| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-33754 | Hig | 0.52 | 8.0 | 0.02 | Jul 14, 2021 | Windows DNS Server Remote Code Execution Vulnerability | ||
| CVE-2021-33753 | Med | 0.31 | 4.7 | 0.02 | Jul 14, 2021 | Microsoft Bing Search Spoofing Vulnerability | ||
| CVE-2021-33752 | Hig | 0.57 | 8.8 | 0.02 | Jul 14, 2021 | Windows DNS Snap-in Remote Code Execution Vulnerability | ||
| CVE-2021-33751 | Hig | 0.46 | 7.0 | 0.01 | Jul 14, 2021 | Windows Storage Spaces Controller Elevation of Privilege Vulnerability | ||
| CVE-2021-33750 | Hig | 0.57 | 8.8 | 0.02 | Jul 14, 2021 | Windows DNS Snap-in Remote Code Execution Vulnerability | ||
| CVE-2021-33749 | Hig | 0.57 | 8.8 | 0.02 | Jul 14, 2021 | Windows DNS Snap-in Remote Code Execution Vulnerability | ||
| CVE-2021-33746 | Hig | 0.52 | 8.0 | 0.02 | Jul 14, 2021 | Windows DNS Server Remote Code Execution Vulnerability | ||
| CVE-2021-33745 | Med | 0.42 | 6.5 | 0.03 | Jul 14, 2021 | Windows DNS Server Denial of Service Vulnerability | ||
| CVE-2021-33744 | Med | 0.35 | 5.3 | 0.01 | Jul 14, 2021 | Windows Secure Kernel Mode Security Feature Bypass Vulnerability | ||
| CVE-2021-33743 | Hig | 0.51 | 7.8 | 0.01 | Jul 14, 2021 | Windows Projected File System Elevation of Privilege Vulnerability | ||
| CVE-2021-33740 | Hig | 0.51 | 7.8 | 0.03 | Jul 14, 2021 | Windows Media Remote Code Execution Vulnerability | ||
| CVE-2021-31984 | Hig | 0.50 | 7.6 | 0.02 | Jul 14, 2021 | Power BI Remote Code Execution Vulnerability | ||
| CVE-2021-31979 | Hig | 0.63 | 7.8 | 0.05 | KEV | Jul 14, 2021 | Windows Kernel Elevation of Privilege Vulnerability | |
| CVE-2021-31961 | Med | 0.40 | 6.1 | 0.01 | Jul 14, 2021 | Windows InstallService Elevation of Privilege Vulnerability | ||
| CVE-2021-31947 | Hig | 0.51 | 7.8 | 0.03 | Jul 14, 2021 | HEVC Video Extensions Remote Code Execution Vulnerability | ||
| CVE-2021-31206 | Hig | 0.50 | 7.6 | 0.13 | Jul 14, 2021 | Microsoft Exchange Server Remote Code Execution Vulnerability | ||
| CVE-2021-31196 | Hig | 0.63 | 7.2 | 0.54 | KEV | Jul 14, 2021 | Microsoft Exchange Server Remote Code Execution Vulnerability | |
| CVE-2021-31183 | Hig | 0.49 | 7.5 | 0.04 | Jul 14, 2021 | Windows TCP/IP Driver Denial of Service Vulnerability | ||
| CVE-2020-18145 | Med | 0.40 | 6.1 | 0.01 | Jul 14, 2021 | Cross Site Scripting (XSS) vulnerability in umeditor v1.2.3 via /public/common/umeditor/php/getcontent.php. | ||
| CVE-2021-36740 | Med | 0.42 | 6.5 | 0.02 | Jul 14, 2021 | Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS… | ||
| CVE-2021-31859 | Hig | 0.51 | 7.8 | 0.00 | Jul 14, 2021 | Incorrect privileges in the MU55 FlexiSpooler service in YSoft SafeQ 6 6.0.55 allows local user privilege escalation by overwriting the executable file via an alternative data stream. | ||
| CVE-2021-23407 | Hig | 0.42 | 7.5 | 0.02 | Jul 14, 2021 | This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is used to create a file system path. | ||
| CVE-2020-29147 | Hig | 0.49 | 7.5 | 0.01 | Jul 14, 2021 | A SQL injection vulnerability in wy_controlls/wy_side_visitor.php of Wayang-CMS v1.0 allows attackers to obtain sensitive database information. | ||
| CVE-2020-29146 | Med | 0.40 | 6.1 | 0.01 | Jul 14, 2021 | A cross site scripting (XSS) vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header. | ||
| CVE-2020-18144 | Cri | 0.64 | 9.8 | 0.01 | Jul 14, 2021 | SQL Injection Vulnerability in ECTouch v2 via the integral_min parameter in index.php. | ||
| CVE-2021-36716 | Hig | 0.49 | 7.5 | 0.01 | Jul 14, 2021 | A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmail(input) function may cause an application to consume an excessive amount of CPU. | ||
