Uncategorized CVEs — 2021 (Page 9/26)

CVEs without a recognized CWE (not present in the CWE map or marked as N/A).

CVSS ≥ 0.0

2021-09-08

High

CVE-2021-1784

A permissions issue existed in DiskArbitration. This was addressed with additional ownership checks. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina, Security Update 2021…

CVSS: 7.5CWE: N/A

High

CVE-2020-27942

A logic issue was addressed with improved state management. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave. Processing a maliciously crafted font file may l…

CVSS: 7.8CWE: N/A

Medium

CVE-2020-27940

This issue was addressed with improved file handling. This issue is fixed in Apple TV app for Fire OS 6.1.0.6A142:7.1.0. An attacker with file system access may modify scripts used by the app.

CVSS: 4.3CWE: N/A

Low

CVE-2021-30804

A permissions issue was addressed with improved validation. This issue is fixed in iOS 14.7. A malicious application may be able to access Find My data.

CVSS: 3.3CWE: N/A

Low

CVE-2021-30803

A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.5. A malicious application may be able to access a user’s recent Contacts.

CVSS: 3.3CWE: N/A

High

CVE-2021-30800

This issue was addressed with improved checks. This issue is fixed in iOS 14.7. Joining a malicious Wi-Fi network may result in a denial of service or arbitrary code execution.

CVSS: 8.8CWE: N/A

High

CVE-2021-30798

A logic issue was addressed with improved state management. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6. A malicious application may be able to bypass certain Privacy preferences.

CVSS: 7.5CWE: N/A

High

CVE-2021-30797

This issue was addressed with improved checks. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. Processing maliciously crafted web content may lead to code…

CVSS: 8.8CWE: N/A

Medium

CVE-2021-30796

A logic issue was addressed with improved validation. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. Processing a maliciously…

CVSS: 6.5CWE: N/A

Critical

CVE-2021-30793

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. An application may be able t…

CVSS: 9.8CWE: N/A

High

CVE-2021-30790

An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. Opening a…

CVSS: 7.8CWE: N/A

High

CVE-2021-30788

This issue was addressed with improved checks. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7, Security Update 2021-005 Mojave, Security Update 2021-004 Catalina. Process…

CVSS: 7.1CWE: N/A

High

CVE-2021-30787

This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. An application may be able to cause unexp…

CVSS: 7.8CWE: N/A

High

CVE-2021-30784

Multiple issues were addressed with improved logic. This issue is fixed in macOS Big Sur 11.5. A local attacker may be able to execute code on the Apple T2 Security Chip.

CVSS: 7.8CWE: N/A

Medium

CVE-2021-30783

An access issue was addressed with improved access restrictions. This issue is fixed in macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. A sandboxed process may…

CVSS: 6.5CWE: N/A

Medium

CVE-2021-30782

This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. A malicious application may be able to ac…

CVSS: 5.5CWE: N/A

High

CVE-2021-30781

CVSS: 7.8CWE: N/A

High

CVE-2021-30779

This issue was addressed with improved checks. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. Processing a maliciously crafted image may lead to arbitrary code execution.

CVSS: 7.8CWE: N/A

Medium

CVE-2021-30778

This issue was addressed with improved entitlements. This issue is fixed in macOS Big Sur 11.5. A malicious application may be able to bypass Privacy preferences.

CVSS: 5.5CWE: N/A

Medium

CVE-2021-30776

A logic issue was addressed with improved validation. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7, Security Update 2021-004 Catalina. Playing a malicious audio file ma…

CVSS: 5.5CWE: N/A

High

CVE-2021-30774

A logic issue was addressed with improved validation. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. A malicious application may be able to gain root privileges.

CVSS: 7.8CWE: N/A

Medium

CVE-2021-30773

An issue in code signature validation was addressed with improved checks. This issue is fixed in iOS 14.7, tvOS 14.7, watchOS 7.6. A malicious application may be able to bypass code signing checks.

CVSS: 5.5CWE: N/A

High

CVE-2021-30772

This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.5. A malicious application may be able to gain root privileges.

