CVE Vulnerability Catalog

An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace.

An information leakage vulnerability exists in Micro Focus Access Manager due to advanced configuration. It affects all versions prior to 5.0.

A use-after-free vulnerability exists in Blink in Google Chrome prior to 89.0.4389.90. A remote attacker could potentially exploit heap corruption via a crafted HTML page.

Internet Explorer Remote Code Execution Vulnerability. Details are not provided in the description, but it allows remote code execution.

Microsoft Office Remote Code Execution Vulnerability. Details are not provided in the description, but it allows remote code execution.

A memory corruption vulnerability in Internet Explorer that could allow remote code execution.

A data race vulnerability exists in audio in Google Chrome prior to 89.0.4389.72. A remote attacker could potentially exploit heap corruption via a crafted HTML page.

Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.

Rockwell Automation Studio 5000 Logix Designer w wersjach 21 i nowszych oraz RSLogix 5000 w wersjach od 16 do 20 są podatne na atak, który pozwala nieautoryzowanemu użytkownikowi obejść mechanizm weryfikacji komunikacji z kontrolerami Logix. Atakujący może uwierzytelnić się z użyciem urządzeń CompactLogix i ControlLogix.

A remote code execution vulnerability in Microsoft Exchange Server allows an attacker to execute arbitrary code in the context of the system on the Exchange server.

A remote code execution vulnerability in Microsoft Exchange Server allows an attacker to execute arbitrary code on the server.

A remote code execution vulnerability in Microsoft Exchange Server allows an attacker to execute arbitrary code on the server.

Microsoft Exchange Server contains a remote code execution vulnerability. This vulnerability can be exploited by an attacker to execute arbitrary code on the server.

A vulnerability exists in the SHA authentication scheme in Veritas Backup Exec before 21.2. An attacker can gain unauthorized access and execute arbitrary commands with system privileges.

A vulnerability exists in the SHA authentication scheme in Veritas Backup Exec before 21.2, which had not been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.

A vulnerability exists in the SHA authentication scheme in Veritas Backup Exec before 21.2. An attacker can gain unauthorized access and, using crafted input parameters, access an arbitrary file on the system with System privileges.

A vulnerability in the Win32k component of Windows allows elevation of privilege. An attacker could exploit it to gain higher privileges on the system.

The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure.

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.