| CVE-2021-22782 | Med | 0.36 | 5.5 | 0.00 | Jul 14, 2021 | Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack… | ||
| CVE-2021-22781 | Med | 0.36 | 5.5 | 0.00 | Jul 14, 2021 | Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack… | ||
| CVE-2021-22780 | Hig | 0.46 | 7.1 | 0.00 | Jul 14, 2021 | Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack… | ||
| CVE-2021-22779 | Cri | 0.59 | 9.1 | 0.01 | Jul 14, 2021 | Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure… | ||
| CVE-2021-22778 | Hig | 0.46 | 7.1 | 0.00 | Jul 14, 2021 | Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack… | ||
| CVE-2020-27379 | Med | 0.42 | 6.5 | 0.00 | Jul 14, 2021 | Cross Site Request Forgery (CSRF) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . The CSRF token is not being validated when the request is sent as a GET method. This results in an unauthorized change in the user's email ID, which can later be used… | ||
| CVE-2020-25445 | Hig | 0.51 | 7.8 | 0.01 | Jul 14, 2021 | The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells… | ||
| CVE-2020-25444 | Med | 0.35 | 5.4 | 0.01 | Jul 14, 2021 | Cross Site Scripting (XSS) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 via the (1) "About Yourself” section under the “My Profile” page, " (2) “Hotel Policy” field under the “Hotel Details” page, (3) “Pricing code” and “name”… | ||
| CVE-2021-35527 | Hig | 0.49 | 7.5 | 0.01 | Jul 14, 2021 | Password autocomplete vulnerability in the web application password field of Hitachi ABB Power Grids eSOMS allows attacker to gain access to user credentials that are stored by the browser. This issue affects: Hitachi ABB Power Grids eSOMS version 6.3 and prior versions. | ||
| CVE-2021-33213 | Med | 0.42 | 6.5 | 0.01 | Jul 14, 2021 | An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address. | ||
| CVE-2021-33212 | Med | 0.35 | 5.4 | 0.01 | Jul 14, 2021 | A Cross-site scripting (XSS) vulnerability in the "View in Browser" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SVG image. | ||
| CVE-2021-33211 | Med | 0.42 | 6.5 | 0.02 | Jul 14, 2021 | A Directory Traversal vulnerability in the Unzip feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to write files to arbitrary directories via relative paths in ZIP archives. | ||
| CVE-2021-24117 | Med | 0.32 | 4.9 | 0.02 | Jul 14, 2021 | In Apache Teaclave Rust SGX SDK 1.1.3, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments… | ||
| CVE-2021-0654 | Med | 0.36 | 5.5 | 0.00 | Jul 14, 2021 | In isRealSnapshot of TaskThumbnailView.java, there is possible data exposure due to a missing permission check. This could lead to local information disclosure from locked profiles with no additional execution privileges needed. User interaction is needed for… | ||
| CVE-2021-0604 | Med | 0.36 | 5.5 | 0.00 | Jul 14, 2021 | In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible way to share private files over Bluetooth due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for… | ||
| CVE-2021-0603 | Hig | 0.51 | 7.8 | 0.00 | Jul 14, 2021 | In onCreate of ContactSelectionActivity.java, there is a possible way to get access to contacts without permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for… | ||
| CVE-2021-0602 | Hig | 0.51 | 7.8 | 0.00 | Jul 14, 2021 | In onCreateOptionsMenu of WifiNetworkDetailsFragment.java, there is a possible way for guest users to view and modify Wi-Fi settings for all configured APs due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges… | ||
| CVE-2021-0601 | Med | 0.36 | 5.5 | 0.00 | Jul 14, 2021 | In encodeFrames of avc_enc_fuzzer.cpp, there is a possible out of bounds write due to a double free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:… | ||
