An issue was discovered in the Linux kernel before 5.14.8. A use-after-free in selinux_ptrace_traceme (aka the SELinux handler for PTRACE_TRACEME) could be used by local attackers to cause memory corruption and escalate privileges, aka CID-a3727a8bac0a. This occurs because of an attempt to access the subjective credentials of another task.
Max CVSS
7.8
EPSS Score
0.04%
Published
2021-10-28
Updated
2023-03-01
An issue was discovered in the Linux kernel for powerpc before 5.14.15. It allows a malicious KVM guest to crash the host, when the host is running on Power8, due to an arch/powerpc/kvm/book3s_hv_rmhandlers.S implementation bug in the handling of the SRR1 register values.
Max CVSS
5.5
EPSS Score
0.05%
Published
2021-10-28
Updated
2021-11-28

CVE-2021-42840

Public exploit
SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled PHP file under the web root, because only the all-lowercase PHP file extensions were blocked. NOTE: this issue exists because of an incomplete fix for CVE-2020-28328.
Max CVSS
9.0
EPSS Score
7.33%
Published
2021-10-22
Updated
2021-11-30
GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.
Max CVSS
7.5
EPSS Score
0.24%
Published
2021-10-22
Updated
2022-05-03
Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
Max CVSS
7.8
EPSS Score
0.09%
Published
2021-10-20
Updated
2021-12-14
The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service (long-range consensus chain reorganizations), even when this adversary has little stake and cannot influence network message propagation. This can cause a protocol stall, or an increase in the profits of individual validators.
Max CVSS
9.1
EPSS Score
0.09%
Published
2021-10-20
Updated
2021-10-26
The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to leverage network delay to cause a denial of service (indefinite stalling of consensus decisions).
Max CVSS
7.5
EPSS Score
0.09%
Published
2021-10-20
Updated
2021-10-26
The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service (delayed consensus decisions), and also increase the profits of individual validators, via short-range reorganizations of the underlying consensus chain.
Max CVSS
9.1
EPSS Score
0.09%
Published
2021-10-20
Updated
2021-10-26
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
Max CVSS
5.3
EPSS Score
0.05%
Published
2021-10-20
Updated
2021-11-26
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
Max CVSS
9.8
EPSS Score
0.16%
Published
2021-10-21
Updated
2021-10-28
The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandles bounds checking.
Max CVSS
6.7
EPSS Score
0.04%
Published
2021-10-20
Updated
2024-03-24
An issue was discovered in stb stb_image.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when converting to RGBA, leading to a buffer overflow when later reinterpreting the result as a 16-bit buffer. An attacker could potentially have crashed a service using stb_image, or read up to 1024 bytes of non-consecutive heap data without control over the read location.
Max CVSS
7.1
EPSS Score
0.18%
Published
2021-10-21
Updated
2022-05-13
An issue was discovered in stb stb_image.h 1.33 through 2.27. The HDR loader parsed truncated end-of-file RLE scanlines as an infinite sequence of zero-length runs. An attacker could potentially have caused denial of service in applications using stb_image by submitting crafted HDR files.
Max CVSS
5.5
EPSS Score
0.11%
Published
2021-10-21
Updated
2023-02-22
Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates.
Max CVSS
6.1
EPSS Score
0.06%
Published
2021-10-18
Updated
2021-10-21
The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
Max CVSS
9.8
EPSS Score
0.28%
Published
2021-10-18
Updated
2021-10-26
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
Max CVSS
9.8
EPSS Score
0.58%
Published
2021-10-18
Updated
2023-02-24
myfactory.FMS before 7.1-912 allows XSS via the Error parameter.
Max CVSS
6.1
EPSS Score
0.10%
Published
2021-10-18
Updated
2021-10-21
myfactory.FMS before 7.1-912 allows XSS via the UID parameter.
Max CVSS
6.1
EPSS Score
0.10%
Published
2021-10-18
Updated
2021-10-21
Rasa X before 0.42.4 allows Directory Traversal during archive extraction. In the functionality that allows a user to load a trained model archive, an attacker has arbitrary write capability within specific directories via a crafted archive file.
Max CVSS
5.5
EPSS Score
0.06%
Published
2021-10-22
Updated
2021-10-28
The affected product is vulnerable to directory traversal due to mishandling of provided backup folder structure.
Max CVSS
8.8
EPSS Score
0.10%
Published
2021-10-22
Updated
2021-10-27
The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can leverage this logic to overwrite the settings and other key functionality.
Max CVSS
8.8
EPSS Score
0.06%
Published
2021-10-22
Updated
2021-10-28
The affected product is vulnerable to a missing permission validation on system backup restore, which could lead to account take over and unapproved settings change.
Max CVSS
8.8
EPSS Score
0.10%
Published
2021-10-22
Updated
2021-10-27
The affected product is vulnerable to a parameter injection via passphrase, which enables the attacker to supply uncontrolled input.
Max CVSS
8.8
EPSS Score
0.11%
Published
2021-10-22
Updated
2022-07-25
The affected product is vulnerable to a disclosure of peer username and password by allowing all users access to read global variables.
Max CVSS
8.0
EPSS Score
0.07%
Published
2021-10-22
Updated
2021-10-27
The affected product’s web application does not properly neutralize the input during webpage generation, which could allow an attacker to inject code in the input forms.
Max CVSS
6.3
EPSS Score
0.09%
Published
2021-10-22
Updated
2021-10-27
1702 vulnerabilities found
1 2 3 4 5 6 ...... 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!