CVSS: 7.8CWE: N/A

Medium

CVE-2021-30768

A logic issue was addressed with improved validation. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7, Security Update 2021-004 Catalina. A sandboxed process may be able t…

CVSS: 5.5CWE: N/A

High

CVE-2021-30764

Processing a maliciously crafted file may lead to arbitrary code execution. This issue is fixed in iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. This issue was addressed with improved checks.

CVSS: 7.8CWE: N/A

Medium

CVE-2021-30757

This issue was addressed by enabling hardened runtime. This issue is fixed in iMovie 10.2.4. Entitlements and privacy permissions granted to this app may be used by a malicious app.

CVSS: 5.5CWE: N/A

Medium

CVE-2021-30756

A local attacker may be able to view Now Playing information from the lock screen. This issue is fixed in macOS Big Sur 11.4, iOS 14.6 and iPadOS 14.6. A privacy issue in Now Playing was addressed wi…

CVSS: 5.5CWE: N/A

Medium

CVE-2021-30751

This issue was addressed with improved data protection. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass certain Privacy preferences.

CVSS: 5.5CWE: N/A

High

CVE-2021-30742

A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 14.5 and iPadOS 14.5. Processing a maliciously crafted audio file may lead to arbitrary code executi…

CVSS: 7.8CWE: N/A

High

CVE-2021-30740

A logic issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4, tvOS 14.6, watchOS 7.5, iOS 14.6 and iPadOS 14.6. A malicious application may be able to execute arbit…

CVSS: 7.8CWE: N/A

Medium

CVE-2021-30738

A malicious application may be able to overwrite arbitrary files. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-004 Mojave. An issue with path validation logic for hardlinks was add…

CVSS: 5.5CWE: N/A

Medium

CVE-2021-30731

This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-004 Catalina. An unprivileged application may be able to capture USB devices.

CVSS: 5.5CWE: N/A

High

CVE-2021-30729

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.6 and iPadOS 14.6. A device may accept invalid activation results.

CVSS: 7.5CWE: N/A

Medium

CVE-2021-30727

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, tvOS 14.6, watchOS 7.5, iOS 14.6 and iPadOS 14.6. A malicious application may be able to modify…

CVSS: 5.5CWE: N/A

High

CVE-2021-30724

This issue was addressed with improved checks. This issue is fixed in tvOS 14.6, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6, Security Update 2021-003 Catalina, macOS Big Sur 11.4, watc…

CVSS: 7.8CWE: N/A

Medium

CVE-2021-30723

An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave, iOS 14.6 a…

CVSS: 5.5CWE: N/A

Medium

CVE-2021-30722

CVSS: 5.9CWE: N/A

Medium

CVE-2021-30721

A path handling issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. An attacker in a privilege…

CVSS: 6.5CWE: N/A

Medium

CVE-2021-1929

Lack of strict validation of bootmode can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdrago…

CVSS: 6.2CWE: N/A

Medium

CVE-2021-39122

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability in the /rest/api/2/search endpoint. The a…

CVSS: 5.3CWE: N/A

Medium

CVE-2021-39121

Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an Information Disclosure vulnerability in the /rest…

CVSS: 4.3CWE: N/A

Medium

CVE-2021-39116

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the GIF Image Reader componen…

CVSS: 5.5CWE: N/A

2021-09-07

High

CVE-2020-19767

A lack of target address verification in the destroycontract() function of 0xRACER 1.0 allows attackers to steal tokens from victim users via a crafted script.

CVSS: 7.5CWE: N/A

High

CVE-2021-38617

In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to create a super user account with a defined password. This directly leads to privil…

CVSS: 8.8CWE: N/A

High

CVE-2021-38616

In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/{user-guid}/ user edition endpoint could permit any logged-in user to increase their own permissions via a user_permissions array in…

CVSS: 7.6CWE: N/A

Medium

CVE-2021-38615

In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/sso/config/ SSO configuration endpoint allows any logged-in user (guest, standard, or admin) to view and modify information.

