CVE Vulnerability Catalog

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.

A type confusion issue exists in Apple products (macOS, iOS, iPadOS, watchOS, tvOS, Safari) due to improper state handling. Processing maliciously crafted web content may lead to arbitrary code execution.

A race condition exists in Apple products (macOS, iOS, iPadOS, watchOS, tvOS) due to improper locking. A malicious application may be able to elevate privileges. Apple is aware of reports that this issue may have been actively exploited.

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE).

A Server Side Request Forgery (SSRF) vulnerability in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the API to perform an SSRF attack to steal administrative credentials.

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 and BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability.

An improper boundary check in the DSP driver prior to SMR Mar-2021 Release 1 allows out-of-bounds memory access.

A vulnerability in the DSP driver prior to SMR Mar-2021 Release 1 allows attackers to load arbitrary ELF libraries inside the DSP.

An incorrect implementation handling file descriptors in the dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.

An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace.

An information leakage vulnerability exists in Micro Focus Access Manager due to advanced configuration. It affects all versions prior to 5.0.

A use-after-free vulnerability exists in Blink in Google Chrome prior to 89.0.4389.90. A remote attacker could potentially exploit heap corruption via a crafted HTML page.

Internet Explorer Remote Code Execution Vulnerability. Details are not provided in the description, but it allows remote code execution.

Microsoft Office Remote Code Execution Vulnerability. Details are not provided in the description, but it allows remote code execution.

A memory corruption vulnerability in Internet Explorer that could allow remote code execution.

A data race vulnerability exists in audio in Google Chrome prior to 89.0.4389.72. A remote attacker could potentially exploit heap corruption via a crafted HTML page.

Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.

Rockwell Automation Studio 5000 Logix Designer w wersjach 21 i nowszych oraz RSLogix 5000 w wersjach od 16 do 20 są podatne na atak, który pozwala nieautoryzowanemu użytkownikowi obejść mechanizm weryfikacji komunikacji z kontrolerami Logix. Atakujący może uwierzytelnić się z użyciem urządzeń CompactLogix i ControlLogix.

A remote code execution vulnerability in Microsoft Exchange Server allows an attacker to execute arbitrary code in the context of the system on the Exchange server.

A remote code execution vulnerability in Microsoft Exchange Server allows an attacker to execute arbitrary code on the server.