Lista CVE - 2021 / Aprile
Visualizzazione 1001 - 1100 di 1817 CVE per Aprile 2021 (Pagina 11 di 19)
| ID CVE | Data | Titolo |
|---|---|---|
| CVE-2021-3492 | 2021-04-17 | Ubuntu linux kernel shiftfs file system double free vulnerability |
| CVE-2021-3493 | 2021-04-17 | The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to... |
| CVE-2021-23378 | 2021-04-18 | Arbitrary Command Injection |
| CVE-2021-23377 | 2021-04-18 | Arbitrary Command Injection |
| CVE-2021-23376 | 2021-04-18 | Arbitrary Command Injection |
| CVE-2021-23375 | 2021-04-18 | Arbitrary Command Injection |
| CVE-2021-23374 | 2021-04-18 | Arbitrary Command Injection |
| CVE-2021-23381 | 2021-04-18 | Arbitrary Command Injection |
| CVE-2021-23380 | 2021-04-18 | Arbitrary Command Injection |
| CVE-2021-23379 | 2021-04-18 | Arbitrary Command Injection |
| CVE-2021-29457 | 2021-04-19 | Heap buffer overflow in Exiv2::Jp2Image::doWriteMetadata |
| CVE-2021-29458 | 2021-04-19 | Out-of-bounds read in Exiv2::Internal::CrwMap::encode |
| CVE-2021-29399 | 2021-04-19 | XMB is vulnerable to cross-site scripting (XSS) due to inadequate filtering of BBCode input. This bug affects all versions of XMB. All XMB installations must be updated to versions 1.9.12.03... |
| CVE-2021-21070 | 2021-04-19 | Privilege Escalation Vulnerability in Adobe RoboHelp |
| CVE-2020-7851 | 2021-04-19 | Innorix File Transfer Solution File Download and Execution Vulnerability |
| CVE-2021-20989 | 2021-04-19 | Fibaro Home Center Insufficient remote access server authorization |
| CVE-2021-20990 | 2021-04-19 | Fibaro Home Center Unauthenticated access to shutdown, reboot and reboot to recovery mode |
| CVE-2021-20991 | 2021-04-19 | Fibaro Home Center Authenticated remote command execution |
| CVE-2021-20992 | 2021-04-19 | Fibaro Home Center Unencrypted management interface |
| CVE-2021-21981 | 2021-04-19 | VMware NSX-T contains a privilege escalation vulnerability due to an issue with RBAC (Role based access control) role assignment. Successful exploitation of this issue may allow attackers with local guest... |
| CVE-2021-27027 | 2021-04-19 | An Out-Of-Bounds Read Vulnerability in Autodesk FBX Review version 1.5.0 and prior may lead to code execution through maliciously crafted DLL files or information disclosure. |
| CVE-2021-27028 | 2021-04-19 | A Memory Corruption Vulnerability in Autodesk FBX Review version 1.5.0 and prior may lead to remote code execution through maliciously crafted DLL files. |
| CVE-2021-27029 | 2021-04-19 | The user may be tricked into opening a malicious FBX file which may exploit a Null Pointer Dereference vulnerability in FBX's Review version 1.5.0 and prior causing the application to... |
| CVE-2021-27030 | 2021-04-19 | A user may be tricked into opening a malicious FBX file which may exploit a Directory Traversal Remote Code Execution vulnerability in FBX’s Review causing it to run arbitrary code... |
| CVE-2021-27031 | 2021-04-19 | A user may be tricked into opening a malicious FBX file which may exploit a use-after-free vulnerability in FBX's Review causing the application to reference a memory location controlled by... |
| CVE-2020-28141 | 2021-04-19 | The messaging subsystem in the Online Discussion Forum 1.0 is vulnerable to XSS in the message body. An authenticated user can send messages to arbitrary users on the system that... |
| CVE-2021-20527 | 2021-04-19 | IBM Resilient SOAR V38.0 could allow a privileged user to create create malicious scripts that could be executed as another user. IBM X-Force ID: 198759. |
| CVE-2021-31254 | 2021-04-19 | Buffer overflow in the tenc_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file, related invalid IV... |
| CVE-2021-31255 | 2021-04-19 | Buffer overflow in the abst_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file. |
| CVE-2021-31256 | 2021-04-19 | Memory leak in the stbl_GetSampleInfos function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file. |
| CVE-2021-31257 | 2021-04-19 | The HintFile function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command. |
| CVE-2021-31258 | 2021-04-19 | The gf_isom_set_extraction_slc function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command. |
| CVE-2021-31259 | 2021-04-19 | The gf_isom_cenc_get_default_info_internal function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command. |
| CVE-2021-31260 | 2021-04-19 | The MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command. |
| CVE-2021-31261 | 2021-04-19 | The gf_hinter_track_new function in GPAC 1.0.1 allows attackers to read memory via a crafted file in the MP4Box command. |
| CVE-2021-31262 | 2021-04-19 | The AV1_DuplicateConfig function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command. |
