Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,721 results · page 30 of 55
Nov 23, 2021Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2021-43221 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.2
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 23, 2021Microsoft Edge for iOS Spoofing VulnerabilityCVE-2021-43220 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 3.1
Microsoft Edge for iOS Spoofing Vulnerability
- Product
- Microsoft Edge for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 23, 2021Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2021-42308 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 3.1
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 18, 2021Functions SDK for EdgeX is meant to provide all the plumbing necessary for developers to get started in processing/transforming/exporting data out of the EdgeX CVE-2021-41278 · Other software · edgexfoundry · reported by GitHubMedium 5.7
Functions SDK for EdgeX is meant to provide all the plumbing necessary for developers to get started in processing/transforming/exporting data out of the EdgeX IoT platform. In affected versions broken encryption in app-functions-sdk “AES” transform in EdgeX Foundry releases prior to Jakarta allows attackers to decrypt messages via unspecified vectors. The app-functions-sdk exports an “aes” transform that user scripts can optionally call to encrypt data in the processing pipeline. No decrypt function is provided. Encryption is not enabled by default, but if used, the level of protection may be less than the user may expects due to a broken implementation. Version v2.1.0 (EdgeX Foundry Jakarta release and later) of app-functions-sdk-go/v2 deprecates the “aes” transform and provides an improved “aes256” transform in its place. The broken implementation will remain in a deprecated state until it is removed in the next EdgeX major release to avoid breakage of existing software that depends on the broken implementation. As the broken transform is a library function that is not invoked by default, users who do not use the AES transform in their processing pipelines are unaffected. Those
- Product
- app-functions-sdk-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2021A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0.CVE-2021-43669 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This bug can be leveraged by constructing a message whose header is invalid to the interface Order. This bug has been admitted and fixed by the developers of Fabric.
- Product
- Fabric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjira.hyperledger.org
Nov 18, 2021A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0.CVE-2021-43667 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the developers of Fabric. If leveraged, any leader node will crash.
- Product
- Fabric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjira.hyperledger.org
Nov 9, 2021Microsoft Edge (Chrome based) Spoofing on IE ModeCVE-2021-41351 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chrome based) Spoofing on IE Mode
- Product
- Microsoft Edge (Chromium-based) in IE Mode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Oct 15, 2021IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to priviledge escalation where a lower evel user could have access to the 'New Job' page to which they shouCVE-2021-29745 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to priviledge escalation where a lower evel user could have access to the 'New Job' page to which they should not have access to. IBM X-Force ID: 201695.
- Product
- Cognos Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comsecurity.netapp.com
Oct 14, 2021LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy.CVE-2021-3882 · Other software · ledgersmb · reported by security@huntr.devMedium 6.8
LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user to use an unencrypted connection (HTTP), an attacker may be able to obtain the authentication data by capturing network traffic. LedgerSMB 1.8 and newer switched from Basic authentication to using cookie authentication with encrypted cookies. Although an attacker can't access the information inside the cookie, nor the password of the user, possession of the cookie is enough to access the application as the user from which the cookie has been obtained. In order for the attacker to obtain the cookie, first of all the server must be configured to respond to unencrypted requests, the attacker must be suitably positioned to eavesdrop on the network traffic between the client and the server *and* the user must be tricked into using unencrypted HTTP traffic. Proper audit control and separation of duties limit Integrity impact of the attack vector. Users of LedgerSMB 1.8 are urged to upgrade to known-fixed versions. Users of LedgerSMB 1.7 or 1.9 are unaffected by this vulnerability and don't need to take action.
- Product
- ledgersmb/ledgersmb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2021A SQL injection vulnerability exists in Sureline SUREedge Migrator 7.0.7.29360.CVE-2021-38303 · Other software · Surelinesystems · reported by MITRECritical 9.8
A SQL injection vulnerability exists in Sureline SUREedge Migrator 7.0.7.29360.
- Product
- Sureedge Migrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2021A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8).CVE-2021-41540 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains a use-after-free vulnerability while parsing OBJ files. An attacker could leverage this vulnerability to execute code in the context of the current process (ZDI-CAN-13776).
