2021 CVEs (page 74)
Page 74 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-1006 | Medium | 4.4 | 2021-12-15 | In several functions of DatabaseManager.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure. This could lead to local i… |
CVE-2021-1005 | Medium | 5.5 | 2021-12-15 | In getDeviceIdWithFeature of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to si… |
CVE-2021-1004 | High | 7.8 | 2021-12-15 | In getConfiguredNetworks of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to a missing… |
CVE-2021-1003 | High | 7.8 | 2021-12-15 | In adjustStreamVolume of AudioService.java, there is a possible way for unprivileged app to change audio stream volume due to a confused deputy. This could lea… |
CVE-2021-1002 | High | 7.5 | 2021-12-15 | In WT_Interpolate of eas_wtengine.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure wit… |
CVE-2021-1001 | Medium | 5.5 | 2021-12-15 | In PVInitVideoEncoder of mp4enc_api.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure… |
CVE-2021-0999 | High | 7.8 | 2021-12-15 | In the broadcast definition in AndroidManifest.xml, there is a possible way to set the A2DP bluetooth device connection state due to a missing permission check… |
CVE-2021-0998 | Medium | 5.5 | 2021-12-15 | In 'ih264e_find_bskip_params()' of ih264e_me.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disc… |
CVE-2021-0997 | Medium | 5.5 | 2021-12-15 | In handleUpdateNetworkState of GnssNetworkConnectivityHandler.java , there is a possible APN disclosure due to log information disclosure. This could lead to l… |
CVE-2021-0996 | Medium | 4.5 | 2021-12-15 | In nfaHciCallback of HciEventManager.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure… |
CVE-2021-0995 | Low | 3.3 | 2021-12-15 | In registerSuggestionConnectionStatusListener of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissi… |
CVE-2021-0994 | Low | 3.3 | 2021-12-15 | In requestRouteToHostAddress of ConnectivityService.java, there is a possible way to determine whether an app is installed, without query permissions, due to a… |
CVE-2021-0993 | Medium | 6.5 | 2021-12-15 | In getOffsetBeforeAfter of TextLine.java, there is a possible denial of service due to resource exhaustion. This could lead to remote denial of service with no… |
CVE-2021-0992 | Low | 3.3 | 2021-12-15 | In onCreate of PaymentDefaultDialog.java, there is a possible way to change a default payment app without user consent due to tapjack overlay. This could lead… |
CVE-2021-0991 | Low | 2.4 | 2021-12-15 | In OnMetadataChangedListener of AdvancedBluetoothDetailsHeaderController.java, there is a possible leak of Bluetooth MAC addresses due to log information discl… |
CVE-2021-0990 | Low | 3.3 | 2021-12-15 | In getDeviceId of PhoneSubInfoController.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel… |
CVE-2021-0989 | Low | 3.3 | 2021-12-15 | In hasManageOngoingCallsPermission of TelecomServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due… |
CVE-2021-0988 | Low | 3.3 | 2021-12-15 | In getLaunchedFromUid and getLaunchedFromPackage of ActivityClientController.java, there is a possible way to determine whether an app is installed, without qu… |
CVE-2021-0987 | Low | 3.3 | 2021-12-15 | In getNeighboringCellInfo of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to si… |
CVE-2021-0986 | Medium | 5.5 | 2021-12-15 | In hasGrantedPolicy of DevicePolicyManagerService.java, there is a possible information disclosure about the device owner, profile owner, or device admin due t… |
CVE-2021-0985 | High | 7.8 | 2021-12-15 | In onReceive of AlertReceiver.java, there is a possible way to dismiss system dialog due to a missing permission check. This could lead to local escalation of… |
CVE-2021-0984 | High | 7.8 | 2021-12-15 | In onNullBinding of ManagedServices.java, there is a possible permission bypass due to an incorrectly unbound service. This could lead to local escalation of p… |
CVE-2021-0983 | Low | 3.3 | 2021-12-15 | In createAdminSupportIntent of DevicePolicyManagerService.java, there is a possible disclosure of information about installed device/profile owner package name… |
