Low-severity CVEs (page 88)
Page 88 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-1018 | Low | 3.3 | 2021-12-15 | In adjustStreamVolume of AudioService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel in… |
CVE-2021-1015 | Low | 3.3 | 2021-12-15 | In getMeidForSlot of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side chann… |
CVE-2021-0995 | Low | 3.3 | 2021-12-15 | In registerSuggestionConnectionStatusListener of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissi… |
CVE-2021-0994 | Low | 3.3 | 2021-12-15 | In requestRouteToHostAddress of ConnectivityService.java, there is a possible way to determine whether an app is installed, without query permissions, due to a… |
CVE-2021-0992 | Low | 3.3 | 2021-12-15 | In onCreate of PaymentDefaultDialog.java, there is a possible way to change a default payment app without user consent due to tapjack overlay. This could lead… |
CVE-2021-0991 | Low | 2.4 | 2021-12-15 | In OnMetadataChangedListener of AdvancedBluetoothDetailsHeaderController.java, there is a possible leak of Bluetooth MAC addresses due to log information discl… |
CVE-2021-0990 | Low | 3.3 | 2021-12-15 | In getDeviceId of PhoneSubInfoController.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel… |
CVE-2021-0989 | Low | 3.3 | 2021-12-15 | In hasManageOngoingCallsPermission of TelecomServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due… |
CVE-2021-0988 | Low | 3.3 | 2021-12-15 | In getLaunchedFromUid and getLaunchedFromPackage of ActivityClientController.java, there is a possible way to determine whether an app is installed, without qu… |
CVE-2021-0987 | Low | 3.3 | 2021-12-15 | In getNeighboringCellInfo of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to si… |
CVE-2021-0983 | Low | 3.3 | 2021-12-15 | In createAdminSupportIntent of DevicePolicyManagerService.java, there is a possible disclosure of information about installed device/profile owner package name… |
CVE-2021-0982 | Low | 3.3 | 2021-12-15 | In getOrganizationNameForUser of DevicePolicyManagerService.java, there is a possible organization name disclosure due to a missing permission check. This coul… |
CVE-2021-0978 | Low | 3.3 | 2021-12-15 | In getSerialForPackage of DeviceIdentifiersPolicyService.java, there is a possible way to determine whether an app is installed, without query permissions, due… |
CVE-2021-42070 | Low | 3.3 | 2021-12-14 | When a user opens manipulated Jupiter Tessellation (.jt) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application… |
CVE-2021-42069 | Low | 3.3 | 2021-12-14 | When a user opens manipulated Tagged Image File Format (.tif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applic… |
CVE-2021-42068 | Low | 3.3 | 2021-12-14 | When a user opens a manipulated GIF (.gif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and b… |
CVE-2021-44448 | Low | 3.3 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0). JTTK library in affected products is vulnerabl… |
CVE-2021-44444 | Low | 3.3 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerabl… |
CVE-2021-44436 | Low | 3.3 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerabl… |
CVE-2021-44431 | Low | 3.3 | 2021-12-14 | A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerabl… |
CVE-2021-39945 | Low | 2.7 | 2021-12-13 | Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 before 14.4.4, all vers… |
CVE-2021-39941 | Low | 3.7 | 2021-12-13 | An information disclosure vulnerability in GitLab CE/EE versions 12.0 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed non-project members to see the defa… |
CVE-2021-39938 | Low | 3.1 | 2021-12-13 | A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting… |
CVE-2021-39936 | Low | 3.5 | 2021-12-13 | Improper access control in GitLab CE/EE affecting all versions starting from 10.7 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions st… |
CVE-2021-39931 | Low | 3.1 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.11 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39918 | Low | 3.1 | 2021-12-13 | Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions start… |
CVE-2021-39910 | Low | 2.6 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2018-25022 | Low | 3.1 | 2021-12-13 | The Onion module in toxcore before 0.2.2 doesn't restrict which packets can be onion-routed, which allows a remote attacker to discover a target user's IP addr… |
CVE-2021-25527 | Low | 3.8 | 2021-12-08 | Improper export of Android application components vulnerability in Samsung Pay (India only) prior to version 4.1.77 allows attacker to access Bill Pay and Rech… |
CVE-2021-25525 | Low | 2.0 | 2021-12-08 | Improper check or handling of exception conditions vulnerability in Samsung Pay (US only) prior to version 4.0.65 allows attacker to use NFC without user recog… |