CVSS: 6.3CWE: N/A

High

CVE-2021-36162

Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). These rules are loaded into the configuration center (eg: Zookeeper, Nacos, ...) an…

CVSS: 8.8CWE: N/A

Medium

CVE-2021-34149

The Bluetooth Classic implementation on the Texas Instruments CC256XCQFN-EM does not properly handle the reception of continuous LMP_AU_Rand packets, allowing attackers in radio range to trigger a de…

CVSS: 6.5CWE: N/A

Medium

CVE-2021-34148

The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMP_max_slot with a greater ACL Length after completi…

CVSS: 6.5CWE: N/A

Medium

CVE-2021-34147

The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 does not properly handle the reception of a malformed LMP timing accuracy response followed by multiple…

CVSS: 6.5CWE: N/A

Medium

CVE-2021-34146

The Bluetooth Classic implementation in the Cypress CYW920735Q60EVB does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a deni…

CVSS: 6.5CWE: N/A

Medium

CVE-2021-34145

The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMP_max_slot with an invalid Baseband packet type (an…

CVSS: 5.3CWE: N/A

Medium

CVE-2021-34143

The Bluetooth Classic implementation in the Zhuhai Jieli AC6366C_DEMO_V1.0 does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger…

CVSS: 6.5CWE: N/A

Medium

CVE-2021-31612

The Bluetooth Classic implementation on Zhuhai Jieli AC690X devices does not properly handle the reception of an oversized LMP packet greater than 17 bytes during the LMP auto rate procedure, allowin…

CVSS: 6.5CWE: N/A

Medium

CVE-2021-31610

The Bluetooth Classic implementation on AB32VG1 devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of servic…

CVSS: 6.5CWE: N/A

Medium

CVE-2021-31609

The Bluetooth Classic implementation in Silicon Labs iWRAP 6.3.0 and earlier does not properly handle the reception of an oversized LMP packet greater than 17 bytes, allowing attackers in radio range…

CVSS: 6.5CWE: N/A

High

CVE-2021-28139

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in…

CVSS: 8.8CWE: N/A

Medium

CVE-2021-34150

The Bluetooth Classic implementation on Bluetrum AB5301A devices with unknown firmware versions does not properly handle the reception of oversized DM1 LMP packets while no other BT connections are a…

CVSS: 6.5CWE: N/A

Medium

CVE-2021-34144

The Bluetooth Classic implementation in the Zhuhai Jieli AC6366C BT SDK through 0.9.1 does not properly handle the reception of truncated LMP_SCO_Link_Request packets while no other BT connections ar…

CVSS: 6.5CWE: N/A

Medium

CVE-2021-31613

The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle the reception of a truncated LMP packet during the LMP auto rate procedure, allowing attackers…

CVSS: 6.5CWE: N/A

Medium

CVE-2021-28155

The Bluetooth Classic implementation on JBL TUNE500BT devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of…

CVSS: 6.5CWE: N/A

Medium

CVE-2021-28135

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger…

CVSS: 6.5CWE: N/A

Critical

CVE-2021-40540

ulfius_uri_logger in Ulfius HTTP Framework before 2.7.4 omits con_info initialization and a con_info->request NULL check for certain malformed HTTP requests.

CVSS: 9.8CWE: N/A

2021-09-06

Critical

CVE-2021-40532

Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension.

CVSS: 9.8CWE: N/A

Medium

CVE-2021-24006

An improper access control vulnerability in FortiManager versions 6.4.0 to 6.4.3 may allow an authenticated attacker with a restricted user profile to access the SD-WAN Orchestrator panel via directl…

CVSS: 6.3CWE: N/A

Medium

CVE-2020-15939

An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, unprivileged attacker to download the device configuration…

CVSS: 4.3CWE: N/A

2021-09-03

High

CVE-2021-30620

Chromium: CVE-2021-30620 Insufficient policy enforcement in Blink

CVSS: 8.8CWE: N/A

High

CVE-2021-30618

Chromium: CVE-2021-30618 Inappropriate implementation in DevTools

CVSS: 8.8CWE: N/A

Medium

CVE-2021-30617

Chromium: CVE-2021-30617 Policy bypass in Blink

CVSS: 6.5CWE: N/A

Medium

CVE-2021-30615

Chromium: CVE-2021-30615 Cross-origin data leak in Navigation

CVSS: 6.5CWE: N/A

2021-09-02

Medium

CVE-2021-38642

Microsoft Edge for iOS Spoofing Vulnerability

CVSS: 6.1CWE: N/A

Medium

CVE-2021-38641

Microsoft Edge for Android Spoofing Vulnerability

CVSS: 6.1CWE: N/A

Medium

CVE-2021-26439

Microsoft Edge for Android Information Disclosure Vulnerability

CVSS: 4.6CWE: N/A

Medium

CVE-2021-26436

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

CVSS: 6.1CWE: N/A

Medium

CVE-2021-22525

This release addresses a potential information leakage vulnerability in NetIQ Access Manager versions prior to 5.0.1

