Low · CVSS 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-13240.
Published May 7, 2021 · Updated Aug 3, 2024
High · CVSS 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13101.
Published May 7, 2021 · Updated Aug 3, 2024
High · CVSS 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13280.
Published May 7, 2021 · Updated Aug 3, 2024
High · CVSS 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation Manager. Authentication is not required to exploit this vulnerablity. The specific flaw exists within the processing of DSI structures in Netatalk. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12326.
Published May 21, 2021 · Updated Aug 3, 2024
High · CVSS 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of XFA forms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13084.
Published May 7, 2021 · Updated Aug 3, 2024
Low · CVSS 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-13244.
Published May 7, 2021 · Updated Aug 3, 2024
High · CVSS 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of XFA forms. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13091.
Published May 7, 2021 · Updated Aug 3, 2024
High · CVSS 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs prior to executing them. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-13661.
Published May 21, 2021 · Updated Aug 3, 2024
Unknown · CVSS Not scored
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the blit function of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker.
Published May 18, 2021 · Updated Aug 3, 2024
Low · CVSS 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-13269.
Published May 7, 2021 · Updated Aug 3, 2024
Unknown · CVSS Not scored
Uploading a table mapping using a manipulated XML file results in an exception that could expose information about the application-server and the used XML-framework on the Mendix Database Replication Module (All versions prior to v7.0.1).
Published May 12, 2021 · Updated Aug 3, 2024
High · CVSS 7.8
Windows Container Manager Service Elevation of Privilege Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
Unknown · CVSS Not scored
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
Published May 18, 2021 · Updated Aug 3, 2024
Unknown · CVSS Not scored
The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.
Published May 18, 2021 · Updated Aug 3, 2024
Unknown · CVSS Not scored
A vulnerability has been identified in Mendix Excel Importer Module (All versions < V9.0.3). Uploading a manipulated XML File results in an exception that could expose information about the Application-Server and the used XML-Framework.
Published May 12, 2021 · Updated Aug 3, 2024
High · CVSS 7.3
.NET and Visual Studio Elevation of Privilege Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
Medium · CVSS 5.5
Microsoft Windows Infrared Data Association (IrDA) Information Disclosure Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
Unknown · CVSS Not scored
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the gray_split_cubic function of their custom fork of the rlottie library. A remote attacker might be able to overwrite Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker.
Published May 18, 2021 · Updated Aug 3, 2024
Medium · CVSS 6.5
Windows SMB Client Security Feature Bypass Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
High · CVSS 7.8
Windows WalletService Elevation of Privilege Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
Unknown · CVSS Not scored
SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as SlurmUser because use of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling.
Published May 13, 2021 · Updated Aug 3, 2024
High · CVSS 7.8
Visual Studio Code Remote Containers Extension Remote Code Execution Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
Unknown · CVSS Not scored
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
Published May 18, 2021 · Updated Aug 3, 2024
Unknown · CVSS Not scored
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the VGradientCache::generateGradientColorTable function of their custom fork of the rlottie library. A remote attacker might be able to overwrite heap memory out-of-bounds on a victim device via a malicious animated sticker.
Published May 18, 2021 · Updated Aug 3, 2024
Unknown · CVSS Not scored
The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution.
Published May 18, 2021 · Updated Aug 3, 2024
High · CVSS 7.8
Microsoft Office Remote Code Execution Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
Unknown · CVSS Not scored
omr-admin.py in openmptcprouter-vps-admin 0.57.3 and earlier compares the user provided password with the original password in a length dependent manner, which allows remote attackers to guess the password via a timing attack.
Published May 6, 2021 · Updated Aug 3, 2024
Unknown · CVSS Not scored
A Cross-Site Scripting (XSS) vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. An authenticated attacker may inject malicious Javascript code when using Markdown editing within the application which remains persistent.
Published May 11, 2022 · Updated Aug 3, 2024
Unknown · CVSS Not scored
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's heap memory out-of-bounds on a victim device via a malicious animated sticker.
Published May 18, 2021 · Updated Aug 3, 2024
Unknown · CVSS Not scored
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
Published May 18, 2021 · Updated Aug 3, 2024
High · CVSS 7.1
Microsoft Bluetooth Driver Spoofing Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
Unknown · CVSS Not scored
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
Published May 18, 2021 · Updated Aug 3, 2024
High · CVSS 7.8
Windows Media Foundation Core Remote Code Execution Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
High · CVSS 7.8
Windows Container Manager Service Elevation of Privilege Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
High · CVSS 7.8
Windows Container Manager Service Elevation of Privilege Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
Medium · CVSS 5.5
Windows Projected File System FS Filter Driver Information Disclosure Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
High · CVSS 7.8
Windows Container Manager Service Elevation of Privilege Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
High · CVSS 7.8
Microsoft Office Remote Code Execution Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
Medium · CVSS 5.5
Microsoft Excel Information Disclosure Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
High · CVSS 7.2
Common Utilities Remote Code Execution Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
High · CVSS 7.8
Microsoft Office Remote Code Execution Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
High · CVSS 7.8
Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
High · CVSS 7.8
Microsoft Office Graphics Remote Code Execution Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
High · CVSS 7.8
Windows Graphics Component Elevation of Privilege Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
High · CVSS 7.8
Windows Graphics Component Elevation of Privilege Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
Medium · CVSS 4.1
Microsoft SharePoint Information Disclosure Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
High · CVSS 8.8
OLE Automation Remote Code Execution Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
High · CVSS 7.4
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
Unknown · CVSS Not scored
Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements.
Published May 4, 2021 · Updated Aug 3, 2024
Medium · CVSS 5.5
Microsoft Office Information Disclosure Vulnerability
Published May 11, 2021 · Updated Aug 3, 2024
