC Remote Access Controller) versions 4.40.00.00 and later are affected by CVE-2021-21538 when prior to 4.40.10.00 due to an improper authentication vulnerability that could allow a remote, unauthenticated attacker to gain access to the iDRAC virtual console. Root cause: im...