CVE-2021-36xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
644 records · Page 1 of 7
There is a Buffer overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability by sending malicious images and inducing users to open the images may cause remote code execution.
UpdatedThere is an Improper verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow attempts to read an array that is out of bounds.
UpdatedThere is a Low memory error in Huawei Smartphone due to the unlimited size of images to be parsed.Successful exploitation of this vulnerability may cause the Gallery or Files app to exit unexpectedly.
UpdatedThere is an Improper verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause transmission of certain virtual information.
UpdatedThere is an Unauthorized file access vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability by modifying soft links may tamper with the files restored from backups.
UpdatedThere is a issue that trustlist strings being repeatedly inserted into the linked list in Huawei Smartphone due to race conditions. Successful exploitation of this vulnerability can cause exceptions when managing the system trustlist.
UpdatedThere is a Memory leaks vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability.
UpdatedThere is a Public key verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality.
UpdatedThere is an Unauthorized file access vulnerability in Huawei Smartphone due to unstandardized path input.Successful exploitation of this vulnerability by creating malicious file paths can cause unauthorized file access.
UpdatedThere is a vulnerability of tampering with the kernel in Huawei Smartphone.Successful exploitation of this vulnerability may escalate permissions.
UpdatedThere is a Kernel crash vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may escalate permissions.
UpdatedThere is a Parameter verification issue in Huawei Smartphone.Successful exploitation of this vulnerability can affect service integrity.
UpdatedThere is a issue that nodes in the linked list being freed for multiple times in Huawei Smartphone due to race conditions. Successful exploitation of this vulnerability can cause the system to restart.
UpdatedThere is a vulnerability of tampering with the kernel in Huawei Smartphone.Successful exploitation of this vulnerability may escalate permissions.
UpdatedThere is a Code injection vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may exhaust system resources and cause the system to restart.
Updatedreplay-sorcery-kms in Replay Sorcery 0.6.0 allows a local attacker to gain root privileges via a symlink attack on /tmp/replay-sorcery or /tmp/replay-sorcery/device.sock.
UpdatedAIMANAGER before B115 on MONITORAPP Application Insight Web Application Firewall (AIWAF) devices with Manager 2.1.0 allows OS Command Injection because of missing input validation on one of the parameters of an HTTP request.
UpdatedIn the server in SerNet verinice before 1.22.2, insecure Java deserialization allows remote authenticated attackers to execute arbitrary code.
UpdatedOpen vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action.
UpdatedUnicorn Engine 1.0.2 has an out-of-bounds write in tb_flush_armeb (called from cpu_arm_exec_armeb and tcg_cpu_exec_armeb).
UpdatedQPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.
Updatedmatio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry), related to use of HDF5 1.12.0.
Updatedlibarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).
UpdatedWin32k Elevation of Privilege Vulnerability
UpdatedWindows SMB Elevation of Privilege Vulnerability
Updated- CVE-2021-36973: Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability 7.8 High
Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability
Updated Windows SMB Information Disclosure Vulnerability
UpdatedWindows Print Spooler Spoofing Vulnerability
UpdatedWindows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
UpdatedWindows DNS Elevation of Privilege Vulnerability
UpdatedWindows WLAN AutoConfig Service Elevation of Privilege Vulnerability
UpdatedWindows Subsystem for Linux Elevation of Privilege Vulnerability
UpdatedWindows WLAN AutoConfig Service Remote Code Execution Vulnerability
UpdatedWindows Event Tracing Elevation of Privilege Vulnerability
UpdatedWindows Common Log File System Driver Elevation of Privilege Vulnerability
UpdatedWindows Installer Information Disclosure Vulnerability
UpdatedWindows Installer Denial of Service Vulnerability
UpdatedWindows SMB Information Disclosure Vulnerability
UpdatedWindows Authenticode Spoofing Vulnerability
UpdatedA remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
UpdatedWindows Desktop Bridge Elevation of Privilege Vulnerability
UpdatedAzure Sphere Information Disclosure Vulnerability
UpdatedWindows Common Log File System Driver Elevation of Privilege Vulnerability
UpdatedWindows Bind Filter Driver Elevation of Privilege Vulnerability
UpdatedWindows TCP/IP Denial of Service Vulnerability
UpdatedVisual Studio Remote Code Execution Vulnerability
UpdatedMicrosoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Updated- CVE-2021-36949: Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability 7.1 High
Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability
Updated Windows Update Medic Service Elevation of Privilege Vulnerability
UpdatedWindows Print Spooler Remote Code Execution Vulnerability
UpdatedMicrosoft Dynamics Business Central Cross-site Scripting Vulnerability
UpdatedWindows 10 Update Assistant Elevation of Privilege Vulnerability
UpdatedAzure CycleCloud Elevation of Privilege Vulnerability
UpdatedWindows LSA Spoofing Vulnerability
UpdatedMicrosoft Word Remote Code Execution Vulnerability
UpdatedMicrosoft SharePoint Server Spoofing Vulnerability
Updated- CVE-2021-36938: Windows Cryptographic Primitives Library Information Disclosure Vulnerability 5.5 Medium
Windows Cryptographic Primitives Library Information Disclosure Vulnerability
Updated Windows Media MPEG-4 Video Decoder Remote Code Execution Vulnerability
UpdatedWindows Print Spooler Remote Code Execution Vulnerability
UpdatedAn elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full use
Updated- CVE-2021-36933: Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability 7.5 High
Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability
Updated - CVE-2021-36932: Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability 7.5 High
Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability
Updated Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Elevation of Privilege Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Information Disclosure Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Elevation of Privilege Vulnerability
UpdatedWindows Digital TV Tuner device registration application Elevation of Privilege Vulnerability
Updated- CVE-2021-36926: Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability 7.5 High
Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability
Updated RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve an arbitrary read or write operation from/to physical memory (leading to Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device.
UpdatedRtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve a pool overflow (leading to Escalation of Privileges, Denial of Service, and Code Execution) via a crafted Device IO Control packet to a device.
UpdatedRtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB device privileged IN and OUT instructions (leading to Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device.
UpdatedRtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB devices (Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device.
UpdatedAIMANAGER before B115 on MONITORAPP Application Insight Web Application Firewall (AIWAF) devices with Manager 2.1.0 has Improper Authentication. An attacker can gain administrative access by modifying the response to an authentication check request.
UpdatedAuthenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6).
UpdatedMultiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id, &assignee).
UpdatedWordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin.
UpdatedThe SQL injection vulnerability in the Hide My WP WordPress plugin (versions <= 6.2.3) is possible because of how the IP address is retrieved and used inside a SQL query. The function "hmwp_get_user_ip" tries to retrieve the IP address from multiple headers, including IP address headers that the user can spoof, such as "X-Forwarded-For." As a result, the malicious payload supplied in one of these
UpdatedCross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder plugin <= 3.6.0 at WordPress allows uploading the JSON file and updating the options. Requires Import and Export add-on.
UpdatedCross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS) in CalderaWP License Manager (WordPress plugin) <= 1.2.11.
UpdatedUnauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at WordPress allows attackers to change options and inject scripts into the footer HTML. Requires an additional extension (plugin) AccessiBe.
UpdatedStored Cross-Site Scripting (XSS) vulnerability in Andrea Pernici News Sitemap for Google plugin <= 1.0.16 on WordPress, attackers must have contributor or higher user role.
UpdatedStored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or higher role.
UpdatedAuthenticated (admin user role) Stored Cross-Site Scripting (XSS) in WP-Appbox (WordPress plugin) <= 4.3.20.
UpdatedAuthenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe the entire database regardless of their authorization. It leads to a complete website reset and takeover.
UpdatedCross-Site Request Forgery (CSRF) vulnerability in WebFactory Ltd. WP Reset PRO plugin <= 5.98 versions.
UpdatedMultiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin <= 7.3.6 on WordPress.
UpdatedMultiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin <= 7.3.4 on WordPress.
UpdatedUnauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Phil Baker's Age Gate plugin <= 2.17.0 at WordPress.
UpdatedAuthenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Gabe Livan's Asset CleanUp: Page Speed Booster plugin <= 1.3.8.4 at WordPress.
UpdatedAuth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin <= 7.3.4 on WordPress.
UpdatedAuthenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Pricing Table (WordPress plugin) versions <= 1.5.2
UpdatedUnauthenticated Cross-Site Scripting (XSS) vulnerability in Tripetto's Tripetto plugin <= 5.1.4 on WordPress via SVG image upload.
Updated- CVE-2021-36893: WordPress Responsive Tabs plugin <= 4.0.5 - Cross-Site Scripting (XSS) vulnerability 4.8 Medium
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Responsive Tabs (WordPress plugin) <= 4.0.5
Updated Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery by Supsystic plugin <= 1.15.5 at WordPress allows changing the plugin settings.
UpdatedCross-Site Request Forgery (CSRF) vulnerability in Social Share Buttons by Supsystic plugin <= 2.2.2 at WordPress.
UpdatedMultiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.6).
UpdatedUnauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.
UpdatedCross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.5.4), vulnerable parameters "tarteaucitronEmail" and "tarteaucitronPass".
UpdatedCross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).
UpdatedUnauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).
Updated