| CVE-2021-29434 | 2021-04-19 | Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields |
| CVE-2021-29453 | 2021-04-19 | Denial of service through memory exhaustion |
| CVE-2021-29455 | 2021-04-19 | Missing validation of JWT signature in `grassrootza/grassroot-platform` |
| CVE-2021-29279 | 2021-04-19 | There is a integer overflow in function filter_core/filter_props.c:gf_props_assign_value in GPAC 1.0.1. In which, the arg const GF_PropertyValue *value,maybe value->value.data.size is a negative number. In result, memcpy in gf_props_assign_value failed. |
| CVE-2021-30015 | 2021-04-19 | There is a Null Pointer Dereference in function filter_core/filter_pck.c:gf_filter_pck_new_alloc_internal in GPAC 1.0.1. The pid comes from function av1dmx_parse_flush_sample, the ctx.opid maybe NULL. The result is a crash in gf_filter_pck_new_alloc_internal. |
| CVE-2021-30019 | 2021-04-19 | In the adts_dmx_process function in filters/reframe_adts.c in GPAC 1.0.1, a crafted file may cause ctx->hdr.frame_size to be smaller than ctx->hdr.hdr_size, resulting in size to be a negative number and a... |
| CVE-2021-30020 | 2021-04-19 | In the function gf_hevc_read_pps_bs_internal function in media_tools/av_parsers.c in GPAC 1.0.1 there is a loop, which with crafted file, pps->num_tile_columns may be larger than sizeof(pps->column_width), which results in a heap overflow... |
| CVE-2021-30199 | 2021-04-19 | In filters/reframe_latm.c in GPAC 1.0.1 there is a Null Pointer Dereference, when gf_filter_pck_get_data is called. The first arg pck may be null with a crafted mp4 file,which results in a... |
| CVE-2021-30014 | 2021-04-19 | There is a integer overflow in media_tools/av_parsers.c in the hevc_parse_slice_segment function in GPAC from v0.9.0-preview to 1.0.1 which results in a crash. |
| CVE-2021-30022 | 2021-04-19 | There is a integer overflow in media_tools/av_parsers.c in the gf_avc_read_pps_bs_internal in GPAC from 0.5.2 to 1.0.1. pps_id may be a negative number, so it will not return. However, avc->pps only... |
| CVE-2021-3505 | 2021-04-19 | A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification.... |
| CVE-2021-3497 | 2021-04-19 | GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files. |
| CVE-2021-3498 | 2021-04-19 | GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files. |
| CVE-2020-27240 | 2021-04-19 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The componentStatus parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection An attacker can make... |
| CVE-2020-27241 | 2021-04-19 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The serialnumber parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection. An attacker can make... |
| CVE-2021-27458 | 2021-04-19 | If Ethernet communication of the JTEKT Corporation TOYOPUC product series’ (TOYOPUC-PC10 Series: PC10G-CPU TCC-6353: All versions, PC10GE TCC-6464: All versions, PC10P TCC-6372: All versions, PC10P-DP TCC-6726: All versions, PC10P-DP-IO TCC-6752:... |
| CVE-2021-3506 | 2021-04-19 | An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker... |
| CVE-2021-20208 | 2021-04-19 | A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host.... |
| CVE-2021-29155 | 2021-04-20 | An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information... |
| CVE-2021-30496 | 2021-04-20 | The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an attacker-supplied message (e.g., in the Persian language)... |
| CVE-2021-3035 | 2021-04-20 | Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution |
| CVE-2021-3036 | 2021-04-20 | PAN-OS: Administrator secrets are logged in web server logs when using the PAN-OS XML API incorrectly |
| CVE-2021-3037 | 2021-04-20 | PAN-OS: Secrets for scheduled configuration exports are logged in system logs |
| CVE-2021-3038 | 2021-04-20 | GlobalProtect App: Windows VPN kernel driver denial of service (DoS) |
| CVE-2021-25679 | 2021-04-20 | The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions... |
| CVE-2021-25680 | 2021-04-20 | The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as... |
| CVE-2021-25681 | 2021-04-20 | AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed AdTran Personal Phone Manager web servers... |
| CVE-2021-20453 | 2021-04-20 | IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to... |
| CVE-2021-20023 | 2021-04-20 | SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host. |
| CVE-2020-7856 | 2021-04-20 | A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient authentication validation. |
