Filtered by CWE-668
Filtered by vendor Subscriptions
Total 648 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-31407 1 Vaadin 2 Flow, Vaadin 2024-11-21 8.6 High
Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.
CVE-2021-31154 1 Pleaseedit Project 1 Pleaseedit 2024-11-21 7.8 High
pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.
CVE-2021-30921 1 Apple 2 Ipados, Iphone Os 2024-11-21 5.5 Medium
A logic issue was addressed with improved state management. This issue is fixed in iOS 14.5 and iPadOS 14.5. A user's password may be visible onscreen.
CVE-2021-30153 1 Mediawiki 1 Mediawiki 2024-11-21 4.3 Medium
An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. . When using VisualEditor to edit a MediaWiki user page belonging to an existing, but hidden, user, VisualEditor will disclose that the user exists. (It shouldn't because they are hidden.) This is related to ApiVisualEditor.
CVE-2021-29280 1 Tp-link 2 Tl-wr840n, Tl-wr840n Firmware 2024-11-21 6.4 Medium
In TP-Link Wireless N Router WR840N an ARP poisoning attack can cause buffer overflow
CVE-2021-29115 1 Esri 1 Arcgis Enterprise 2024-11-21 5.3 Medium
An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers. This issue may reveal field names, but not not disclose features.
CVE-2021-28633 1 Adobe 1 Creative Cloud Desktop Application 2024-11-21 6.1 Medium
Adobe Creative Cloud Desktop Application (installer) version 2.4 (and earlier) is affected by an Insecure temporary file creation vulnerability. An attacker could leverage this vulnerability to cause arbitrary file overwriting in the context of the current user. Exploitation of this issue requires physical interaction to the system.
CVE-2021-28623 2 Adobe, Microsoft 2 Premiere Elements, Windows 2024-11-21 5.5 Medium
Adobe Premiere Elements version 5.2 (and earlier) is affected by an insecure temporary file creation vulnerability. An unauthenticated attacker could leverage this vulnerability to call functions against the installer to perform high privileged actions. Exploitation of this issue does not require user interaction.
CVE-2021-28597 3 Adobe, Apple, Microsoft 3 Photoshop Elements, Macos, Windows 2024-11-21 5.5 Medium
Adobe Photoshop Elements version 5.2 (and earlier) is affected by an insecure temporary file creation vulnerability. An unauthenticated attacker could leverage this vulnerability to call functions against the installer to perform high privileged actions. Exploitation of this issue does not require user interaction.
CVE-2021-28568 3 Adobe, Apple, Microsoft 3 Genuine Service, Macos, Windows 2024-11-21 5.8 Medium
Adobe Genuine Services version 7.1 (and earlier) is affected by an Insecure file permission vulnerability during installation process. A local authenticated attacker could leverage this vulnerability to achieve privilege escalation in the context of the current user.
CVE-2021-28488 1 Ericsson 1 Network Manager 2024-11-21 6.5 Medium
Ericsson Network Manager (ENM) before 21.2 has incorrect access-control behavior (that only affects the level of access available to persons who were already granted a highly privileged role). Users in the same AMOS authorization group can retrieve managed-network data that was not set to be accessible to the entire group (i.e., was only set to be accessible to a subset of that group).
CVE-2021-28168 3 Eclipse, Oracle, Redhat 6 Jersey, Communications Cloud Native Core Policy, Communications Cloud Native Core Unified Data Repository and 3 more 2024-11-21 6.2 Medium
Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.
CVE-2021-27424 1 Ge 38 Multilin B30, Multilin B30 Firmware, Multilin B90 and 35 more 2024-11-21 5.3 Medium
GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a “Last-key pressed” MODBUS register can be used to gain unauthorized information.
CVE-2021-27236 1 Mutare 1 Voice 2024-11-21 9.8 Critical
An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. getfile.asp allows Unauthenticated Local File Inclusion, which can be leveraged to achieve Remote Code Execution.
CVE-2021-26343 1 Amd 48 Epyc 7003, Epyc 7003 Firmware, Epyc 72f3 and 45 more 2024-11-21 5.5 Medium
Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result in information disclosure.
CVE-2021-26341 2 Amd, Redhat 255 A10-9600p, A10-9600p Firmware, A10-9630p and 252 more 2024-11-21 6.5 Medium
Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage.
CVE-2021-26327 1 Amd 40 Epyc 7003, Epyc 7003 Firmware, Epyc 72f3 and 37 more 2024-11-21 5.5 Medium
Insufficient validation of guest context in the SNP Firmware could lead to a potential loss of guest confidentiality.
CVE-2021-26312 1 Amd 114 Epyc 7232p, Epyc 7232p Firmware, Epyc 7251 and 111 more 2024-11-21 5.5 Medium
Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be able to access, resulting in a potential loss of integrity.
CVE-2021-26309 1 Jetbrains 1 Teamcity 2024-11-21 3.3 Low
Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Permissions.
CVE-2021-25652 1 Avaya 1 Aura Appliance Virtualization Platform 2024-11-21 4.9 Medium
An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Appliance Virtualization Platform Utilities (AVPU). This vulnerability may potentially allow any local user to access system functionality and configuration information that should only be available to a privileged user. Affects versions 8.0.0.0 through 8.1.3.1 of AVPU.