CVE-2021-25514 | Low | 3.3 | 2021-12-08 | An improper intent redirection handling in Tags prior to SMR Dec-2021 Release 1 allows attackers to access sensitive information. |
CVE-2021-25513 | Low | 2.4 | 2021-12-08 | An improper privilege management vulnerability in Apps Edge application prior to SMR Dec-2021 Release 1 allows unauthorized access to some device data on the l… |
CVE-2021-37073 | Low | 3.7 | 2021-12-07 | There is a Race Condition vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to the detection result is tampered with. |
CVE-2021-44187 | Low | 3.3 | 2021-12-07 | Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2021-44186 | Low | 3.3 | 2021-12-07 | Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2021-44185 | Low | 3.3 | 2021-12-07 | Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2021-39890 | Low | 3.1 | 2021-12-06 | It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above. |
CVE-2021-42117 | Low | 3.5 | 2021-11-30 | Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote… |
CVE-2021-43220 | Low | 3.1 | 2021-11-24 | Microsoft Edge for iOS Spoofing Vulnerability |
CVE-2021-42308 | Low | 3.1 | 2021-11-24 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2021-32004 | Low | 3.7 | 2021-11-22 | This issue affects: Secomea GateManager All versions prior to 9.6. Improper Check of host header in web server of Secomea GateManager allows attacker to cause… |
CVE-2019-5640 | Low | 3.3 | 2021-11-22 | Rapid7 Nexpose versions prior to 6.6.114 suffer from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker ca… |
CVE-2021-36319 | Low | 3.3 | 2021-11-20 | Dell Networking OS10 versions 10.4.3.x, 10.5.0.x and 10.5.1.x contain an information exposure vulnerability. A low privileged authenticated malicious user can… |
CVE-2021-42525 | Low | 3.3 | 2021-11-18 | Acrobat Animate versions 21.0.9 (and earlier)is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2021-37939 | Low | 2.7 | 2021-11-18 | It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentional… |
CVE-2021-41190 | Low | 3.0 | 2021-11-17 | The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification vers… |
CVE-2021-43553 | Low | 3.1 | 2021-11-17 | PI Vision could disclose information to a user with insufficient privileges for an AF attribute that is the child of another attribute and is configured as a L… |
CVE-2021-43273 | Low | 3.3 | 2021-11-14 | An Out-of-bounds Read vulnerability exists in the DGN file reading procedure in Open Design Alliance Drawings SDK before 2022.11. Crafted data in a DGN file an… |
CVE-2021-38973 | Low | 2.7 | 2021-11-12 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the prop… |
CVE-2021-37910 | Low | 3.7 | 2021-11-12 | ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can r… |
CVE-2021-34421 | Low | 3.7 | 2021-11-11 | The Keybase Client for Android before version 5.8.0 and the Keybase Client for iOS before version 5.8.0 fails to properly remove exploded messages initiated by… |
CVE-2021-34419 | Low | 3.7 | 2021-11-11 | In the Zoom Client for Meetings for Ubuntu Linux before version 5.1.0, there is an HTML injection flaw when sending a remote control request to a user in the p… |
CVE-2021-42323 | Low | 3.3 | 2021-11-10 | Azure RTOS Information Disclosure Vulnerability |
CVE-2021-42301 | Low | 3.3 | 2021-11-10 | Azure RTOS Information Disclosure Vulnerability |
CVE-2021-41376 | Low | 2.3 | 2021-11-10 | Azure Sphere Information Disclosure Vulnerability |
CVE-2021-26444 | Low | 3.3 | 2021-11-10 | Azure RTOS Information Disclosure Vulnerability |
CVE-2021-34685 | Low | 2.7 | 2021-11-08 | UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authenticated user to upl… |
CVE-2021-25505 | Low | 3.3 | 2021-11-05 | Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is unlocked. |
CVE-2021-39911 | Low | 1.7 | 2021-11-05 | An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versio… |
CVE-2021-39901 | Low | 2.7 | 2021-11-05 | In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiting a specific endpoint. |
CVE-2021-39898 | Low | 3.7 | 2021-11-05 | In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was… |
CVE-2021-39897 | Low | 2.6 | 2021-11-05 | Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have ac… |
CVE-2021-39914 | Low | 3.1 | 2021-11-04 | A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a spe… |
CVE-2021-41247 | Low | 3.5 | 2021-11-04 | JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser ses… |
CVE-2021-23472 | Low | 3.1 | 2021-11-03 | This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provid… |
CVE-2021-43264 | Low | 3.3 | 2021-11-02 | In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access con… |
CVE-2021-42754 | Low | 3.2 | 2021-11-02 | An improper control of generation of code vulnerability [CWE-94] in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may allow an authenticated at… |