| CVE-2021-28793 | 2021-04-20 | vscode-restructuredtext before 146.0.0 contains an incorrect access control vulnerability, where a crafted project folder could execute arbitrary binaries via crafted workspace configuration. |
| CVE-2021-28492 | 2021-04-20 | Unisys Stealth (core) 5.x before 5.0.048.0, 5.1.x before 5.1.017.0, and 6.x before 6.0.037.0 stores passwords in a recoverable format. |
| CVE-2020-25864 | 2021-04-20 | HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14. |
| CVE-2021-1079 | 2021-04-20 | NVIDIA GeForce Experience, all versions prior to 3.22, contains a vulnerability in GameStream plugins where log files are created using NT/System level permissions, which may lead to code execution, denial... |
| CVE-2021-28156 | 2021-04-20 | HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10. |
| CVE-2020-14105 | 2021-04-20 | The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15. |
| CVE-2020-26197 | 2021-04-20 | Dell PowerScale OneFS 8.1.0 - 9.1.0 contains an LDAP Provider inability to connect over TLSv1.2 vulnerability. It may make it easier to eavesdrop and decrypt such traffic for a malicious... |
| CVE-2021-21526 | 2021-04-20 | Dell PowerScale OneFS 8.1.0 - 9.1.0 contains a privilege escalation in SmartLock compliance mode that may allow compadmin to execute arbitrary commands as root. |
| CVE-2021-30464 | 2021-04-20 | OMICRON StationGuard before 1.10 allows remote attackers to cause a denial of service (connectivity outage) via crafted tcp/20499 packets to the CTRL Ethernet port. |
| CVE-2021-28827 | 2021-04-20 | TIBCO Administrator Stored Cross Site Scripting vulnerability |
| CVE-2021-28828 | 2021-04-20 | TIBCO Administrator SQL injection vulnerability |
| CVE-2021-28829 | 2021-04-20 | TIBCO Administrator CSV injection vulnerability |
| CVE-2021-29459 | 2021-04-20 | XSS Cross Site Scripting |
| CVE-2020-35313 | 2021-04-20 | A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to execute arbitrary code via a crafted URL to the theme/plugin installer. |
| CVE-2020-35314 | 2021-04-20 | A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to upload a custom plugin which can contain arbitrary code and obtain a... |
| CVE-2021-29461 | 2021-04-20 | LFI and possible code execution on discord-recon using tools arguments |
| CVE-2020-7857 | 2021-04-20 | A vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of improper classes. This issue affects: Tobesoft XPlatform versions prior... |
| CVE-2021-29462 | 2021-04-20 | DNS rebinding in pupnp |
| CVE-2020-35980 | 2021-04-21 | An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is a use-after-free in the function gf_isom_box_del() in isomedia/box_funcs.c. |
| CVE-2021-1076 | 2021-04-21 | NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys or nvidia.ko) where improper access control may lead to denial of... |
| CVE-2021-1077 | 2021-04-21 | NVIDIA GPU Display Driver for Windows and Linux, R450 and R460 driver branch, contains a vulnerability where the software uses a reference count to manage a resource that is incorrectly... |
| CVE-2021-28965 | 2021-04-21 | The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after... |
| CVE-2021-20454 | 2021-04-21 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability... |
| CVE-2021-20501 | 2021-04-21 | IBM i 7.1, 7.2, 7.3, and 7.4 SMTP allows a network attacker to send emails to non-existent local-domain recipients to the SMTP server, caused by using a non-default configuration. An... |
| CVE-2021-21642 | 2021-04-21 | Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2021-21643 | 2021-04-21 | Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of... |
| CVE-2021-21644 | 2021-04-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an attacker-specified ID. |
| CVE-2021-21645 | 2021-04-21 | Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs. |
| CVE-2021-21646 | 2021-04-21 | Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attackers with Job/Configure permission to execute arbitrary code in the context of... |
| CVE-2021-21647 | 2021-04-21 | Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read permission to schedule builds of projects without having Item/Build... |
| CVE-2020-35979 | 2021-04-21 | An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is heap-based buffer overflow in the function gp_rtp_builder_do_avc() in ietf/rtp_pck_mpeg4.c. |
| CVE-2020-35981 | 2021-04-21 | An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function SetupWriters() in isomedia/isom_store.c. |
| CVE-2020-35982 | 2021-04-21 | An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function gf_hinter_track_finalize() in media_tools/isom_hinter.c. |
| CVE-2021-30139 | 2021-04-21 | In Alpine Linux apk-tools before 2.12.5, the tarball parser allows a buffer overflow and crash. |