|
2021-12-10
|
CVE-2021-44228
|
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along...
|
Log4j, Xcode, Synchro, Synchro_4d, Advanced_malware_protection_virtual_private_cloud_appliance, Automated_subsea_tuning, Broadworks, Business_process_automation, Cloud_connect, Cloudcenter, Cloudcenter_cost_optimizer, Cloudcenter_suite, Cloudcenter_suite_admin, Cloudcenter_workload_manager, Common_services_platform_collector, Connected_analytics_for_network_deployment, Connected_mobile_experiences, Contact_center_domain_manager, Contact_center_management_portal, Crosswork_data_gateway, Crosswork_network_automation, Crosswork_network_controller, Crosswork_optimization_engine, Crosswork_platform_infrastructure, Crosswork_zero_touch_provisioning, Customer_experience_cloud_agent, Cx_cloud_agent, Cyber_vision, Cyber_vision_sensor_management_extension, Data_center_network_manager, Dna_center, Dna_spaces, Dna_spaces\:_connector, Dna_spaces_connector, Emergency_responder, Enterprise_chat_and_email, Evolved_programmable_network_manager, Finesse, Firepower_threat_defense, Fog_director, Fxos, Identity_services_engine, Integrated_management_controller_supervisor, Intersight_virtual_appliance, Iot_operations_dashboard, Mobility_services_engine, Network_assurance_engine, Network_dashboard_fabric_controller, Network_insights_for_data_center, Network_services_orchestrator, Nexus_dashboard, Nexus_insights, Optical_network_controller, Packaged_contact_center_enterprise, Paging_server, Prime_service_catalog, Sd\-Wan_vmanage, Smart_phy, Ucs_central, Ucs_central_software, Ucs_director, Unified_communications_manager, Unified_communications_manager_im_\&_presence_service, Unified_communications_manager_im_and_presence_service, Unified_computing_system, Unified_contact_center_enterprise, Unified_contact_center_express, Unified_contact_center_management_portal, Unified_customer_voice_portal, Unified_intelligence_center, Unified_sip_proxy, Unified_workforce_optimization, Unity_connection, Video_surveillance_manager, Video_surveillance_operations_manager, Virtual_topology_system, Virtualized_infrastructure_manager, Virtualized_voice_browser, Wan_automation_engine, Webex_meetings_server, Workload_optimization_manager, Debian_linux, Fedora, Audio_development_kit, Computer_vision_annotation_tool, Data_center_manager, Genomics_kernel_library, Oneapi_sample_browser, Secure_device_onboard, Sensor_solution_firmware_development_kit, System_debugger, System_studio, Active_iq_unified_manager, Cloud_insights, Cloud_manager, Cloud_secure_agent, Oncommand_insight, Ontap_tools, Snapcenter, Rhythmyx, Captial, Comos, Desigo_cc_advanced_reports, Desigo_cc_info_center, E\-Car_operation_center, Energy_engage, Energyip, Energyip_prepay, Gma\-Manager, Head\-End_system_universal_device_integration_system, Industrial_edge_management, Industrial_edge_management_hub, Logo\!_soft_comfort, Mendix, Mindsphere, Navigator, Nx, Opcenter_intelligence, Operation_scheduler, Sentron_powermanager, Siguard_dsa, Sipass_integrated, Siveillance_command, Siveillance_control_pro, Siveillance_identity, Siveillance_vantage, Siveillance_viewpoint, Solid_edge_cam_pro, Solid_edge_harness_design, Spectrum_power_4, Spectrum_power_7, Sppa\-T3000_ses3000_firmware, Teamcenter, Vesys, Xpedition_enterprise, Xpedition_package_integrator, Snow_commander, Vm_access_proxy, Email_security
|
10.0
|
|
|
|
2020-04-30
|
CVE-2020-11652
|
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
|
Workspaces_server, Ubuntu_linux, Debian_linux, Leap, Salt, Application_remote_collector
|
6.5
|
|
|
|
2021-03-09
|
CVE-2021-21166
|
Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
|
Debian_linux, Fedora, Chrome
|
8.8
|
|
|
|
2021-11-19
|
CVE-2021-44026
|
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
|
Debian_linux, Fedora, Webmail
|
9.8
|
|
|
|
2021-12-15
|
CVE-2021-0920
|
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel
|
Debian_linux, Android
|
6.4
|
|
|
|
2021-01-26
|
CVE-2021-3156
|
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
|
Privilege_management_for_mac, Privilege_management_for_unix\/linux, Debian_linux, Fedora, Web_gateway, Active_iq_unified_manager, Cloud_backup, Hci_management_node, Oncommand_unified_manager_core_package, Ontap_select_deploy_administration_utility, Ontap_tools, Solidfire, Communications_performance_intelligence_center, Micros_compact_workstation_3_firmware, Micros_es400_firmware, Micros_kitchen_display_system_firmware, Micros_workstation_5a_firmware, Micros_workstation_6_firmware, Tekelec_platform_distribution, Sudo, Diskstation_manager, Diskstation_manager_unified_controller, Skynas_firmware, Vs960hd_firmware
|
7.8
|
|
|
|
2023-09-28
|
CVE-2023-5217
|
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
|
Ipad_os, Iphone_os, Debian_linux, Fedora, Chrome, Edge, Edge_chromium, Firefox, Thunderbird, Enterprise_linux, Libvpx
|
8.8
|
|
|
|
2024-03-06
|
CVE-2023-52583
|
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix deadlock or deadcode of misusing dget()
The lock order is incorrect between denty and its parent, we should
always make sure that the parent get the lock first.
But since this deadcode is never used and the parent dir will always
be set from the callers, let's just remove it.
|
Debian_linux, Linux_kernel
|
5.5
|
|
|
|
2024-04-01
|
CVE-2024-26654
|
In the Linux kernel, the following vulnerability has been resolved:
ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
The dreamcastcard->timer could schedule the spu_dma_work and the
spu_dma_work could also arm the dreamcastcard->timer.
When the snd_pcm_substream is closing, the aica_channel will be
deallocated. But it could still be dereferenced in the worker
thread. The reason is that del_timer() will return directly
regardless of whether the timer handler is running or not...
|
Debian_linux, Linux_kernel
|
7.0
|
|
|
|
2024-04-13
|
CVE-2024-26817
|
In the Linux kernel, the following vulnerability has been resolved:
amdkfd: use calloc instead of kzalloc to avoid integer overflow
This uses calloc instead of doing the multiplication which might
overflow.
|
Debian_linux, Linux_kernel
|
5.5
|
|
|