Total
1333 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-31918 | 1 Redhat | 1 Openstack | 2024-08-03 | 7.5 High |
| A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality. | ||||
| CVE-2021-31894 | 1 Siemens | 8 Simatic Pcs 7, Simatic Pcs 7 Firmware, Simatic Pdm and 5 more | 2024-08-03 | 8.8 High |
| A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions < V9.1 SP2), SIMATIC PDM (All versions < V9.2 SP2), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 SP2 HF1). A directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software. | ||||
| CVE-2021-31902 | 1 Jetbrains | 1 Youtrack | 2024-08-03 | 7.5 High |
| In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly. | ||||
| CVE-2021-31859 | 1 Ysoft | 1 Safeq | 2024-08-03 | 7.8 High |
| Incorrect privileges in the MU55 FlexiSpooler service in YSoft SafeQ 6 6.0.55 allows local user privilege escalation by overwriting the executable file via an alternative data stream. | ||||
| CVE-2021-31540 | 1 Wowza | 1 Streaming Engine | 2024-08-03 | 7.1 High |
| Wowza Streaming Engine through 4.8.5 (in a default installation) has incorrect file permissions of configuration files in the conf/ directory. A regular local user is able to read and write to all the configuration files, e.g., modify the application server configuration. | ||||
| CVE-2021-31475 | 1 Solarwinds | 1 Orion Job Scheduler | 2024-08-03 | 8.8 High |
| This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job Scheduler 2020.2.1 HF 2. Authentication is required to exploit this vulnerability. The specific flaw exists within the JobRouterService WCF service. The issue is due to the WCF service configuration, which allows a critical resource to be accessed by unprivileged users. An attacker can leverage this vulnerability to execute code in the context of an administrator. Was ZDI-CAN-12007. | ||||
| CVE-2021-31167 | 1 Microsoft | 9 Windows 10, Windows 10 1809, Windows 10 1909 and 6 more | 2024-08-03 | 7.8 High |
| Windows Container Manager Service Elevation of Privilege Vulnerability | ||||
| CVE-2021-31155 | 1 Umask Project | 1 Umask | 2024-08-03 | 7.8 High |
| Failure to normalize the umask in please before 0.4 allows a local attacker to gain full root privileges if they are allowed to execute at least one command. | ||||
| CVE-2021-30964 | 1 Apple | 4 Ipados, Iphone Os, Macos and 1 more | 2024-08-03 | 5.5 Medium |
| An inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.1, watchOS 8.3, iOS 15.2 and iPadOS 15.2. A malicious application may be able to bypass Privacy preferences. | ||||
| CVE-2021-30920 | 1 Apple | 1 Macos | 2024-08-03 | 5.5 Medium |
| A permissions issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.0.1. A local attacker may be able to read sensitive information. | ||||
| CVE-2021-30892 | 1 Apple | 2 Mac Os X, Macos | 2024-08-03 | 5.5 Medium |
| An inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.0.1, Security Update 2021-007 Catalina, macOS Big Sur 11.6.1. A malicious application may be able to modify protected parts of the file system. | ||||
| CVE-2021-30577 | 2 Fedoraproject, Google | 2 Fedora, Chrome | 2024-08-03 | 7.8 High |
| Insufficient policy enforcement in Installer in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform local privilege escalation via a crafted file. | ||||
| CVE-2021-29396 | 1 Globalnorthstar | 1 Northstar Club Management | 2024-08-03 | 9.8 Critical |
| Systemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to use various functionalities without authentication. | ||||
| CVE-2021-29247 | 1 Btcpayserver | 1 Btcpay Server | 2024-08-03 | 5.3 Medium |
| BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie. | ||||
| CVE-2021-28646 | 1 Trendmicro | 2 Apex One, Officescan | 2024-08-03 | 5.5 Medium |
| An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to take control of a specific log file on affected installations. | ||||
| CVE-2021-28645 | 1 Trendmicro | 2 Apex One, Officescan | 2024-08-03 | 7.8 High |
| An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. | ||||
| CVE-2021-28374 | 1 Debian | 2 Courier-authlib, Debian Linux | 2024-08-03 | 7.5 High |
| The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak permissions, allowing an attacker to read user information. This may include a cleartext password in some configurations. In general, it includes the user's existence, uid and gids, home and/or Maildir directory, quota, and some type of password information (such as a hash). | ||||
| CVE-2021-28269 | 1 Soyal | 1 701client | 2024-08-03 | 8.8 High |
| Soyal Technology 701Client 9.0.1 is vulnerable to Insecure permissions via client.exe binary with Authenticated Users group with Full permissions. | ||||
| CVE-2021-28098 | 1 Forescout | 1 Counteract | 2024-08-03 | 7.8 High |
| An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in the logging function. SecureConnector runs with administrative privileges and writes logs entries to a file in %PROGRAMDATA%\ForeScout SecureConnector\ that has full permissions for the Everyone group. Using a symbolic link allows an attacker to point the log file to a privileged location such as %WINDIR%\System32. The resulting log file adopts the file permissions of the source of the symbolic link (in this case, the Everyone group). The log file in System32 can be replaced and renamed with a malicious DLL for DLL hijacking. | ||||
| CVE-2021-27483 | 1 Zoll | 1 Defibrillator Dashboard | 2024-08-03 | 7.8 High |
| ZOLL Defibrillator Dashboard, v prior to 2.2,The affected products contain insecure filesystem permissions that could allow a lower privilege user to escalate privileges to an administrative level user. | ||||