CVE-2021-25371

The CVE-2021-25371 issue affects Samsung SMR firmware (Mar-2021 Release 1) DSP driver, where a vulnerability could allow loading arbitrary ELF libraries inside the DSP. Affected component is the DSP driver within Samsung SMR firmware; root cause details are not provided in the sources, but the co...

CVE-2021-25370

CVE-2021-25370 is a Samsung-internal chain of three vulnerabilities fixed in SMR Mar-2021 Release 1. The final issue is a use-after-free in the Display Processing Unit (DPU) driver that allows memory corruption leading to kernel panic when a file descriptor is mishandled in the DPU path. The thre...

CVE-2021-25369

CVE-2021-25369 is an information-leak vulnerability in the Samsung device stack, uncovered as part of a three-vulnerability exploit chain. The issue resides in an improper access control of the sec_log file, exposing kernel information to userspace prior to Samsung’s SMR MAR-2021 Release 1. The l...

CVE-2020-19625

Gridx 1.3 is affected by a remote code execution vulnerability in tests/support/stores/test_grid_filter.php, exploitable via crafted values in the $query parameter. The Nuclei template CVE-2020-19625 confirms this remote code execution path and assigns a CRITICAL severity. Impact, as described in...

CVE-2021-22506

Mode C: Affected product is Micro Focus Access Manager prior to version 5.0. The connected documents describe an Information Leakage vulnerability (CVE-2021-22506) in the Access Manager, arising from an advance configuration exposure that could disclose information. The Nessus entry additionally ...

CVE-2021-1435

CVE-2021-1435 affects Cisco IOS XE Software Web UI, allowing an authenticated attacker to inject and execute arbitrary commands as root due to insufficient input validation. Exploitation occurs via crafted requests to the Web UI; impact is root-level command execution. Cisco released advisories a...

CVE-2021-21402

Summary of CVE-2021-21402 (Jellyfin) : A local/file read vulnerability exists in Jellyfin before version 10.7.1, enabling an attacker to read arbitrary files from the server’s filesystem via crafted requests. The issue is more prevalent when Windows is the host OS and affected servers exposed to ...

CVE-2021-26295

Apache OFBiz contains an unsafe Java deserialization vulnerability in requests leading to remote takeover on versions prior to 17.12.06. Multiple sources (including MSF exploit for the SOAP endpoint prior to 17.12.06) describe PoCs/Exploits and DNS-log-based validation. Affected component is OFBi...

CVE-2021-27358

Grafana 6.7.3–7.4.1 is affected by CVE-2021-27358 via the snapshot feature. An unauthenticated remote attacker can trigger a Denial of Service by making a remote API call if a common configuration is set. Remediation: upgrade to Grafana 7.4.2 or later (fix released in 7.4.2).

CVE-2021-21193

CVE-2021-21193 is a use-after-free in Blink of Chromium-based browsers (Chrome) prior to 89.0.4389.90 that can allow remote code execution via a crafted HTML page, with evidence of an exploit in the wild per Arch/Chromium advisories. Affected products include Google Chrome/Chromium (Blink/WebKit ...

CVE-2021-27076

CVE-2021-27076 is a remote code execution flaw in Microsoft SharePoint Server (2019, 2016, 2013 SP1, Foundation) caused by improper code generation management. Attackers with low privileges can execute arbitrary code. CIRCL records active exploitation since March 2021, with proof-of-concept code ...

CVE-2021-27059

CVE-2021-27059 is a Microsoft Office Remote Code Execution vulnerability with public advisories and multiple security updates. The provided documents indicate affected products include Office 2010, Office 2013, and Office 2016 (32/64‑bit), across multiple Service Packs. The root cause is not expl...

CVE-2021-27085

Technical details about CVE-2021-27085 are not publicly provided in the connected documents. The sources mention Internet Explorer RCE but do not specify affected versions, exploits, or remediations in the supplied materials. Monitor for updates.

CVE-2021-26899

Technical details for CVE-2021-26899, including affected product/version, root cause, impact, and fix, are not provided in the connected documents. Monitor for updates from official sources.

CVE-2021-26868

Technical details about CVE-2021-26868 are not publicly provided in the supplied documents; monitor for updates.

CVE-2021-26411

CVE-2021-26411 (Internet Explorer Memory Corruption) is a memory-corruption vulnerability in IE that was exploited in the wild as a zero‑day. Project Zero’s analysis attributes two primary bug patterns to IE exploitation: a use-after-free caused by a user-controlled callback between object operat...

CVE-2021-21166

CVE-2021-21166 describes a data race in the audio component of Google Chrome (Chromium-based) prior to 89.0.4389.72, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. Affected product: Google Chrome (Chromium) before 89.0.4389.72; root cause: audi...

CVE-2021-26294

CVE-2021-26294 affects AfterLogic Aurora and WebMail Pro up to version 7.7.9. It is a directory traversal vulnerability in WebDAV endpoints (dav/server.php) that allows unauthenticated attackers to read arbitrary files (e.g., data/settings/settings.xml) by using crafted paths such as ../..//dav/s...

CVE-2021-27964

CVE-2021-27964 affects SonLogger prior to 6.4.1. It enables unauthenticated arbitrary file upload via POST to /Config/SaveUploadedHotspotLogoFile without validating file extension/content, enabling remote code execution and potential full server compromise as described in connected sources. Remed...

CVE-2021-25337

CVE-2021-25337 is an Samsung-only vulnerability in the clipboard content provider (system_server) that allowed untrusted apps to read/write arbitrary files via improper access control before SMR Mar-2021 Release 1. The issue stems from missing access checks in the SemClipboardProvider.insert path...