This is a list of recent vulnerabilities for which exploits are available.
CVE, Title, Vendor
Description
CVSS v3.1 Base Score
Date Created
Date Updated
CVE-2021-2248
Remote Code Execution Vulnerability in Oracle Secure Product
Oracle
Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server). The supported version that is affected is 5.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via SKID to compromise Oracle Secure Global Desktop. While the vulnerability is in Oracle Secure Global Desktop, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Secure Global Desktop.
10 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
04/22/2021
04/29/2021
CVE-2021-31572
Denial of Service Vulnerability in AWS
Amazon
The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in stream_buffer.c for a stream buffer.
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
04/09/2021
05/03/2021
CVE-2017-3167
Authentication Bypass Vulnerability in Apache httpd
Apache and multiple other vendors
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
06/19/2017
05/04/2021
CVE-2021-21346
Deserialization Vulnerability in XStream Library
XStream_project
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
03/22/2021
04/30/2021
CVE-2020-11975
Privilege Escalation Vulnerability in Apache Unomi
Apache
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
04/09/2021
04/14/2021
CVE-2021-1479
Remote Code Execution Vulnerability in Cisco vManage Software
Cisco
Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gain escalated privileges on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
06/05/2020
05/03/2021
CVE-2020-11857
Authorization Bypass Vulnerability in Micro Focus Operation Bridge
Microfocus
An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could allow remote attackers to access the OBR host as a non-admin user
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
09/22/2020
04/30/2021
CVE-2020-11857
Remote Code Execution in Oracle Fusion
Oracle
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: OPSS). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java.
