CVSS: 9.3EPSS: 0%CPEs: 6EXPL: 0CVE-2021-30720 – webkitgtk: Logic issue allowing access to restricted ports on arbitrary servers
https://notcve.org/view.php?id=CVE-2021-30720
26 May 2021 — A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious website may be able to access restricted ports on arbitrary servers. Se abordó un problema lógico con restricciones mejoradas. Este problema se corrigió en tvOS versión 14.6, iOS versión 14.6 e iPadOS versión 14.6, Safari versión 14.1.1, macOS Big Sur versión 11.4, watchOS versión 7.5. • https://support.apple.com/en-us/HT212528 • CWE-20: Improper Input Validation CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-30734 – Apple Safari Integer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-30734
26 May 2021 — Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content may lead to arbitrary code execution. Se abordaron múltiples problemas de corrupción de la memoria con un manejo de la memoria mejorada. Este problema se corrigió en tvOS versión 14.6, iOS versión 14.6 e iPadOS versión 14.6, Safari versión 14.1.1, macOS Big Sur versión 11.4, watch... • https://support.apple.com/en-us/HT212528 • CWE-20: Improper Input Validation CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 0%CPEs: 6EXPL: 0CVE-2021-30744 – webkitgtk: Cross-origin issue with iframe elements leading to universal cross site scripting attack
https://notcve.org/view.php?id=CVE-2021-30744
26 May 2021 — Description: A cross-origin issue with iframe elements was addressed with improved tracking of security origins. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content may lead to universal cross site scripting. Descripción: Se abordó un problema de origen cruzado con elementos iframe con un seguimiento de los orígenes de seguridad mejorados. Este problema se corrigió en tvOS versión 14.6, iOS versión 14.6 e iPad... • https://support.apple.com/en-us/HT212528 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-30749 – Apple WebKit KeyframeEffect Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-30749
26 May 2021 — Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content may lead to arbitrary code execution. Se abordaron múltiples problemas de corrupción de la memoria con una administración de memoria mejorada. Este problema se corrigió en tvOS versión 14.6, iOS versión 14.6 e iPadOS versión 14.6, Safari versión 14.1.1, macOS Big Sur versión 11.4,... • https://support.apple.com/en-us/HT212528 • CWE-20: Improper Input Validation CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-30663 – Apple Multiple Products WebKit Integer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2021-30663
04 May 2021 — An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Se abordó un desbordamiento de enteros con una comprobación de entrada mejorada. Este problema es corregido en iOS versión 14.5.1 y iPadOS versión 14.5.1, tvOS versión 14.6, iOS versión 12.5.3, Safari versión 14.1.1, macOS Big Sur versión 11.3.1. • https://support.apple.com/en-us/HT212335 • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 0%CPEs: 7EXPL: 0CVE-2021-30661 – Apple Multiple Products WebKit Storage Use-After-Free Vulnerability
https://notcve.org/view.php?id=CVE-2021-30661
28 Apr 2021 — A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.. Se abordó un problema de uso de la memoria previamente liberada con una administración de la memoria mejorada. • https://support.apple.com/en-us/HT212317 • CWE-20: Improper Input Validation CWE-416: Use After Free •
CVSS: 8.1EPSS: 0%CPEs: 8EXPL: 0CVE-2021-1825 – webkitgtk: Input validation issue leading to cross site scripting attack
https://notcve.org/view.php?id=CVE-2021-1825
28 Apr 2021 — An input validation issue was addressed with improved input validation. This issue is fixed in iTunes 12.11.3 for Windows, iCloud for Windows 12.3, macOS Big Sur 11.3, Safari 14.1, watchOS 7.4, tvOS 14.5, iOS 14.5 and iPadOS 14.5. Processing maliciously crafted web content may lead to a cross site scripting attack. Se abordó un problema de comprobación de entradas con una comprobación de entrada mejorada. Este problema se corrigió en iTunes versión 12.11.3 para Windows, iCloud para Windows versión 12.3, mac... • https://support.apple.com/en-us/HT212317 • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 34EXPL: 0CVE-2020-7463 – Apple Security Advisory 2021-04-26-2
https://notcve.org/view.php?id=CVE-2020-7463
26 Mar 2021 — In FreeBSD 12.1-STABLE before r364644, 11.4-STABLE before r364651, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, improper handling in the kernel causes a use-after-free bug by sending large user messages from multiple threads on the same SCTP socket. The use-after-free situation may result in unintended kernel behaviour including a kernel panic. En FreeBSD versiones 12.1-STABLE anteriores a r364644, 11.4-STABLE anteriores a r364651, 12.1-RELEASE anteriores a p9, 11.4-RELEASE a... • http://seclists.org/fulldisclosure/2021/Apr/49 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2021-1844 – webkitgtk: Memory corruption issue leading to arbitrary code execution
https://notcve.org/view.php?id=CVE-2021-1844
09 Mar 2021 — A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and iPadOS 14.4.1, Safari 14.0.3 (v. 14610.4.3.1.7 and 15610.4.3.1.7), watchOS 7.3.2, macOS Big Sur 11.2.3. Processing maliciously crafted web content may lead to arbitrary code execution. Se abordó un problema de corrupción de memoria con una comprobación mejorada. Este problema es corregido en iOS versión 14.4.1 y iPadOS versión 14.4.1, Safari versión 14.0.3 (versiones v.14610.4.3.1.7 y 15610.4.3.1.7),... • http://seclists.org/fulldisclosure/2021/Apr/55 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 5.9EPSS: 0%CPEs: 38EXPL: 2CVE-2021-23841 – Null pointer deref in X509_issuer_and_serial_hash()
https://notcve.org/view.php?id=CVE-2021-23841
16 Feb 2021 — The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never di... • https://github.com/Trinadh465/external_boringssl_openssl_1.1.0g_CVE-2021-23841 • CWE-476: NULL Pointer Dereference •