CVE-2021-0982 | Low | 3.3 | 2021-12-15 | In getOrganizationNameForUser of DevicePolicyManagerService.java, there is a possible organization name disclosure due to a missing permission check. This coul… |
CVE-2021-0981 | High | 7.8 | 2021-12-15 | In enqueueNotificationInternal of NotificationManagerService.java, there is a possible way to run a foreground service without showing a notification due to im… |
CVE-2021-0979 | Medium | 5.5 | 2021-12-15 | In isRequestPinItemSupported of ShortcutService.java, there is a possible cross-user leak of packages in which the default launcher supports requests to create… |
CVE-2021-0978 | Low | 3.3 | 2021-12-15 | In getSerialForPackage of DeviceIdentifiersPolicyService.java, there is a possible way to determine whether an app is installed, without query permissions, due… |
CVE-2021-0977 | Medium | 6.7 | 2021-12-15 | In phNxpNHal_DtaUpdate of phNxpNciHal_dta.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of… |
CVE-2021-0976 | Medium | 6.5 | 2021-12-15 | In toBARK of floor0.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additiona… |
CVE-2021-0973 | Medium | 5.0 | 2021-12-15 | In isFileUri of UriUtil.java, there is a possible way to bypass ignoring file://URI attachment due to improper handling of case sensitivity. This could lead to… |
CVE-2021-0971 | Medium | 6.5 | 2021-12-15 | In MPEG4Source::read of MPEG4Extractor.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote information disclo… |
CVE-2021-0970 | High | 7.8 | 2021-12-15 | In createFromParcel of GpsNavigationMessage.java, there is a possible Parcel serialization/deserialization mismatch. This could lead to local escalation of pri… |
CVE-2021-0969 | Medium | 6.5 | 2021-12-15 | In getTitle of AccessPoint.java, there is a possible unhandled exception due to a missing null check. This could lead to remote denial of service if a proximal… |
CVE-2021-0968 | High | 8.8 | 2021-12-15 | In osi_malloc and osi_calloc of allocator.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with… |
CVE-2021-0967 | High | 8.8 | 2021-12-15 | In vorbis_book_decodev_set of codebook.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote information disclosu… |
CVE-2021-0966 | Medium | 5.5 | 2021-12-15 | In code generated by BuildParcelFields of generate_cpp.cpp, there is a possible way for a crafted parcelable to reveal uninitialized memory of a target process… |
CVE-2021-0965 | High | 8.8 | 2021-12-15 | In AndroidManifest.xml of Settings, there is a possible pairing of a Bluetooth device without user's consent due to a missing permission check. This could lead… |
CVE-2021-0964 | Medium | 6.5 | 2021-12-15 | In C2SoftMP3::process() of C2SoftMp3Dec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information discl… |
CVE-2021-0963 | High | 7.1 | 2021-12-15 | In onCreate of KeyChainActivity.java, there is a possible way to use an app certificate stored in keychain due to a tapjacking/overlay attack. This could lead… |
CVE-2021-0961 | Medium | 4.4 | 2021-12-15 | In quota_proc_write of xt_quota2.c, there is a possible way to read kernel memory due to uninitialized data. This could lead to local information disclosure wi… |
CVE-2021-0958 | Medium | 4.4 | 2021-12-15 | In update of km_compat.cpp, there is a possible loss of potentially sensitive data due to a logic error in the code. This could lead to local denial of service… |
CVE-2021-0956 | Critical | 9.8 | 2021-12-15 | In NfcTag::discoverTechnologies (activation) of NfcTag.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote… |
CVE-2021-0955 | High | 7.0 | 2021-12-15 | In pf_write_buf of FuseDaemon.cpp, there is possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additi… |
CVE-2021-0954 | High | 7.3 | 2021-12-15 | In ResolverActivity, there is a possible user interaction bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User… |
CVE-2021-0953 | High | 7.8 | 2021-12-15 | In setOnClickActivityIntent of SearchWidgetProvider.java, there is a possible way to access contacts and history bookmarks without permission due to an unsafe… |
