deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-37145
Published: 2021-09-07
Description: A command-injection vulnerability in an authenticated Telnet connection in Poly (formerly Polycom) CX5500 and CX5100 1.3.5 leads an attacker to Privilege Escalation and Remote Code Execution capability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://support.polycom.com/content/dam/polycom-support/global/documentation/security-bulletin-cx5100-cx5500-authenticated-v1-0.pdf; https://support.polycom.com/content/support.html; https://support.polycom.com/content/dam/polycom-support/global/documentation/security-bulletin-cx5100-cx5500-authenticated-v1-0.pdf
CVE: CVE-2020-19853
Published: 2021-09-08
Description: BlueCMS v1.6 contains a SQL injection vulnerability via /ad_js.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/p1g3/CVE_REQUEST/blob/master/Sql%20injection%20in%20bluecms%20v1.6.html; https://github.com/p1g3/CVE_REQUEST/blob/master/Sql%20injection%20in%20bluecms%20v1.6.html
CVE: CVE-2020-19855
Published: 2021-09-08
Description: phpwcms v1.9 contains a cross-site scripting (XSS) vulnerability in /image_zoom.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/p1g3/CVE_REQUEST/blob/master/PHPWCMS%20V1.9%20XSS.html; https://github.com/p1g3/CVE_REQUEST/blob/master/PHPWCMS%20V1.9%20XSS.html
CVE: CVE-2021-39116
Published: 2021-09-08
Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the GIF Image Reader component. The affected versions are before version 8.13.14, and from version 8.14.0 before 8.19.0.
CVSS Score: 5.5 (MEDIUM)
References: https://jira.atlassian.com/browse/JRASERVER-72738; https://jira.atlassian.com/browse/JRASERVER-72738
CVE: CVE-2021-39121
Published: 2021-09-08
Description: Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an Information Disclosure vulnerability in the /rest/api/latest/projectvalidate/key endpoint. The affected versions are before version 8.5.18, from version 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2.
CVSS Score: 4.3 (MEDIUM)
References: https://jira.atlassian.com/browse/JRASERVER-72715; https://jira.atlassian.com/browse/JRASERVER-72715
CVE: CVE-2021-39122
Published: 2021-09-08
Description: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability in the /rest/api/2/search endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.
CVSS Score: 5.3 (MEDIUM)
References: https://jira.atlassian.com/browse/JRASERVER-72293; https://jira.atlassian.com/browse/JRASERVER-72293
CVE: CVE-2020-29012
Published: 2021-09-08
Description: An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID (via other, hypothetical attacks)
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-613
References: https://fortiguard.com/advisory/FG-IR-20-070; https://fortiguard.com/advisory/FG-IR-20-070
CVE: CVE-2021-23404
Published: 2021-09-08
Description: This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.
CVSS Score: 7.6 (HIGH)
CWE: CWE-352
References: https://github.com/coleifer/sqlite-web/blob/2e7c85da3d37f80074ed3ae39b5851069b4f301c/sqlite_web/__main__.py%23L1; https://snyk.io/vuln/SNYK-PYTHON-SQLITEWEB-1316324; https://github.com/coleifer/sqlite-web/blob/2e7c85da3d37f80074ed3ae39b5851069b4f301c/sqlite_web/__main__.py%23L1
CVE: CVE-2021-36179
Published: 2021-09-08
Description: A stack-based buffer overflow in Fortinet FortiWeb version 6.3.14 and below, 6.2.4 and below allows attacker to execute unauthorized code or commands via crafted parameters in CLI command execution
CVSS Score: 8.0 (HIGH)
CWE: CWE-787
References: https://fortiguard.com/advisory/FG-IR-20-206; https://fortiguard.com/advisory/FG-IR-20-206
CVE: CVE-2021-36182
Published: 2021-09-08
Description: A Improper neutralization of special elements used in a command ('Command Injection') in Fortinet FortiWeb version 6.3.13 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://fortiguard.com/advisory/FG-IR-21-047; https://fortiguard.com/advisory/FG-IR-21-047
CVE: CVE-2021-40377
Published: 2021-09-08
Description: SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus allowing one to inject HTML and/or JavaScript into a page that will then be processed and stored by the application.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.smartertools.com/smartermail/release-notes/current; https://www.smartertools.com/smartermail/release-notes/current
CVE: CVE-2020-11264
Published: 2021-09-08
Description: Improper authentication of Non-EAPOL/WAPI plaintext frames during four-way handshake can lead to arbitrary network packet injection in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin
CVE: CVE-2020-11301
Published: 2021-09-08
Description: Improper authentication of un-encrypted plaintext Wi-Fi frames in an encrypted network can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin
CVE: CVE-2021-1904
Published: 2021-09-08
Description: Child process can leak information from parent process due to numeric pids are getting compared and these pid can be reused in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-697
