CVE-2021-2000
published 2021-01-20CVE-2021-2000: Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily…
PriorityP49low2.4CVSS 3.1
AVNACLPRHUIRSUCNILAN
EPSS
0.76%
51.3th percentile
Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having SYS Account privilege with network access via Oracle Net to compromise Unified Audit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Unified Audit accessible data. CVSS 3.1 Base Score 2.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N).
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome_chrome | — | — | |
| oracle | database_server | — | — |
| oracle | database_server | — | — |
| oracle | database_server | — | — |
| oracle | database_server | — | — |
| oracle_corporation | database_enterprise_edition | — | — |
| oracle_corporation | database_enterprise_edition | — | — |
| oracle_corporation | database_enterprise_edition | — | — |
| oracle_corporation | database_enterprise_edition | — | — |
| ws_project | ws | >= 5.0.0 < 5.2.3 | 5.2.3 |
| ws_project | ws | >= 6.0.0 < 6.2.2 | 6.2.2 |
| ws_project | ws | >= 7.0.0 < 7.4.6 | 7.4.6 |
CVSS provenance
nvdv3.12.4LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
vendor_oracle2.4LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p6hg-pmvw-h64j: Vulnerability in the Unified Audit component of Oracle Database Server
ghsa_unreviewed·2022-05-24
CVE-2021-2000 [LOW] GHSA-p6hg-pmvw-h64j: Vulnerability in the Unified Audit component of Oracle Database Server
Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having SYS Account privilege with network access via Oracle Net to compromise Unified Audit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Unified Audit accessible data. CVSS 3.1 Base Score 2.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N).
Kernel
Merge tag 'xfs-5.17-merge-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux
kernel_security·2022-01-21
Merge tag 'xfs-5.17-merge-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux
Merge tag 'xfs-5.17-merge-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux
Pull xfs irix ioctl housecleaning from Darrick Wong:
"Remove the XFS_IOC_ALLOCSP* and XFS_IOC_FREESP* ioctl families.
This is the second of a series of small pull requests that perform
some long overdue housecleaning of XFS ioctls. This time, we're
vacating the implementation of all variants of the ALLOCSP and FREESP
ioctls, which are holdovers from EFS in Irix, circa 1993. Roughly
equivalent functionality have been available for both ioctls since
2.6.25 (April 2008):
- XFS_IOC_FREESP ftruncates a file.
- XFS_IOC_ALLOCSP is the equivalent of fallocate.
As noted in the fix patch for CVE 2021-4155, the ALLOCSP ioctl has
been serving up stale disk blocks since 2000, and in 21 years
**nobody** noticed. On those
GHSA
ReDoS in Sec-Websocket-Protocol header
ghsa·2021-05-28
CVE-2021-32640 [MEDIUM] CWE-345 ReDoS in Sec-Websocket-Protocol header
ReDoS in Sec-Websocket-Protocol header
### Impact
A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server.
### Proof of concept
```js
for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
const value = 'b' + ' '.repeat(length) + 'x';
const start = process.hrtime.bigint();
value.trim().split(/ *, */);
const end = process.hrtime.bigint();
console.log('length = %d, time = %f ns', length, end - start);
}
```
### Patches
The vulnerability was fixed in [email protected] (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff) and backported to [email protected] (https://github.com/websockets/ws/commit/78c676d2a1acefbc05292e9f7ea0a9457704bf1b) and [email protected] (https://github.com/websockets/ws/commit/76d47c147900202
Chrome
Stable Channel Update for Desktop: CVE-2025-12435
vendor_chrome·2025-10-28·CVSS 5.4
CVE-2025-12435 [MEDIUM] Stable Channel Update for Desktop: CVE-2025-12435
Stable Channel Update for Desktop
CVE-2025-12435: Incorrect security UI in Omnibox. Reported by Hafiizh on 2025-09-21 [$2000][ 40054742 ] Medium CVE-2025-12436: Policy bypass in Extensions
Reported by Luan Herrera (@lbherrera_) on 2021-02-08 [$2000][ 446294487 ] Medium CVE-2025-12437: Use after free in PageInfo
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2023-1231
vendor_chrome·2023-03-07·CVSS 4.3
CVE-2023-1231 [MEDIUM] Stable Channel Update for Desktop: CVE-2023-1231
Stable Channel Update for Desktop
CVE-2023-1231: Inappropriate implementation in Autofill. Reported by Kirtikumar Anandrao Ramchandani via Yan Zhu of Brave on 2021-11-30 [$3000][ 813542 ] Low CVE-2023-2314: Insufficient data validation in DevTools
Reported by Rob Wu on 2018-02-19 [$2000][ 1346924 ] Low CVE-2023-1232: Insufficient policy enforcement in Resource Timing
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2022-1856
vendor_chrome·2022-05-24·CVSS 8.8
CVE-2022-1856 [HIGH] Stable Channel Update for Desktop: CVE-2022-1856
Stable Channel Update for Desktop
CVE-2022-1856: Use after free in User Education. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-05-06 [$2000][ 1227995 ] High CVE-2022-1857: Insufficient policy enforcement in File System API
Reported by Daniel Rhea on 2021-07-11 [$1000][ 1314310 ] High CVE-2022-1858: Out of bounds read in DevTools