| CVE-2021-0600 | Hig | 0.51 | 7.8 | 0.00 | Jul 14, 2021 | In onCreate of DeviceAdminAdd.java, there is a possible way to mislead a user to activate a device admin app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for… | ||
| CVE-2021-0599 | Med | 0.36 | 5.5 | 0.00 | Jul 14, 2021 | In scheduleTimeoutLocked of NotificationRecord.java, there is a possible disclosure of a sensitive identifier via broadcasted intent due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not… | ||
| CVE-2021-0597 | Med | 0.36 | 5.5 | 0.00 | Jul 14, 2021 | In notifyProfileAdded and notifyProfileRemoved of SipService.java, there is a possible way to retrieve SIP account names due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not… | ||
| CVE-2021-0596 | Hig | 0.49 | 7.5 | 0.01 | Jul 14, 2021 | In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over NFC with no additional execution privileges needed. User interaction is not needed for… | ||
| CVE-2021-0594 | Hig | 0.52 | 8.0 | 0.01 | Jul 14, 2021 | In onCreate of ConfirmConnectActivity, there is a possible remote bypass of user consent due to improper input validation. This could lead to remote (proximal, NFC) escalation of privilege allowing an attacker to deceive a user into allowing a Bluetooth connection with no… | ||
| CVE-2021-0592 | Hig | 0.57 | 8.8 | 0.01 | Jul 14, 2021 | In various functions in WideVine, there are possible out of bounds writes due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android… |
- risk 0.52cvss 8.0epss 0.02
Windows DNS Server Remote Code Execution Vulnerability
- risk 0.31cvss 4.7epss 0.02
Microsoft Bing Search Spoofing Vulnerability
- risk 0.57cvss 8.8epss 0.02
Windows DNS Snap-in Remote Code Execution Vulnerability
- risk 0.46cvss 7.0epss 0.01
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
- risk 0.57cvss 8.8epss 0.02
Windows DNS Snap-in Remote Code Execution Vulnerability
- risk 0.57cvss 8.8epss 0.02
Windows DNS Snap-in Remote Code Execution Vulnerability
- risk 0.52cvss 8.0epss 0.02
Windows DNS Server Remote Code Execution Vulnerability
- risk 0.42cvss 6.5epss 0.03
Windows DNS Server Denial of Service Vulnerability
- risk 0.35cvss 5.3epss 0.01
Windows Secure Kernel Mode Security Feature Bypass Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows Projected File System Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.03
Windows Media Remote Code Execution Vulnerability
- risk 0.50cvss 7.6epss 0.02
Power BI Remote Code Execution Vulnerability
- risk 0.63cvss 7.8epss 0.05
Windows Kernel Elevation of Privilege Vulnerability
- risk 0.40cvss 6.1epss 0.01
Windows InstallService Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.03
HEVC Video Extensions Remote Code Execution Vulnerability
- risk 0.50cvss 7.6epss 0.13
Microsoft Exchange Server Remote Code Execution Vulnerability
- risk 0.63cvss 7.2epss 0.54
Microsoft Exchange Server Remote Code Execution Vulnerability
- risk 0.49cvss 7.5epss 0.04
Windows TCP/IP Driver Denial of Service Vulnerability
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability in umeditor v1.2.3 via /public/common/umeditor/php/getcontent.php.
- risk 0.42cvss 6.5epss 0.02
Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS…
- risk 0.51cvss 7.8epss 0.00
Incorrect privileges in the MU55 FlexiSpooler service in YSoft SafeQ 6 6.0.55 allows local user privilege escalation by overwriting the executable file via an alternative data stream.
- risk 0.42cvss 7.5epss 0.02
This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is used to create a file system path.
