This is a list of recent vulnerabilities for which exploits are available.
CVE, Title, Vendor
Description
CVSS v3.1 Base Score
Date Created
Date Updated
CVE, Title, Vendor
Description
CVSS v3.1 Base Score
Date Created
Date Updated
CVE-2020-14871
Remote Code Execution Vulnerability in Oracle Solaris
Oracle
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris.
10 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
10/21/2020
06/22/2021
CVE-2020-14871
Buffer Overflow Vulnerability in Oracle Solaris
Oracle
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases.
10 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
10/21/2020
06/22/2021
CVE-2021-31950
Remote Code Execution Vulnerability in Microsoft Sharepoint
Microsoft
Microsoft SharePoint Server Spoofing Vulnerability This CVE ID is unique from CVE-2021-31948, CVE-2021-31964.
Base Score: 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
06/08/2021
06/15/2021
CVE-2013-4988
Buffer Overflow Vulnerability in IcoFX
Icofx
Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCount value in an ICONDIR structure in an ICO file. NOTE: some of these details are obtained from third party information.
9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
12/13/2013
06/07/2021
CVE-2020-13927
Weak Authentication Vulnerability in Apache Airflow
Apache
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/apache-airflow/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
11/10/2020
06/02/2021
CVE-2020-11978
Code Injection Vulnerability in Apache Airflow
Apache
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
