CVE-2021-0004
published 2021-08-11CVE-2021-0004: Improper buffer restrictions in the firmware of Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.3.0 may allow a…
PriorityP412medium4.4CVSS 3.1
AVLACLPRHUINSUCNINAH
EPSS
0.26%
17.7th percentile
Improper buffer restrictions in the firmware of Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.3.0 may allow a privileged user to potentially enable denial of service via local access.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | fedora | — | — |
| intel | ethernet_controller_e810_firmware | < 1.5.3.0 | 1.5.3.0 |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p85q-fm7j-ffmp: Improper buffer restrictions in the firmware of Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1
ghsa_unreviewed·2022-05-24
CVE-2021-0004 [MEDIUM] CWE-119 GHSA-p85q-fm7j-ffmp: Improper buffer restrictions in the firmware of Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1
Improper buffer restrictions in the firmware of Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.3.0 may allow a privileged user to potentially enable denial of service via local access.
VMware
VMware ESXi, Workstation, and Fusion updates address multiple security vulnerabilities (CVE-2021-22040, CVE-2021-22041, CVE-2021-22042, CVE-2021-22043, CVE-2021-22050)
vendor_vmware·2022-02-15·CVSS 6.7
CVE-2021-22040 [MEDIUM] VMware ESXi, Workstation, and Fusion updates address multiple security vulnerabilities (CVE-2021-22040, CVE-2021-22041, CVE-2021-22042, CVE-2021-22043, CVE-2021-22050)
VMSA-2022-0004: VMware ESXi, Workstation, and Fusion updates address multiple security vulnerabilities (CVE-2021-22040, CVE-2021-22041, CVE-2021-22042, CVE-2021-22043, CVE-2021-22050)
VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller.VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.4.
CVEs: CVE-2021-22040, CVE-2021-22041, CVE-2021-22042, CVE-2021-22043, CVE-2021-22050
Affected products: Fusion Pro, VMware Cloud Foundation, VMware ESXi, VMware Fusion, VMware Workstation, VMware vSphere, Workstation Player, Workstation Pro
VMware
VMware vRealize Operations updates address Server Side Request Forgery and Arbitrary File Write vulnerabilities (CVE-2021-21975, CVE-2021-21983)
vendor_vmware·2021-03-30·CVSS 7.5
CVE-2021-21975 [HIGH] VMware vRealize Operations updates address Server Side Request Forgery and Arbitrary File Write vulnerabilities (CVE-2021-21975, CVE-2021-21983)
VMSA-2021-0004: VMware vRealize Operations updates address Server Side Request Forgery and Arbitrary File Write vulnerabilities (CVE-2021-21975, CVE-2021-21983)
The vRealize Operations Manager API contains a Server Side Request Forgery. VMware has evaluated this issue to be of 'Important' severity with a maximum CVSSv3 base score of 8.6.
CVEs: CVE-2021-21975, CVE-2021-21983
Affected products: VMware Aria, VMware Cloud Foundation, VMware vRealize
No detection rules found.
Nuclei
Jitsi Meet - Remote Code Execution (Apache Log4j)
nuclei·CVSS 10.0
CVE-2021-44228 [CRITICAL] Jitsi Meet - Remote Code Execution (Apache Log4j)
Jitsi Meet - Remote Code Execution (Apache Log4j)
Jitsi Meet is susceptible to Log4j JNDI remote code execution. Jitsi is a collection of free and open-source multiplatform voice, video conferencing and instant messaging applications for the Web platforms.
Template:
id: jitsi-meet-log4j-rce
info:
name: Jitsi Meet - Remote Code Execution (Apache Log4j)
author: shaikhyaser
severity: critical
description: |
Jitsi Meet is susceptible to Log4j JNDI remote code execution. Jitsi is a collection of free and open-source multiplatform voice, video conferencing and instant messaging applications for the Web platforms.
reference:
- https://github.com/jitsi/security-advisories/blob/4e1ab58585a8a0593efccce77d5d0e22c5338605/advisories/JSA-2021-0004.md
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/
No writeups or analysis indexed.
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IVGBTAQ3N7X3RJRMPD3QZXD76V4HSOEP/https://security.netapp.com/advisory/ntap-20210827-0009/https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00479.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IVGBTAQ3N7X3RJRMPD3QZXD76V4HSOEP/https://security.netapp.com/advisory/ntap-20210827-0009/https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00479.html
2021-08-11
Published