2021

Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and

In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. This could lead

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to loca

We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is

Windows Common Log File System Driver Elevation of Privilege Vulnerability

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configu

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions start

Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in con

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execut

A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p9

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except

All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserial

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014

Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially explo

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the c

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Excel Security Feature Bypass Vulnerability

Active Directory Domain Services Elevation of Privilege Vulnerability

Active Directory Domain Services Elevation of Privilege Vulnerability

Windows Installer Elevation of Privilege Vulnerability

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS

Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI,

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the W

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the D

Win32k Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potent

Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corrup

Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the rende

Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised th

Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap c

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path

Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1

Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path trave

Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to

An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name

Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacke

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A mali

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with netw

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,