- Product
- Solid Edge SE2021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comzerodayinitiative.com
Sep 28, 2021A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8).CVE-2021-41539 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains a use-after-free vulnerability while parsing OBJ files. An attacker could leverage this vulnerability to execute code in the context of the current process (ZDI-CAN-13773).
- Product
- Solid Edge SE2021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comzerodayinitiative.com
Sep 28, 2021A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700), NX 1980 Series (All versions < V1988), Solid Edge SE2021 (All versions < SE20CVE-2021-41538 · Other software · Siemens · reported by productcert@siemens.comLow 3.3
A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700), NX 1980 Series (All versions < V1988), Solid Edge SE2021 (All versions < SE2021MP8). The affected application is vulnerable to information disclosure by unexpected access to an uninitialized pointer while parsing user-supplied OBJ files. An attacker could leverage this vulnerability to leak information from unexpected memory locations (ZDI-CAN-13770).
- Product
- NX 1953 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Sep 28, 2021A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8).CVE-2021-41537 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains a use-after-free vulnerability while parsing OBJ files. An attacker could leverage this vulnerability to execute code in the context of the current process (ZDI-CAN-13789).
- Product
- Solid Edge SE2021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comzerodayinitiative.com
Sep 28, 2021A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8).CVE-2021-41536 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains a use-after-free vulnerability while parsing OBJ files. An attacker could leverage this vulnerability to execute code in the context of the current process (ZDI-CAN-13778).
- Product
- Solid Edge SE2021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comzerodayinitiative.com
Sep 28, 2021A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700), NX 1980 Series (All versions < V1988), Solid Edge SE2021 (All versions < SE20CVE-2021-41535 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700), NX 1980 Series (All versions < V1988), Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains a use-after-free vulnerability while parsing OBJ files. An attacker could leverage this vulnerability to execute code in the context of the current process (ZDI-CAN-13771).
- Product
- NX 1953 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Sep 28, 2021A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8).CVE-2021-41534 · Other software · Siemens · reported by productcert@siemens.comLow 3.3
A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8). The affected application is vulnerable to an out of bounds read past the end of an allocated buffer when parsing JT files. An attacker could leverage this vulnerability to leak information in the context of the current process (ZDI-CAN-13703).
- Product
- NX 1980 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Sep 28, 2021A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8).CVE-2021-41533 · Other software · Siemens · reported by productcert@siemens.comLow 3.3
A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8). The affected application is vulnerable to an out of bounds read past the end of an allocated buffer when parsing JT files. An attacker could leverage this vulnerability to leak information in the context of the current process (ZDI-CAN-13565).
- Product
- NX 1980 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Sep 23, 2021IBM Edge 4.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system.CVE-2020-4941 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Edge 4.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 191941.
- Product
- Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 23, 2021IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system.CVE-2020-4809 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189633.
- Product
- Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 23, 2021IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system.CVE-2020-4805 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189539.
- Product
- Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 23, 2021IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system.CVE-2020-4803 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189535.
- Product
- Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 22, 2021A vulnerability in the Layer 2 punt code of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a queue wedge on an interface that CVE-2021-1621 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.4
A vulnerability in the Layer 2 punt code of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a queue wedge on an interface that receives specific Layer 2 frames, resulting in a denial of service (DoS) condition. This vulnerability is due to improper handling of certain Layer 2 frames. An attacker could exploit this vulnerability by sending specific Layer 2 frames on the segment the router is connected to. A successful exploit could allow the attacker to cause a queue wedge on the interface, resulting in a DoS condition.
- Product
- Cisco IOS XE Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Sep 22, 2021Edgecore ECS2020 Firmware 1.0.0.0 devices allow Unauthenticated Command Injection via the command1 HTTP header to the /EXCU_SHELL URI.CVE-2019-6288 · Other software · Edge-core · reported by MITRECritical 9.8
Edgecore ECS2020 Firmware 1.0.0.0 devices allow Unauthenticated Command Injection via the command1 HTTP header to the /EXCU_SHELL URI.
- Product
- Ecs2020 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwitter.comedge-core.com
Sep 21, 2021This affects the package edge.js before 5.3.2.CVE-2021-23443 · Other software · Adonisjs · reported by report@snyk.ioMedium 5.4
This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array (instead of a string or a SafeValue), even if {{ }} are used.