References: https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin
CVE: CVE-2021-1914
Published: 2021-09-08
Description: Loop with unreachable exit condition may occur due to improper handling of unsupported input in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin
CVE: CVE-2021-1916
Published: 2021-09-08
Description: Possible buffer underflow due to lack of check for negative indices values when processing user provided input in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin
CVE: CVE-2021-1919
Published: 2021-09-08
Description: Integer underflow can occur when the RTCP length is lesser than than the actual blocks present in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191
References: https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin
CVE: CVE-2021-1920
Published: 2021-09-08
Description: Integer underflow can occur due to improper handling of incoming RTCP packets in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191
References: https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin
CVE: CVE-2021-1923
Published: 2021-09-08
Description: Incorrect pointer argument passed to trusted application TA could result in un-intended memory operations in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin
CVE: CVE-2021-1928
Published: 2021-09-08
Description: Buffer over read could occur due to incorrect check of buffer size while flashing emmc devices in Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin
CVE: CVE-2021-1929
Published: 2021-09-08
Description: Lack of strict validation of bootmode can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 6.2 (MEDIUM)
References: https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin
CVE: CVE-2021-1930
Published: 2021-09-08
Description: Possible out of bounds read due to incorrect validation of incoming buffer length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin
CVE: CVE-2021-1972
Published: 2021-09-08
Description: Possible buffer overflow due to improper validation of device types during P2P search in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2021-bulletin
CVE: CVE-2021-36695
Published: 2021-09-08
Description: Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in the download file feature on a manager profile due to lack of input validation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.r29k.com/articles/bb/stored-xss-in-deskpro#anchor1; https://www.r29k.com/articles/bb/stored-xss-in-deskpro#anchor1
CVE: CVE-2021-28580
Published: 2021-09-08
Description: Medium by Adobe version 2.4.5.331 (and earlier) is affected by a buffer overflow vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve remote code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://helpx.adobe.com/security/products/medium/apsb21-34.html; https://helpx.adobe.com/security/products/medium/apsb21-34.html
CVE: CVE-2021-28581
Published: 2021-09-08
Description: Adobe Creative Cloud Desktop 3.5 (and earlier) is affected by an uncontrolled search path vulnerability that could result in elevation of privileges. Exploitation of this issue requires user interaction in that a victim must log on to the attacker's local machine.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://helpx.adobe.com/security/products/creative-cloud/apsb21-31.html; https://helpx.adobe.com/security/products/creative-cloud/apsb21-31.html
CVE: CVE-2021-28701
Published: 2021-09-08
Description: Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches (back) from v2 to v1. Freeing such pages requires that the hypervisor enforce that no parallel request can result in the addition of a mapping of such a page to a guest. That enforcement was missing, allowing guests to retain access to pages that were freed and perhaps re-used for other purposes. Unfortunately, when XSA-379 was being prepared, this similar issue was not noticed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: http://www.openwall.com/lists/oss-security/2021/09/08/2; http://xenbits.xen.org/xsa/advisory-384.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HEHUIUWSSMCQGQY3GWX4J2SZGYP5W2Z/
CVE: CVE-2021-30720
Published: 2021-09-08
Description: A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious website may be able to access restricted ports on arbitrary servers.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287
References: https://support.apple.com/en-us/HT212528; https://support.apple.com/en-us/HT212529; https://support.apple.com/en-us/HT212532
CVE: CVE-2021-30721
Published: 2021-09-08
Description: A path handling issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. An attacker in a privileged network position may be able to leak sensitive user information.
CVSS Score: 6.5 (MEDIUM)
References: https://support.apple.com/en-us/HT212529; https://support.apple.com/en-us/HT212530; https://support.apple.com/en-us/HT212531
CVE: CVE-2021-30722
Published: 2021-09-08
Description: An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. An attacker in a privileged network position may be able to leak sensitive user information.