- risk 0.49cvss 7.5epss 0.01
A SQL injection vulnerability in wy_controlls/wy_side_visitor.php of Wayang-CMS v1.0 allows attackers to obtain sensitive database information.
- risk 0.40cvss 6.1epss 0.01
A cross site scripting (XSS) vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header.
- risk 0.64cvss 9.8epss 0.01
SQL Injection Vulnerability in ECTouch v2 via the integral_min parameter in index.php.
- risk 0.49cvss 7.5epss 0.01
A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmail(input) function may cause an application to consume an excessive amount of CPU.
- risk 0.36cvss 5.5epss 0.00
Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack…
- risk 0.36cvss 5.5epss 0.00
Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack…
- risk 0.46cvss 7.1epss 0.00
Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack…
- risk 0.59cvss 9.1epss 0.01
Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure…
- risk 0.46cvss 7.1epss 0.00
Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack…
- risk 0.42cvss 6.5epss 0.00
Cross Site Request Forgery (CSRF) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . The CSRF token is not being validated when the request is sent as a GET method. This results in an unauthorized change in the user's email ID, which can later be used…
- risk 0.51cvss 7.8epss 0.01
The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells…
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 via the (1) "About Yourself” section under the “My Profile” page, " (2) “Hotel Policy” field under the “Hotel Details” page, (3) “Pricing code” and “name”…
- risk 0.49cvss 7.5epss 0.01
Password autocomplete vulnerability in the web application password field of Hitachi ABB Power Grids eSOMS allows attacker to gain access to user credentials that are stored by the browser. This issue affects: Hitachi ABB Power Grids eSOMS version 6.3 and prior versions.
- risk 0.42cvss 6.5epss 0.01
An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address.
- risk 0.35cvss 5.4epss 0.01
A Cross-site scripting (XSS) vulnerability in the "View in Browser" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SVG image.
- risk 0.42cvss 6.5epss 0.02
A Directory Traversal vulnerability in the Unzip feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to write files to arbitrary directories via relative paths in ZIP archives.
- risk 0.32cvss 4.9epss 0.02
In Apache Teaclave Rust SGX SDK 1.1.3, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments…
- risk 0.36cvss 5.5epss 0.00
In isRealSnapshot of TaskThumbnailView.java, there is possible data exposure due to a missing permission check. This could lead to local information disclosure from locked profiles with no additional execution privileges needed. User interaction is needed for…
- risk 0.36cvss 5.5epss 0.00
In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible way to share private files over Bluetooth due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for…
- risk 0.51cvss 7.8epss 0.00
In onCreate of ContactSelectionActivity.java, there is a possible way to get access to contacts without permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for…
- risk 0.51cvss 7.8epss 0.00
In onCreateOptionsMenu of WifiNetworkDetailsFragment.java, there is a possible way for guest users to view and modify Wi-Fi settings for all configured APs due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges…
- risk 0.36cvss 5.5epss 0.00
In encodeFrames of avc_enc_fuzzer.cpp, there is a possible out of bounds write due to a double free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:…
- risk 0.51cvss 7.8epss 0.00
In onCreate of DeviceAdminAdd.java, there is a possible way to mislead a user to activate a device admin app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for…
- risk 0.36cvss 5.5epss 0.00
In scheduleTimeoutLocked of NotificationRecord.java, there is a possible disclosure of a sensitive identifier via broadcasted intent due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not…
- risk 0.36cvss 5.5epss 0.00
In notifyProfileAdded and notifyProfileRemoved of SipService.java, there is a possible way to retrieve SIP account names due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not…
- risk 0.49cvss 7.5epss 0.01
In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over NFC with no additional execution privileges needed. User interaction is not needed for…
- risk 0.52cvss 8.0epss 0.01
In onCreate of ConfirmConnectActivity, there is a possible remote bypass of user consent due to improper input validation. This could lead to remote (proximal, NFC) escalation of privilege allowing an attacker to deceive a user into allowing a Bluetooth connection with no…
- risk 0.57cvss 8.8epss 0.01
In various functions in WideVine, there are possible out of bounds writes due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android…