CVSS: 5.5CWE: N/A

High

CVE-2020-13929

Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act as another user. This issue affects Apache Zeppelin Apache Zeppelin versio…

CVSS: 7.5CWE: N/A

2021-09-01

High

CVE-2021-40387

An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is authenticated remote code execution.

CVSS: 8.8CWE: N/A

High

CVE-2021-40385

An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is a privilege escalation from read-only user to admin.

CVSS: 8.8CWE: N/A

High

CVE-2021-40382

An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. mjpegStreamer.cgi allows video screenshot access.

CVSS: 7.5CWE: N/A

High

CVE-2021-40381

An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. index_MJpeg.cgi allows video access.

CVSS: 7.5CWE: N/A

High

CVE-2021-40380

An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. cameralist.cgi and setcamera.cgi disclose credentials.

CVSS: 7.5CWE: N/A

Medium

CVE-2021-29851

IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. IBM X-Force ID: 205527.

CVSS: 4.3CWE: N/A

Medium

CVE-2021-36012

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can…

CVSS: 6.5CWE: CWE-840

Medium

CVE-2021-23426

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function.

CVSS: 5.6CWE: N/A

High

CVE-2021-38703

Wireless devices running certain Arcadyan-derived firmware (such as KPN Experia WiFi 1.00.15) do not properly sanitise user input to the syslog configuration form. An authenticated remote attacker co…

CVSS: 8.8CWE: N/A

High

CVE-2021-36235

An issue was discovered in Ivanti Workspace Control before 10.6.30.0. A locally authenticated user with low privileges can bypass File and Folder Security by leveraging an unspecified attack vector.…

CVSS: 7.8CWE: N/A

Critical

CVE-2020-20495

bludit v3.13.0 contains an arbitrary file deletion vulnerability in the backup plugin via the `deleteBackup' parameter.

CVSS: 9.1CWE: N/A

2021-08-31

Medium

CVE-2021-40085

An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a crafted extra_dhcp_opts value.

CVSS: 6.5CWE: N/A

High

CVE-2021-22944

A vulnerability found in UniFi Protect application V1.18.1 and earlier allows a malicious actor with a view-only role and network access to gain the same privileges as the owner of the UniFi Protect…

CVSS: 8.0CWE: N/A

Medium

CVE-2021-35219

ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page.

CVSS: 6.0CWE: N/A

High

CVE-2021-40330

git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localho…

CVSS: 7.5CWE: N/A

2021-08-30

Critical

CVE-2020-22848

A remote code execution (RCE) vulnerability in the \Playsong.php component of cscms v4.1 allows attackers to execute arbitrary commands.

CVSS: 9.8CWE: N/A

High

CVE-2021-39271

OrbiTeam BSCW Classic before 7.4.3 allows authenticated remote code execution (RCE) during archive extraction via attacker-supplied Python code in the class attribute of a .bscw file. This is fixed i…

CVSS: 8.8CWE: N/A

2021-08-29

Critical

CVE-2021-40177

Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite.

CVSS: 9.8CWE: N/A

2021-08-27

Medium

CVE-2021-28699

inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. That is, when operating in this mode, a guest has two tables. As a resu…

CVSS: 5.5CWE: N/A

Medium

CVE-2021-28695

IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables…

CVSS: 6.8CWE: N/A

Medium

CVE-2021-28694

CVSS: 6.8CWE: N/A

2021-08-26

Medium

CVE-2021-29862

IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 206086.

CVSS: 5.5CWE: N/A

High

CVE-2021-29801

IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the kernel to gain root privileges. IBM X-Force ID: 203977.