- Product
- Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021Microsoft Edge (Chromium-based) Tampering VulnerabilityCVE-2021-38669 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.4
Microsoft Edge (Chromium-based) Tampering Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Sep 14, 2021A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowledge via clicking on a crafted URL.CVE-2020-21081 · Other software · Maccms · reported by MITREMedium 6.5
A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowledge via clicking on a crafted URL.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2021SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a non-administrative autCVE-2021-37531 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a non-administrative authenticated attacker to craft a malicious XSL stylesheet file containing a script with OS-level commands, copy it into a location to be accessed by the system and then create a file which will trigger the XSLT engine to execute the script contained within the malicious XSL file. This can result in a full compromise of the confidentiality, integrity, and availability of the system.
- Product
- SAP NetWeaver Knowledge Management XML Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 14, 2021A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8).CVE-2021-37203 · Other software · Siemens · reported by productcert@siemens.comHigh 7.1
A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8). The plmxmlAdapterIFC.dll contains an out-of-bounds read while parsing user supplied IFC files which could result in a read past the end of an allocated buffer. This could allow an attacker to cause a denial-of-service condition or read sensitive information from memory locations.
- Product
- NX 1980 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Sep 14, 2021A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8).CVE-2021-37202 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8). The IFC adapter in affected application contains a use-after-free vulnerability that could be triggered while parsing user-supplied IFC files. An attacker could leverage this vulnerability to execute code in the context of the current process.
- Product
- NX 1980 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Sep 14, 2021A vulnerability has been identified in Industrial Edge Management (All versions < V1.3).CVE-2021-37184 · Other software · Siemens · reported by productcert@siemens.comCritical 9.8
A vulnerability has been identified in Industrial Edge Management (All versions < V1.3). An unauthenticated attacker could change the the password of any user in the system under certain circumstances. With this an attacker could impersonate any valid user on an affected system.
- Product
- Industrial Edge Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Sep 3, 2021Chromium: CVE-2021-30624 Use after free in AutofillCVE-2021-30624 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30624 Use after free in Autofill
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30623 Use after free in BookmarksCVE-2021-30623 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30623 Use after free in Bookmarks
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30622 Use after free in WebApp InstallsCVE-2021-30622 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30622 Use after free in WebApp Installs
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30621 UI Spoofing in AutofillCVE-2021-30621 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comMedium 6.5
Chromium: CVE-2021-30621 UI Spoofing in Autofill
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30620 Insufficient policy enforcement in BlinkCVE-2021-30620 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30620 Insufficient policy enforcement in Blink
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30619 UI Spoofing in AutofillCVE-2021-30619 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comMedium 6.5
Chromium: CVE-2021-30619 UI Spoofing in Autofill
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30618 Inappropriate implementation in DevToolsCVE-2021-30618 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30618 Inappropriate implementation in DevTools
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30617 Policy bypass in BlinkCVE-2021-30617 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comMedium 6.5
Chromium: CVE-2021-30617 Policy bypass in Blink
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30616 Use after free in MediaCVE-2021-30616 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30616 Use after free in Media
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30615 Cross-origin data leak in NavigationCVE-2021-30615 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comMedium 6.5
Chromium: CVE-2021-30615 Cross-origin data leak in Navigation
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30614 Heap buffer overflow in TabStripCVE-2021-30614 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30614 Heap buffer overflow in TabStrip
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30613 Use after free in Base internalsCVE-2021-30613 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30613 Use after free in Base internals
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30612 Use after free in WebRTCCVE-2021-30612 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30612 Use after free in WebRTC
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30611 Use after free in WebRTCCVE-2021-30611 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30611 Use after free in WebRTC
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30610 Use after free in Extensions APICVE-2021-30610 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30610 Use after free in Extensions API
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30609 Use after free in Sign-InCVE-2021-30609 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30609 Use after free in Sign-In
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30608 Use after free in Web ShareCVE-2021-30608 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30608 Use after free in Web Share
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30607 Use after free in PermissionsCVE-2021-30607 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30607 Use after free in Permissions
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30606 Use after free in BlinkCVE-2021-30606 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30606 Use after free in Blink
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.