stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2021-30607 (severity: HIGH, weakness: CWE-416)
Chromium: CVE-2021-30607 Use after free in Permissions
CVE-2021-30608 (severity: HIGH, weakness: CWE-416)
Chromium: CVE-2021-30608 Use after free in Web Share
CVE-2021-30609 (severity: HIGH, weakness: CWE-416)
Chromium: CVE-2021-30609 Use after free in Sign-In
CVE-2021-3061 (severity: HIGH, weakness: CWE-78)
An OS command injection vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables an authenticated administrator with access to the CLI to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers that have Prisma Access 2.1 firewalls are impacted by this issue.
CVE-2021-30610 (severity: HIGH, weakness: CWE-416)
Chromium: CVE-2021-30610 Use after free in Extensions API
CVE-2021-30611 (severity: HIGH, weakness: CWE-416)
Chromium: CVE-2021-30611 Use after free in WebRTC
CVE-2021-30612 (severity: HIGH, weakness: CWE-416)
Chromium: CVE-2021-30612 Use after free in WebRTC
CVE-2021-30613 (severity: HIGH, weakness: CWE-416)
Chromium: CVE-2021-30613 Use after free in Base internals
CVE-2021-30614 (severity: HIGH, weakness: CWE-787)
Chromium: CVE-2021-30614 Heap buffer overflow in TabStrip
CVE-2021-30615 (severity: MEDIUM, weakness: NVD-CWE-Other)
Chromium: CVE-2021-30615 Cross-origin data leak in Navigation
CVE-2021-30616 (severity: HIGH, weakness: CWE-416)
Chromium: CVE-2021-30616 Use after free in Media
CVE-2021-30617 (severity: MEDIUM, weakness: NVD-CWE-Other)
Chromium: CVE-2021-30617 Policy bypass in Blink
CVE-2021-30618 (severity: HIGH, weakness: NVD-CWE-Other)
Chromium: CVE-2021-30618 Inappropriate implementation in DevTools
CVE-2021-30619 (severity: MEDIUM, weakness: CWE-290)
Chromium: CVE-2021-30619 UI Spoofing in Autofill
CVE-2021-3062 (severity: HIGH, weakness: CWE-284)
An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS. Exploitation of this vulnerability enables an attacker to perform any operations allowed by the EC2 role in AWS. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20 VM-Series firewalls; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11 VM-Series firewalls; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14 VM-Series firewalls; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8 VM-Series firewalls. Prisma Access customers are not impacted by this issue.
CVE-2021-30620 (severity: HIGH, weakness: NVD-CWE-Other)
Chromium: CVE-2021-30620 Insufficient policy enforcement in Blink
CVE-2021-30621 (severity: MEDIUM, weakness: CWE-290)
Chromium: CVE-2021-30621 UI Spoofing in Autofill
CVE-2021-30622 (severity: HIGH, weakness: CWE-416)
Chromium: CVE-2021-30622 Use after free in WebApp Installs
CVE-2021-30623 (severity: HIGH, weakness: CWE-416)
Chromium: CVE-2021-30623 Use after free in Bookmarks
CVE-2021-30624 (severity: HIGH, weakness: CWE-416)
Chromium: CVE-2021-30624 Use after free in Autofill
CVE-2021-30625 (severity: HIGH, weakness: CWE-416)
Use after free in Selection API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who convinced the user the visit a malicious website to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-30626 (severity: HIGH, weakness: CWE-787)
Out of bounds memory access in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-30627 (severity: HIGH, weakness: CWE-843)
Type confusion in Blink layout in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-30628 (severity: HIGH, weakness: CWE-787)
Stack buffer overflow in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page.
CVE-2021-30629 (severity: HIGH, weakness: CWE-416)
Use after free in Permissions in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-3063 (severity: HIGH, weakness: CWE-755)
An improper handling of exceptional conditions vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to send specifically crafted traffic to a GlobalProtect interface that causes the service to stop responding. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.21; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h4; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8-h4; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers are not impacted by this issue.
CVE-2021-30630 (severity: MEDIUM, weakness: CWE-346)
Inappropriate implementation in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
CVE-2021-30632 (severity: HIGH, weakness: CWE-787)
Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-30633 (severity: CRITICAL, weakness: CWE-416)
Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVE-2021-30635 (severity: MEDIUM, weakness: CWE-22)
Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-related folder via directory traversal (no customer-specific data is exposed).
CVE-2021-30636 (severity: CRITICAL, weakness: CWE-190)
In MediaTek LinkIt SDK before 4.6.1, there is a possible memory corruption due to an integer overflow during mishandled memory allocation by pvPortCalloc and pvPortRealloc.
CVE-2021-30637 (severity: MEDIUM, weakness: CWE-79)
htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php.
CVE-2021-30638 (severity: HIGH, weakness: CWE-200)
Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to Apache Tapestry 5.6.3; Apache Tapestry 5.7.0 version and Apache Tapestry 5.7.1.
CVE-2021-30639 (severity: HIGH, weakness: CWE-755)
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.