CVE-2021-41019 | Low | 3.5 | 2021-11-02 | An improper validation of certificate with host mismatch [CWE-297] vulnerability in FortiOS versions 6.4.6 and below may allow the connection to a malicious LD… |
CVE-2021-36181 | Low | 3.1 | 2021-11-02 | A concurrent execution using shared resource with improper Synchronization vulnerability ('Race Condition') in the customer database interface of FortiPortal b… |
CVE-2021-30816 | Low | 2.4 | 2021-10-28 | The issue was addressed with improved permissions logic. This issue is fixed in iOS 15 and iPadOS 15. An attacker with physical access to a device may be able… |
CVE-2021-36994 | Low | 3.7 | 2021-10-28 | There is a issue that trustlist strings being repeatedly inserted into the linked list in Huawei Smartphone due to race conditions. Successful exploitation of… |
CVE-2021-22468 | Low | 3.3 | 2021-10-28 | A component of the HarmonyOS has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability. Local attackers may exploit this vulnerability to… |
CVE-2021-22464 | Low | 3.3 | 2021-10-28 | A component of the HarmonyOS has a Out-of-bounds Read vulnerability. Local attackers may exploit this vulnerability to cause system Soft Restart. |
CVE-2021-22457 | Low | 3.3 | 2021-10-28 | A component of the HarmonyOS has a Improper Input Validation vulnerability. Local attackers may exploit this vulnerability to cause out-of-bounds write. |
CVE-2021-22453 | Low | 3.3 | 2021-10-28 | A component of the HarmonyOS has a Improper Input Validation vulnerability. Local attackers may exploit this vulnerability to cause nearby process crash. |
CVE-2021-35236 | Low | 3.1 | 2021-10-27 | The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie… |
CVE-2021-39224 | Low | 3.5 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version 1.1.1 returned verbatim exception messa… |
CVE-2021-39220 | Low | 3.5 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render im… |
CVE-2020-14264 | Low | 3.9 | 2021-10-25 | "HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK" |
CVE-2020-14263 | Low | 3.9 | 2021-10-21 | "HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK" |
CVE-2021-35640 | Low | 2.7 | 2021-10-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.26 and prior. Easily exploitab… |
CVE-2021-35633 | Low | 2.7 | 2021-10-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Logging). Supported versions that are affected are 8.0.26 and prior. Easily explo… |
CVE-2021-35625 | Low | 2.7 | 2021-10-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.26 and prior… |
CVE-2021-35623 | Low | 2.7 | 2021-10-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported versions that are affected are 8.0.26 and prior. Easi… |
CVE-2021-35618 | Low | 1.8 | 2021-10-20 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.26 and prior. Difficult… |
CVE-2021-35613 | Low | 3.7 | 2021-10-20 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.26 and prior. Difficult… |
CVE-2021-35603 | Low | 3.7 | 2021-10-20 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE… |
CVE-2021-35588 | Low | 3.1 | 2021-10-20 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java S… |
CVE-2021-35576 | Low | 2.7 | 2021-10-20 | Vulnerability in the Oracle Database Enterprise Edition Unified Audit component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 1… |
CVE-2021-35549 | Low | 3.9 | 2021-10-20 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11. Easily exploitable vulnerabil… |
CVE-2021-2480 | Low | 3.7 | 2021-10-20 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 11.1.1.9.0. Di… |
CVE-2011-1075 | Low | 3.7 | 2021-10-19 | FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new version in. In parti… |
CVE-2021-30815 | Low | 2.4 | 2021-10-19 | A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in iOS 15 and i… |
CVE-2021-38440 | Low | 3.3 | 2021-10-18 | FATEK Automation WinProladder versions 3.30 and prior is vulnerable to an out-of-bounds read, which may allow an attacker to read unauthorized information. |
CVE-2021-36097 | Low | 3.5 | 2021-10-18 | Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissio… |
CVE-2020-4951 | Low | 3.3 | 2021-10-15 | IBM Cognos Analytics 11.1.7 and 11.2.0 contains locally cached browser data, that could allow a local attacker to obtain sensitive information. |
CVE-2021-40730 | Low | 3.3 | 2021-10-15 | Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected… |
CVE-2021-40729 | Low | 3.3 | 2021-10-15 | Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected… |
CVE-2021-22033 | Low | 2.7 | 2021-10-13 | Releases prior to VMware vRealize Operations 8.6 contain a Server Side Request Forgery (SSRF) vulnerability. |
CVE-2021-41136 | Low | 3.7 | 2021-10-12 | Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which cont… |