CVSS: 7.8CWE: N/A

Medium

CVE-2021-29727

IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 201106.

CVSS: 5.5CWE: N/A

Critical

CVE-2021-29715

IBM API Connect 5.0.0.0 through 5.0.8.11 could alllow a remote user to obtain sensitive information or conduct denial of serivce attacks due to open ports. IBM X-Force ID: 201018.

CVSS: 9.1CWE: N/A

Medium

CVE-2021-36929

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

CVSS: 6.3CWE: N/A

Critical

CVE-2021-40147

EmTec ZOC before 8.02.2 allows \e[201~ pastes, a different vulnerability than CVE-2021-32198.

CVSS: 9.8CWE: N/A

2021-08-25

Critical

CVE-2021-37334

Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion. A vulnerability occ…

CVSS: 9.8CWE: N/A

Critical

CVE-2021-37153

ForgeRock Access Management (AM) before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass issue.

CVSS: 9.8CWE: N/A

Medium

CVE-2021-22250

Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administrators created for their account

CVSS: 5.4CWE: N/A

Low

CVE-2021-22244

Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability data

CVSS: 3.1CWE: N/A

Low

CVE-2021-40089

An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the…

CVSS: 2.3CWE: N/A

2021-08-24

Critical

CVE-2021-31009

Multiple issues were addressed by removing HDF5. This issue is fixed in iOS 15.2 and iPadOS 15.2, macOS Monterey 12.1. Multiple issues in HDF5.

CVSS: 9.8CWE: N/A

High

CVE-2021-31005

Description: A logic issue was addressed with improved state management. This issue is fixed in iOS 15 and iPadOS 15, macOS Monterey 12.0.1. Turning off "Block all remote content" may not apply to al…

CVSS: 7.5CWE: N/A

Medium

CVE-2021-31001

An access issue was addressed with improved access restrictions. This issue is fixed in iOS 15 and iPadOS 15. An attacker in a privileged network position may be able to leak sensitive user informati…

CVSS: 6.5CWE: N/A

Medium

CVE-2021-30998

A S/MIME issue existed in the handling of encrypted email. This issue was addressed with improved selection of the encryption certificate. This issue is fixed in iOS 15.2 and iPadOS 15.2. A sender's…

CVSS: 5.3CWE: N/A

Low

CVE-2021-30994

An access issue was addressed with improved access restrictions. This issue is fixed in macOS Monterey 12.0.1. A malicious application may be able to access local users' Apple IDs.

CVSS: 3.3CWE: N/A

Medium

CVE-2021-30992

This issue was addressed with improved handling of file metadata. This issue is fixed in iOS 15.2 and iPadOS 15.2. A user in a FaceTime call may unexpectedly leak sensitive user information through L…

CVSS: 5.5CWE: N/A

Medium

CVE-2021-30990

A logic issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.1, Security Update 2021-008 Catalina, macOS Big Sur 11.6.2. A malicious application may bypass Gatekeepe…

CVSS: 5.5CWE: N/A

Medium

CVE-2021-30988

Description: A permissions issue was addressed with improved validation. This issue is fixed in iOS 15.2 and iPadOS 15.2. A malicious application may be able to identify what other applications a use…

CVSS: 5.5CWE: N/A

Medium

CVE-2021-30986

A device configuration issue was addressed with an updated configuration. This issue is fixed in macOS Monterey 12.1. A device may be passively tracked by its Bluetooth MAC address.

CVSS: 5.5CWE: N/A

Medium

CVE-2021-30976

A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.1, Security Update 2021-008 Catalina, macOS Big Sur 11.6.2. A malicious application may bypass Gat…

CVSS: 5.5CWE: N/A

Medium

CVE-2021-30970

A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.1, macOS Big Sur 11.6.2. A malicious application may be able to bypass Privacy preferences.

CVSS: 5.5CWE: N/A

High

CVE-2021-30969

A path handling issue was addressed with improved validation. This issue is fixed in Security Update 2021-008 Catalina, macOS Big Sur 11.6.2. Processing a maliciously crafted URL may cause unexpected…

CVSS: 7.8CWE: N/A