CVSS Score: 5.9 (MEDIUM)
References: https://support.apple.com/en-us/HT212529; https://support.apple.com/en-us/HT212530; https://support.apple.com/en-us/HT212531
CVE: CVE-2021-30723
Published: 2021-09-08
Description: An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted USD file may disclose memory contents.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT212528; https://support.apple.com/en-us/HT212529; https://support.apple.com/en-us/HT212530
CVE: CVE-2021-30724
Published: 2021-09-08
Description: This issue was addressed with improved checks. This issue is fixed in tvOS 14.6, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6, Security Update 2021-003 Catalina, macOS Big Sur 11.4, watchOS 7.5. A local attacker may be able to elevate their privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/HT212528; https://support.apple.com/en-us/HT212529; https://support.apple.com/en-us/HT212530
CVE: CVE-2021-30725
Published: 2021-09-08
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT212528; https://support.apple.com/en-us/HT212529; https://support.apple.com/en-us/HT212530
CVE: CVE-2021-30726
Published: 2021-09-08
Description: A malicious application may be able to execute arbitrary code with kernel privileges. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. An out-of-bounds write issue was addressed with improved bounds checking.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT212529; https://support.apple.com/en-us/HT212530; https://support.apple.com/en-us/HT212531
CVE: CVE-2021-30727
Published: 2021-09-08
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, tvOS 14.6, watchOS 7.5, iOS 14.6 and iPadOS 14.6. A malicious application may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT212528; https://support.apple.com/en-us/HT212529; https://support.apple.com/en-us/HT212532
CVE: CVE-2021-30728
Published: 2021-09-08
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A malicious application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT212529; https://support.apple.com/en-us/HT212530; https://support.apple.com/en-us/HT212531
CVE: CVE-2021-30729
Published: 2021-09-08
Description: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.6 and iPadOS 14.6. A device may accept invalid activation results.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/HT212528; https://support.apple.com/en-us/HT212528
CVE: CVE-2021-30731
Published: 2021-09-08
Description: This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-004 Catalina. An unprivileged application may be able to capture USB devices.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT212529; https://support.apple.com/en-us/HT212600; https://support.apple.com/en-us/HT212529
CVE: CVE-2021-30733
Published: 2021-09-08
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave, macOS Big Sur 11.4, watchOS 7.5. Processing a maliciously crafted font may result in the disclosure of process memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/HT212528; https://support.apple.com/en-us/HT212529; https://support.apple.com/en-us/HT212532
CVE: CVE-2021-30734
Published: 2021-09-08
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT212528; https://support.apple.com/en-us/HT212529; https://support.apple.com/en-us/HT212532
CVE: CVE-2021-30735
Published: 2021-09-08
Description: A malicious application may be able to execute arbitrary code with kernel privileges. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. An out-of-bounds write issue was addressed with improved bounds checking.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT212529; https://support.apple.com/en-us/HT212530; https://support.apple.com/en-us/HT212531
CVE: CVE-2021-30736
Published: 2021-09-08
Description: A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Big Sur 11.4, tvOS 14.6, watchOS 7.5, iOS 14.6 and iPadOS 14.6. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.apple.com/en-us/HT212528; https://support.apple.com/en-us/HT212529; https://support.apple.com/en-us/HT212532
CVE: CVE-2021-30737
Published: 2021-09-08
Description: A memory corruption issue in the ASN.1 decoder was addressed by removing the vulnerable code. This issue is fixed in tvOS 14.6, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6, iOS 12.5.4, Security Update 2021-003 Catalina, macOS Big Sur 11.4, watchOS 7.5. Processing a maliciously crafted certificate may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT212528; https://support.apple.com/en-us/HT212529; https://support.apple.com/en-us/HT212530
CVE: CVE-2021-30738
Published: 2021-09-08
Description: A malicious application may be able to overwrite arbitrary files. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-004 Mojave. An issue with path validation logic for hardlinks was addressed with improved path sanitization.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT212529; https://support.apple.com/en-us/HT212531; https://support.apple.com/en-us/HT212529
CVE: CVE-2021-30739
Published: 2021-09-08
Description: A local attacker may be able to elevate their privileges. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A memory corruption issue was addressed with improved validation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT212529; https://support.apple.com/en-us/HT212530; https://support.apple.com/en-us/HT212531
CVE: CVE-2021-30740
Published: 2021-09-08
Description: A logic issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4, tvOS 14.6, watchOS 7.5, iOS 14.6 and iPadOS 14.6. A malicious application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/HT212528; https://support.apple.com/en-us/HT212529; https://support.apple.com/en-us/HT212532
CVE: CVE-2021-30741
Published: 2021-09-08
Description: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination.
CVSS Score: 7.1 (HIGH)
CWE: CWE-416
References: https://support.apple.com/en-us/HT212528; https://support.apple.com/en-us/HT212528