CVE-2021-3064 (severity: CRITICAL, weakness: CWE-121)
A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges. The attacker must have network access to the GlobalProtect interface to exploit this issue. This issue impacts PAN-OS 8.1 versions earlier than PAN-OS 8.1.17. Prisma Access customers are not impacted by this issue.
CVE-2021-30640 (severity: MEDIUM, weakness: CWE-116)
A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.
CVE-2021-30641 (severity: MEDIUM, weakness: NVD-CWE-Other)
Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'
CVE-2021-30642 (severity: CRITICAL, weakness: CWE-78)
An input validation flaw in the Symantec Security Analytics web UI 7.2 prior 7.2.7, 8.1, prior to 8.1.3-NSR3, 8.2, prior to 8.2.1-NSR2 or 8.2.2 allows a remote, unauthenticated attacker to execute arbitrary OS commands on the target with elevated privileges.
CVE-2021-30648 (severity: CRITICAL, weakness: CWE-287)
The Symantec Advanced Secure Gateway (ASG) and ProxySG web management consoles are susceptible to an authentication bypass vulnerability. An unauthenticated attacker can execute arbitrary CLI commands, view/modify the appliance configuration and policy, and shutdown/restart the appliance.
CVE-2021-30650 (severity: MEDIUM, weakness: CWE-79)
A reflected cross-site scripting (XSS) vulnerability in the Symantec Layer7 API Management OAuth Toolkit (OTK) allows a remote attacker to craft a malicious URL for the OTK web UI and target OTK users with phishing attacks or other social engineering techniques. A successful attack allows injecting malicious code into the OTK web UI client application.
CVE-2021-30651 (severity: MEDIUM, weakness: NVD-CWE-Other)
A malicious authenticated SMG administrator user can obtain passwords for external LDAP/Active Directory servers that they might not otherwise be authorized to access.
CVE-2021-30652 (severity: HIGH, weakness: CWE-362)
A race condition was addressed with additional validation. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. A malicious application may be able to gain root privileges.
CVE-2021-30653 (severity: HIGH, weakness: NVD-CWE-Other)
This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing a maliciously crafted image may lead to arbitrary code execution.
CVE-2021-30654 (severity: MEDIUM, weakness: NVD-CWE-Other)
This issue was addressed by removing additional entitlements. This issue is fixed in GarageBand 10.4.3. A local attacker may be able to read sensitive information.
CVE-2021-30655 (severity: CRITICAL, weakness: NVD-CWE-Other)
An application may be able to execute arbitrary code with system privileges. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. The issue was addressed with improved permissions logic.
CVE-2021-30656 (severity: MEDIUM, weakness: NVD-CWE-Other)
An access issue was addressed with improved memory management. This issue is fixed in iOS 14.5 and iPadOS 14.5. A malicious application may be able to determine kernel memory layout.
CVE-2021-30657 (severity: MEDIUM, weakness: CWE-862)
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekeeper checks. Apple is aware of a report that this issue may have been actively exploited..
CVE-2021-30658 (severity: MEDIUM, weakness: CWE-494)
This issue was addressed with improved handling of file metadata. This issue is fixed in macOS Big Sur 11.3. A malicious application may bypass Gatekeeper checks.
CVE-2021-30659 (severity: MEDIUM, weakness: NVD-CWE-Other)
A validation issue was addressed with improved logic. This issue is fixed in iOS 14.5 and iPadOS 14.5, watchOS 7.4, macOS Big Sur 11.3. A malicious application may be able to leak sensitive user information.
CVE-2021-30660 (severity: HIGH, weakness: CWE-125)
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. A malicious application may be able to disclose kernel memory.
CVE-2021-30661 (severity: HIGH, weakness: CWE-416)
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
CVE-2021-30662 (severity: HIGH, weakness: NVD-CWE-Other)
This issue was addressed with improved checks. This issue is fixed in iOS 14.5 and iPadOS 14.5. Processing a maliciously crafted file may lead to arbitrary code execution.
CVE-2021-30663 (severity: HIGH, weakness: CWE-190)
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2021-30664 (severity: HIGH, weakness: CWE-787)
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing a maliciously crafted file may lead to arbitrary code execution.
CVE-2021-30665 (severity: HIGH, weakness: CWE-787)
A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
CVE-2021-30666 (severity: HIGH, weakness: CWE-119)
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
CVE-2021-30667 (severity: MEDIUM, weakness: CWE-287)
A logic issue was addressed with improved validation. This issue is fixed in iOS 14.6 and iPadOS 14.6. An attacker in WiFi range may be able to force a client to use a less secure authentication mechanism.
CVE-2021-30668 (severity: MEDIUM, weakness: CWE-287)
This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4. A person with physical access to a Mac may be able to bypass Login Window during a software update.
CVE-2021-30669 (severity: MEDIUM, weakness: CWE-494)
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A malicious application may bypass Gatekeeper checks.
CVE-2021-30671 (severity: LOW, weakness: CWE-20)
A validation issue was addressed with improved logic. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina. A malicious application may be able to send unauthorized Apple events to Finder.
CVE-2021-30672 (severity: HIGH, weakness: CWE-787)
A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. A malicious application may be able to gain root privileges.
