CVE-2021-22911

CVE-2021-22911 affects Rocket.Chat 3.11–3.13 and is a NoSQL injection that enables unauthenticated access to an API endpoint, potentially leading to data exposure, modification, or remote code execution. Root cause: NoSQL injection in endpoints such as getPasswordPolicy and users.list, enabling r...

CVE-2021-33558

Boa 0.94.13 contains an information disclosure flaw: remote attackers can access sensitive files (backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, config.js) due to a misconfiguration. Evidence across sources (NVD, nuclei template, Red Hat/ CNNVD entries) confirms th...

CVE-2021-21985

CVE-2021-21985 affects VMware vCenter Server via the vSphere Client (HTML5) and the default-enabled Virtual SAN Health Check plug‑in. Root cause: improper input validation leads to remote code execution when an attacker with network access to port 443 sends crafted input, enabling commands with u...

CVE-2021-27562

CVE-2021-27562 affects Arm Trusted Firmware M through 1.2; the NS world can trigger a system halt, overwrite secure data, or print secure data via NSPE handler mode. CVSS indicates low–medium overall risk (LOCAL, LOW IT, HIGH availability impact). Public sources confirm details across NVD, CISA K...

CVE-2021-29256

The CVE-2021-29256 entry covers a use-after-free vulnerability in the Arm Mali GPU kernel driver that can let an unprivileged user access freed memory, enabling information disclosure or potential root privilege escalation. Affected GPU families and ranges are: Bifrost r16p0–r29p0 (before r30p0),...

CVE-2020-35580

Summary: CVE-2020-35580 is a local file inclusion vulnerability in the SearchBlox FileServlet (versions before 9.2.2). The issue allows remote, unauthenticated attackers to read arbitrary files from the OS (via /searchblox/servlet/FileServlet?col=url=) and may expose the SearchBlox configuration ...

CVE-2021-32305

WebSVN (versions prior to 2.6.1) is affected by CVE-2021-32305, a remote code execution vulnerability where an attacker can inject shell metacharacters via the search parameter to execute arbitrary commands on the server. The issue is caused by unsafely handling the search input and is rated high...

CVE-2021-3537

Summary: CVE-2021-3537 affects libxml2 up to 2.9.11. In XML mixed content parsing, errors were not propagated, causing a NULL dereference when an untrusted document is parsed in recovery mode and post-validated, with availability as the highest impact. The connected documents confirm the vulnerab...

CVE-2021-24284

The CVE-2021-24284 entry covers the Kaswara Modern VC Addons WordPress plugin (versions up to 3.0.1). It admits unauthenticated arbitrary file uploads via the uploadFontIcon AJAX action, unzipping a supplied ZIP into wp-content/uploads/kaswara/fonts_icon without filtering PHP or other malicious f...

CVE-2021-24285

CVE-2021-24285 concerns the WordPress plugin Car Seller - Auto Classifieds Script (versions ≤ 2.1.0). The vulnerability is a SQL injection in the request_list_request AJAX handler: the order_id parameter is not sanitised/validated/escaped before being interpolated into a SQL statement, and the en...

CVE-2021-28799

CVE-2021-28799 is an improper authorization vulnerability affecting QNAP HBS 3 on various QTS/QuTS versions. The flaw allows remote attackers to log in to affected devices. Affected: HBS 3 on QTS 4.5.2 (prior to v16.0.0415); QTS 4.3.6 (prior to v3.0.210412); QTS 4.3.4 (prior to v3.0.210411); QTS ...

CVE-2021-31207

CVE-2021-31207 is one of the ProxyShell chain affecting on-premises Microsoft Exchange Server, enabling post-auth arbitrary-file-write that can lead to remote code execution. Exploitation chains documented in FireEye and related advisories describe initial steps using Autodiscover and MAPI to lea...

CVE-2021-31167

CVE-2021-31167 is a Windows vulnerability in the Container Manager Service that enables Elevation of Privilege. It is a local, low-attack-complexity issue with high impact (confidentiality/ integrity/ availability), allowing an attacker with low privileges to escalate. Public exploits are noted f...

CVE-2021-31166

CVE-2021-31166 : A use-after-free in Microsoft’s HTTP Protocol Stack (http.sys) enables remote code execution. The issue occurs in http!UlpParseContentCoding: a local LIST_ENTRY is built and then moved into the Request structure without nulling the local list, leaving entries dangling and allowin...

CVE-2021-26419

CVE-2021-26419 is a memory-corruption vulnerability in Internet Explorer’s scripting engine (jscript9.dll) that can lead to arbitrary code execution. The issue affects Internet Explorer 11 (and related IE components) and is exploitable remotely via a crafted web or Office document vector, with us...

CVE-2020-24587

CVE-2020-24587 is referenced in the Amazon Linux 2 kernel advisory for Kernel-5.10-2022-002. The connected document confirms a flaw in the Linux kernel 802.11 wifi fragmentation handling where fragments encrypted under different keys can be reassembled and decrypted, enabling an attacker within w...

CVE-2020-23575

Kyocera Printer d-COPIA253MF plus is affected by a directory-traversal vulnerability described in CVE-2020-23575. The issue allows an attacker to retrieve or view arbitrary files from the affected server via directory traversal. Connected sources (Kyocera/Nuclei template) confirm this affects Kyo...

CVE-2021-32471

CVE-2021-32471 concerns the Marvin Minsky 1967 Universal Turing Machine implementation, where insufficient input validation in the program allows a user to execute arbitrary code via crafted data. The described scenario notes that, after processing input composed of As and Bs (rather than 0s and ...

CVE-2021-28664

CVE-2021-28664 concerns the Arm Mali GPU kernel driver, enabling privilege escalation or memory corruption (unprivileged user can write to read-only memory). Affected GPU families and revisions: Bifrost r0p0–r29p0 (before r30p0), Valhall r19p0–r29p0 (before r30p0), and Midgard r8p0–r30p0 (before ...

CVE-2021-28663

CVE-2021-28663 is an Arm Mali GPU kernel-driver use-after-free memory corruption vulnerability that can enable privilege escalation or information disclosure. Affected GPUs span Bifrost (r0p0–r28p0 before r29p0), Valhall (r19p0–r28p0 before r29p0), and Midgard (r4p0–r30p0). The issue arises from ...