CVE-2021-0952 | Medium | 5.0 | 2021-12-15 | In doCropPhoto of PhotoSelectionHandler.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure o… |
CVE-2021-0933 | High | 8.0 | 2021-12-15 | In onCreate of CompanionDeviceActivity.java or DeviceChooserActivity.java, there is a possible way for HTML tags to interfere with a consent dialog due to impr… |
CVE-2021-0932 | High | 7.8 | 2021-12-15 | In showNotification of NavigationModeController.java, there is a possible confused deputy due to an unsafe PendingIntent. This could lead to local escalation o… |
CVE-2021-0931 | Medium | 5.5 | 2021-12-15 | In getAlias of BluetoothDevice.java, there is a possible way to create misleading permission dialogs due to missing data filtering. This could lead to local in… |
CVE-2021-0930 | High | 8.8 | 2021-12-15 | In phNxpNciHal_process_ext_rsp of phNxpNciHal_ext.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code exe… |
CVE-2021-0929 | High | 7.8 | 2021-12-15 | In ion_dma_buf_end_cpu_access and related functions of ion.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escal… |
CVE-2021-0928 | High | 7.8 | 2021-12-15 | In createFromParcel of OutputConfiguration.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could… |
CVE-2021-0927 | High | 7.8 | 2021-12-15 | In requestChannelBrowsable of TvInputManagerService.java, there is a possible permission bypass due to a logic error in the code. This could lead to local esca… |
CVE-2021-0926 | High | 7.8 | 2021-12-15 | In onCreate of NfcImportVCardActivity.java, there is a possible way to add a contact without user's consent due to a missing permission check. This could lead… |
CVE-2021-0925 | High | 7.5 | 2021-12-15 | In rw_t4t_sm_detect_ndef of rw_t4t.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosur… |
CVE-2021-0924 | High | 7.8 | 2021-12-15 | In xhci_vendor_get_ops of xhci.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with n… |
CVE-2021-0923 | High | 7.8 | 2021-12-15 | In createOrUpdate of Permission.java, there is a possible way to gain internal permissions due to a missing permission check. This could lead to local escalati… |
CVE-2021-0922 | High | 7.8 | 2021-12-15 | In enforceCrossUserOrProfilePermission of PackageManagerService.java, there is a possible bypass of INTERACT_ACROSS_PROFILES permission due to a missing permis… |
CVE-2021-0921 | High | 7.8 | 2021-12-15 | In ParsingPackageImpl of ParsingPackageImpl.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This coul… |
CVE-2021-0920 | Medium | 6.4 | 2021-12-15 | In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System e… |
CVE-2021-0919 | Medium | 5.0 | 2021-12-15 | In getService of IServiceManager.cpp, there is a possible unhandled exception due to an integer overflow. This could lead to local denial of service making the… |
CVE-2021-0918 | High | 8.8 | 2021-12-15 | In gatt_process_notification of gatt_cl.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution ove… |
CVE-2021-0904 | Medium | 6.7 | 2021-12-15 | In SRAMROM, there is a possible permission bypass due to an insecure permission setting. This could lead to local escalation of privilege with System execution… |
CVE-2021-0889 | Critical | 9.8 | 2021-12-15 | In Android TV , there is a possible silent pairing due to lack of rate limiting in the pairing flow. This could lead to remote code execution with no additiona… |
CVE-2021-0799 | High | 7.8 | 2021-12-15 | In ActivityThread.java, there is a possible way to collide the content provider's authorities. This could lead to local escalation of privilege with no additio… |
CVE-2021-0769 | High | 7.3 | 2021-12-15 | In onCreate of AllowBindAppWidgetActivity.java, there is a possible bypass of user interaction requirements due to unclear UI. This could lead to local escalat… |
CVE-2021-0704 | Medium | 5.5 | 2021-12-15 | In createNoCredentialsPermissionNotification and related functions of AccountManagerService.java, there is a possible way to retrieve accounts from the device… |
CVE-2021-0675 | High | 7.8 | 2021-12-15 | In alac decoder, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional… |