CVE-2021-30673 (severity: MEDIUM, weakness: NVD-CWE-Other)
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina. A malicious application may be able to access a user's call history.
CVE-2021-30674 (severity: MEDIUM, weakness: NVD-CWE-Other)
This issue was addressed with improved checks. This issue is fixed in iOS 14.6 and iPadOS 14.6. A malicious application may disclose restricted memory.
CVE-2021-30675 (severity: HIGH, weakness: CWE-787)
A memory corruption issue was addressed with improved state management. This issue is fixed in Boot Camp 6.1.14. A malicious application may be able to elevate privileges.
CVE-2021-30676 (severity: HIGH, weakness: NVD-CWE-Other)
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A local user may be able to cause unexpected system termination or read kernel memory.
CVE-2021-30677 (severity: HIGH, weakness: NVD-CWE-Other)
This issue was addressed with improved environment sanitization. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave, macOS Big Sur 11.4, watchOS 7.5. A malicious application may be able to break out of its sandbox.
CVE-2021-30678 (severity: CRITICAL, weakness: NVD-CWE-Other)
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.
CVE-2021-30679 (severity: HIGH, weakness: NVD-CWE-Other)
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. An application may be able to gain elevated privileges.
CVE-2021-30680 (severity: HIGH, weakness: NVD-CWE-Other)
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4. A local user may be able to load unsigned kernel extensions.
CVE-2021-30681 (severity: HIGH, weakness: CWE-20)
A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6, Security Update 2021-003 Catalina, macOS Big Sur 11.4, watchOS 7.5. A malicious application may be able to gain root privileges.
CVE-2021-30682 (severity: MEDIUM, weakness: NVD-CWE-Other)
A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious application may be able to leak sensitive user information.
CVE-2021-30683 (severity: HIGH, weakness: CWE-416)
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A malicious application could execute arbitrary code leading to compromise of user information.
CVE-2021-30684 (severity: HIGH, weakness: NVD-CWE-Other)
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina. A remote attacker may cause an unexpected application termination or arbitrary code execution.
CVE-2021-30685 (severity: MEDIUM, weakness: NVD-CWE-Other)
This issue was addressed with improved checks. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Security Update 2021-003 Catalina, macOS Big Sur 11.4, watchOS 7.5. Parsing a maliciously crafted audio file may lead to disclosure of user information.
CVE-2021-30686 (severity: MEDIUM, weakness: CWE-125)
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Security Update 2021-003 Catalina, macOS Big Sur 11.4, watchOS 7.5. Processing a maliciously crafted audio file may disclose restricted memory.
CVE-2021-30687 (severity: MEDIUM, weakness: CWE-125)
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in tvOS 14.6, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6, Security Update 2021-003 Catalina, macOS Big Sur 11.4, watchOS 7.5. Processing a maliciously crafted image may lead to disclosure of user information.
CVE-2021-30688 (severity: HIGH, weakness: NVD-CWE-Other)
A malicious application may be able to break out of its sandbox. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina. A path handling issue was addressed with improved validation.
CVE-2021-30689 (severity: MEDIUM, weakness: CWE-79)
A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content may lead to universal cross site scripting.
CVE-2021-30690 (severity: CRITICAL, weakness: NVD-CWE-Other)
Multiple issues in apache were addressed by updating apache to version 2.4.46. This issue is fixed in Security Update 2021-004 Mojave. Multiple issues in apache.
CVE-2021-30691 (severity: MEDIUM, weakness: NVD-CWE-Other)
An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted USD file may disclose memory contents.
CVE-2021-30692 (severity: MEDIUM, weakness: NVD-CWE-Other)
An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted USD file may disclose memory contents.
CVE-2021-30693 (severity: HIGH, weakness: CWE-20)
A validation issue was addressed with improved logic. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted image may lead to arbitrary code execution.
CVE-2021-30694 (severity: MEDIUM, weakness: NVD-CWE-Other)
An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted USD file may disclose memory contents.
CVE-2021-30695 (severity: MEDIUM, weakness: CWE-125)
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted USD file may disclose memory contents.
CVE-2021-30696 (severity: MEDIUM, weakness: NVD-CWE-Other)
An attacker in a privileged network position may be able to misrepresent application state. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A logic issue was addressed with improved state management.
CVE-2021-30697 (severity: MEDIUM, weakness: NVD-CWE-Other)
A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6, Security Update 2021-003 Catalina, macOS Big Sur 11.4, watchOS 7.5. A local user may be able to leak sensitive user information.
CVE-2021-30698 (severity: HIGH, weakness: CWE-476)
A null pointer dereference was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.4, Safari 14.1.1, iOS 14.6 and iPadOS 14.6. A remote attacker may be able to cause a denial of service.
CVE-2021-30699 (severity: MEDIUM, weakness: NVD-CWE-Other)
A window management issue was addressed with improved state management. This issue is fixed in iOS 14.6 and iPadOS 14.6. A user may be able to view restricted content from the lockscreen.
CVE-2021-30700 (severity: MEDIUM, weakness: NVD-CWE-Other)
This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4, tvOS 14.6, watchOS 7.5, iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted image may lead to disclosure of user information.