Severity: high
Chrome
Stable Channel Update for Desktop: CVE-2022-1136
vendor_chrome·2022-03-29·CVSS 8.8
CVE-2022-1136 [MEDIUM] Stable Channel Update for Desktop: CVE-2022-1136
Stable Channel Update for Desktop
CVE-2022-1136: Use after free in Tab Strip . Reported by Krace on 2021-12-15 [$5000][ 1289846 ] Medium CVE-2022-1137: Inappropriate implementation in Extensions
Reported by Thomas Orlita on 2022-01-22 [$2000][ 1246188 ] Medium CVE-2022-1138: Inappropriate implementation in Web Cursor
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2022-0803
vendor_chrome·2022-03-01·CVSS 6.5
CVE-2022-0803 [MEDIUM] Stable Channel Update for Desktop: CVE-2022-0803
Stable Channel Update for Desktop
CVE-2022-0803: Inappropriate implementation in Permissions. Reported by Abdulla Aldoseri on 2021-12-15 [$2500][ 1264561 ] Medium CVE-2022-0804: Inappropriate implementation in Full screen mode
Reported by Irvan Kurniawan (sourc7) on 2021-10-29 [$2000][ 1290700 ] Medium CVE-2022-0805: Use after free in Browser Switcher
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2021-38017
vendor_chrome·2021-11-15·CVSS 8.8
CVE-2021-38017 [MEDIUM] Stable Channel Update for Desktop: CVE-2021-38017
Stable Channel Update for Desktop
CVE-2021-38017: Insufficient policy enforcement in iframe sandbox. Reported by NDevTK on 2021-10-05 [$2000][ 1197889 ] Medium CVE-2021-38018: Inappropriate implementation in navigation
Reported by Alesandro Ortiz on 2021-04-11 [$1000][ 1251179 ] Medium CVE-2021-38019: Insufficient policy enforcement in CORS
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2021-38008
vendor_chrome·2021-11-15·CVSS 8.8
CVE-2021-38008 [HIGH] Stable Channel Update for Desktop: CVE-2021-38008
Stable Channel Update for Desktop
CVE-2021-38008: Use after free in media. Reported by Marcin Towalski of Cisco Talos on 2021-10-26 [$2000][ 1260649 ] High CVE-2021-38009: Inappropriate implementation in cache
Reported by Luan Herrera (@lbherrera_) on 2021-10-16 [$NA][ 1240593 ] High CVE-2021-38006: Use after free in storage foundation
Severity: high
Chrome
Stable Channel Update for Desktop: CVE-2021-37987
vendor_chrome·2021-10-19·CVSS 8.8
CVE-2021-37987 [MEDIUM] Stable Channel Update for Desktop: CVE-2021-37987
Stable Channel Update for Desktop
CVE-2021-37987: Use after free in Network APIs. Reported by Yangkang (@dnpushme) of 360 ATA on 2021-05-08 [$5000][ 1228248 ] Medium CVE-2021-37988 : Use after free in Profiles
Reported by raven (@raid_akame) on 2021-07-12 [$2000][ 1233067 ] Medium CVE-2021-37989 : Inappropriate implementation in Blink
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2021-21209
vendor_chrome·2021-04-14·CVSS 6.5
CVE-2021-21209 [MEDIUM] Stable Channel Update for Desktop: CVE-2021-21209
Stable Channel Update for Desktop
CVE-2021-21209: Inappropriate implementation in storage. Reported by Tom Van Goethem ( @tomvangoethem) on 2020-10-29 [$3000][ 1184562 ] Medium CVE-2021-21210: Inappropriate implementation in Network
Reported by @bananabr on 2021-03-04 [$2000][ 1103119 ] Medium CVE-2021-21211: Inappropriate implementation in Navigation
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2021-21135
vendor_chrome·2021-01-19·CVSS 6.5
CVE-2021-21135 [MEDIUM] Stable Channel Update for Desktop: CVE-2021-21135
Stable Channel Update for Desktop
CVE-2021-21135: Inappropriate implementation in Performance API. Reported by ndevtk on 2020-12-11 [$2000][ 1038002 ] Low CVE-2021-21136: Insufficient policy enforcement in WebView
Reported by Shiv Sahni, Movnavinothan V and Imdad Mohammed on 2019-12-27 [$500][ 1093791 ] Low CVE-2021-21137: Inappropriate implementation in DevTools
Severity: medium
Oracle
Oracle Oracle Database Server Risk Matrix: Unified Audit — CVE-2021-2000
vendor_oracle·2021-01-15·CVSS 2.4
CVE-2021-2000 [LOW] Oracle Oracle Database Server Risk Matrix: Unified Audit — CVE-2021-2000
Oracle Oracle Database Server Risk Matrix: Unified Audit vulnerability
CVE: CVE-2021-2000
CVSS: 2.4
Protocol: Oracle Net
Remote exploit: No
Affected versions: Network
Advisory: cpujan2021 (JAN 2021)
Suricata
ET EXPLOIT Possible Realtek SDK - formRebootCheck/formWsc Stack Buffer Overflow Inbound (CVE-2021-35392)
suricata·2021-08-30·CVSS 7.5
CVE-2021-35392 [HIGH] ET EXPLOIT Possible Realtek SDK - formRebootCheck/formWsc Stack Buffer Overflow Inbound (CVE-2021-35392)
ET EXPLOIT Possible Realtek SDK - formRebootCheck/formWsc Stack Buffer Overflow Inbound (CVE-2021-35392)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Realtek SDK - formRebootCheck/formWsc Stack Buffer Overflow Inbound (CVE-2021-35392)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/goform/"; pcre:"/^form(RebootCheck|Wsc)$/R"; http.request_body; content:"submit-url="; fast_pattern; isdataat:2000,relative; reference:url,www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain/; reference:cve,2021-35392; classtype:attempted-user; sid:2033837; rev:1; metadata:attack_target Server, created_at 2021_08_30, cve CVE_2021_35392, deployment Perimeter, deployment Internal, confidence Medium, signature_severi
No writeups or analysis indexed.
2021-01-20
Published