CVE-2021-0653 | Medium | 5.5 | 2021-12-15 | In enqueueNotification of NetworkPolicyManagerService.java, there is a possible way to retrieve a trackable identifier due to a missing permission check. This… |
CVE-2021-0650 | Medium | 6.5 | 2021-12-15 | In WT_InterpolateNoLoop of eas_wtengine.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information discl… |
CVE-2021-0649 | High | 7.8 | 2021-12-15 | In stopVpnProfile of Vpn.java, there is a possible VPN profile reset due to a permissions bypass. This could lead to local escalation of privilege CONTROL_ALWA… |
CVE-2021-0434 | High | 7.3 | 2021-12-15 | In onReceive of BluetoothPermissionRequest.java, there is a possible phishing attack allowing a malicious Bluetooth device to acquire permissions based on insu… |
CVE-2021-42216 | Critical | 9.8 | 2021-12-15 | A Broken or Risky Cryptographic Algorithm exists in AnonAddy 0.8.5 via VerificationController.php. |
CVE-2021-44655 | Critical | 9.8 | 2021-12-15 | Online Pre-owned/Used Car Showroom Management System 1.0 contains a SQL injection authentication bypass vulnerability. Admin panel authentication can be bypass… |
CVE-2021-44653 | Critical | 9.8 | 2021-12-15 | Online Magazine Management System 1.0 contains a SQL injection authentication bypass vulnerability. The Admin panel authentication can be bypassed due to SQL i… |
CVE-2021-43675 | Medium | 6.1 | 2021-12-15 | Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php. The function exit will terminate the script and print the m… |
CVE-2021-4117 | Medium | 4.3 | 2021-12-15 | yetiforcecrm is vulnerable to Business Logic Errors |
CVE-2021-44657 | High | 8.8 | 2021-12-15 | In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not en… |
CVE-2021-43908 | Medium | 4.3 | 2021-12-15 | Visual Studio Code Spoofing Vulnerability |
CVE-2021-43907 | Critical | 9.8 | 2021-12-15 | Visual Studio Code WSL Extension Remote Code Execution Vulnerability |
CVE-2021-43905 | Critical | 9.6 | 2021-12-15 | Microsoft Office app Remote Code Execution Vulnerability |
CVE-2021-43899 | Critical | 9.8 | 2021-12-15 | Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability |
CVE-2021-43896 | Medium | 5.5 | 2021-12-15 | Microsoft PowerShell Spoofing Vulnerability |
CVE-2021-43893 | High | 7.5 | 2021-12-15 | Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability |
CVE-2021-43892 | High | 7.4 | 2021-12-15 | Microsoft BizTalk ESB Toolkit Spoofing Vulnerability |
CVE-2021-43891 | High | 7.8 | 2021-12-15 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2021-43890 | High | 7.1 | 2021-12-15 | We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploi… |
CVE-2021-43889 | High | 7.2 | 2021-12-15 | Microsoft Defender for IoT Remote Code Execution Vulnerability |
CVE-2021-43888 | High | 7.5 | 2021-12-15 | Microsoft Defender for IoT Information Disclosure Vulnerability |
CVE-2021-43883 | High | 7.8 | 2021-12-15 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2021-43882 | Critical | 9.0 | 2021-12-15 | Microsoft Defender for IoT Remote Code Execution Vulnerability |
CVE-2021-43880 | Medium | 5.5 | 2021-12-15 | Windows Mobile Device Management Elevation of Privilege Vulnerability |
CVE-2021-43877 | High | 8.8 | 2021-12-15 | ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability |
CVE-2021-43875 | High | 7.8 | 2021-12-15 | Microsoft Office Graphics Remote Code Execution Vulnerability |
CVE-2021-43518 | High | 7.8 | 2021-12-15 | Teeworlds up to and including 0.7.5 is vulnerable to Buffer Overflow. A map parser does not validate m_Channels value coming from a map file, leading to a buff… |
CVE-2021-43256 | High | 7.8 | 2021-12-15 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2021-43255 | Medium | 5.5 | 2021-12-15 | Microsoft Office Trust Center Spoofing Vulnerability |
CVE-2021-43248 | High | 7.8 | 2021-12-15 | Windows Digital Media Receiver Elevation of Privilege Vulnerability |
CVE-2021-43247 | High | 7.8 | 2021-12-15 | Windows TCP/IP Driver Elevation of Privilege Vulnerability |
CVE-2021-43246 | Medium | 5.6 | 2021-12-15 | Windows Hyper-V Denial of Service Vulnerability |