Security Vulnerabilities - CVEs Published In July 2021
MagicMotion Flamingo 2 has a lack of access control for reading from device descriptors.
CVSS Score
4.6
EPSS Score
0.003
Published
2021-07-15
MagicMotion Flamingo 2 lacks BLE encryption, enabling data sniffing and packet forgery.
CVSS Score
5.3
EPSS Score
0.002
Published
2021-07-15
The MagicMotion Flamingo 2 application for Android stores data on an sdcard under com.vt.magicmotion/files/Pictures, whence it can be read by other applications.
CVSS Score
7.5
EPSS Score
0.007
Published
2021-07-15
Acronis True Image 2019 update 1 through 2020 on macOS allows local privilege escalation due to an insecure XPC service configuration.
CVSS Score
7.8
EPSS Score
0.003
Published
2021-07-15
Acronis True Image through 2021 on macOS allows local privilege escalation from admin to root due to insecure folder permissions.
CVSS Score
6.7
EPSS Score
0.003
Published
2021-07-15
Acronis True Image 2019 update 1 through 2021 update 1 on macOS allows local privilege escalation due to an insecure XPC service configuration.
CVSS Score
7.8
EPSS Score
0.022
Published
2021-07-15
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a read-ony user's credentials, an attacker can view most attributes of all config objects including `ticket_salt` of `ApiListener`. This salt is enough to compute a ticket for every possible common name (CN). A ticket, the master node's certificate, and a self-signed certificate are enough to successfully request the desired certificate from Icinga. That certificate may in turn be used to steal an endpoint or API user's identity. Versions 2.12.5 and 2.11.10 both contain a fix the vulnerability. As a workaround, one may either specify queryable types explicitly or filter out ApiListener objects.
CVSS Score
8.8
EPSS Score
0.011
Published
2021-07-15
iDrive RemotePC before 7.6.48 on Windows allows authentication bypass. A remote and unauthenticated attacker can bypass cloud authentication to connect and control a system via TCP port 5970 and 5980.
CVSS Score
9.8
EPSS Score
0.012
Published
2021-07-15
iDrive RemotePC before 4.0.1 on Linux allows denial of service. A remote and unauthenticated attacker can disconnect a valid user session by connecting to an ephemeral port.
CVSS Score
7.5
EPSS Score
0.01
Published
2021-07-15
iDrive RemotePC before 7.6.48 on Windows allows privilege escalation. A local and low-privileged user can force RemotePC to execute an attacker-controlled executable with SYSTEM privileges.
CVSS Score
7.8
EPSS Score
0.003
Published
2021-07-15