Vulnerabilidades exploradas (CISA KEV)

CVE-2021-30533 Média · 6.5 KEV Alta · 53 CWE-863 07/06/2021

Google Chromium PopupBlocker Security Bypass Vulnerability

Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe.

CVE-2021-27852 Crítica · 9.8 KEV Alta · 63 CWE-502 27/05/2021

Checkbox Survey Deserialization of Untrusted Data Vulnerability

Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.

CVE-2021-22899 Alta · 8.8 KEV Alta · 56 CWE-77 27/05/2021

Ivanti Pulse Connect Secure Command Injection Vulnerability

A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature

CVE-2021-22894 Alta · 8.8 KEV Alta · 56 CWE-119 27/05/2021

Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability

A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.

CVE-2021-22900 Alta · 7.2 KEV Alta · 55 CWE-669 27/05/2021

Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability

A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.

CVE-2021-21985 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-918 26/05/2021

VMware vCenter Server Improper Input Validation Vulnerability

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

CVE-2021-27562 Média · 5.5 KEV Alta · 51 CWE-787 25/05/2021

Arm Trusted Firmware Out-of-Bounds Write Vulnerability

In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode.

CVE-2021-29256 Alta · 8.8 KEV Alta · 54 CWE-416 24/05/2021

Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0.

CVE-2021-28799 Crítica · 9.8 KEV Urgente · 77 Exploit público Ransomware CWE-285 13/05/2021

QNAP NAS Improper Authorization Vulnerability

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

CVE-2021-31207 Média · 6.6 KEV Urgente · 85 Exploit público Ransomware CWE-434 11/05/2021

Microsoft Exchange Server Security Feature Bypass Vulnerability

CVE-2021-31166 Crítica · 9.8 KEV Urgente · 81 Exploit público CWE-416 11/05/2021

Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability

HTTP Protocol Stack Remote Code Execution Vulnerability

CVE-2021-28663 Alta · 8.8 KEV Alta · 61 Exploit público CWE-416 10/05/2021

Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability

The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0.

CVE-2021-28664 Alta · 8.8 KEV Alta · 61 Exploit público CWE-787 10/05/2021

Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability

The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve read/write access to read-only pages. This affects Bifrost r0p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r8p0 through r30p0 before r31p0.

CVE-2021-31755 Crítica · 9.8 KEV Alta · 67 Exploit público CWE-787 07/05/2021

Tenda AC11 Router Stack Buffer Overflow Vulnerability

An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.

CVE-2021-1905 Alta · 7.8 KEV Alta · 58 Exploit público CWE-416 07/05/2021

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CVE-2021-1906 Média · 5.5 KEV Alta · 45 07/05/2021

Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability

Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CVE-2021-32030 Crítica · 9.8 KEV Alta · 67 Exploit público CWE-287 06/05/2021

ASUS Routers Improper Authentication Vulnerability

The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.

CVE-2021-1498 Crítica · 9.8 KEV Urgente · 79 Exploit público CWE-77 06/05/2021

Cisco HyperFlex HX Data Platform Command Injection Vulnerability

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

CVE-2021-1497 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-78 06/05/2021

Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

CVE-2021-21551 Alta · 7.8 KEV Urgente · 76 Exploit público CWE-782 04/05/2021

Dell dbutil Driver Insufficient Access Control Vulnerability

Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.

CVE-2021-20090 Crítica · 9.8 KEV Alta · 67 Exploit público CWE-22 29/04/2021

Arcadyan Buffalo Firmware Path Traversal Vulnerability

A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.

CVE-2021-21220 Alta · 8.8 KEV Urgente · 74 Exploit público CWE-787 26/04/2021

Google Chromium V8 Improper Input Validation Vulnerability

Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2021-21224 Alta · 8.8 KEV Alta · 56 CWE-843 26/04/2021

Google Chromium V8 Type Confusion Vulnerability

Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

CVE-2021-21206 Alta · 8.8 KEV Alta · 55 CWE-416 26/04/2021

Google Chromium Blink Use-After-Free Vulnerability

Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2021-22205 Crítica · 10.0 KEV Urgente · 93 Exploit público Ransomware CWE-94 23/04/2021

GitLab Community and Enterprise Editions Remote Code Execution Vulnerability

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.