위협 피드

• CVE-2021-1782긴급CVSS7.0EPSS 2%KEV

  A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited..

  KEV 등재: 2021-11-03공식(NVD) →
• CVE-2021-1879긴급CVSS6.1EPSS 7%KEV

  This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing maliciously crafted web content may lead to universal cross site scripting. Apple is aware of a report that this issue may have been actively exploited..

  KEV 등재: 2021-11-03공식(NVD) →
• CVE-2021-38000긴급CVSS6.1EPSS 5%KEV

  Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.

  KEV 등재: 2021-11-03공식(NVD) →
• CVE-2021-27562긴급CVSS5.5EPSS 3%KEV

  In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode.

  KEV 등재: 2021-11-03공식(NVD) →
• CVE-2021-31199긴급CVSS5.2EPSS 3%KEV

  Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

  KEV 등재: 2021-11-03공식(NVD) →
• CVE-2021-1906긴급CVSS5.5EPSS 1%KEV

  Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

  KEV 등재: 2021-11-03공식(NVD) →
• CVE-2021-31201긴급CVSS5.2EPSS 3%KEV

  Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

  KEV 등재: 2021-11-03공식(NVD) →
• CVE-2020-9819긴급CVSS4.3EPSS 2%KEV

  A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5, watchOS 5.3.7. Processing a maliciously crafted mail message may lead to heap corruption.

  KEV 등재: 2021-11-03공식(NVD) →
• CVE-2020-0878긴급CVSS4.2EPSS 3%KEV랜섬웨어

  <p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, the attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers, and then convince a user to view the website. The attacker could also take advantage of compromised websites, or websites that accept or host user-provided content or advertisements, by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically via an enticement in email or instant message, or by getting them to open an email attachment.</p> <p>The security update addresses the vulnerability by modifying how Microsoft browsers handle objects in memory.</p>

  KEV 등재: 2021-11-03공식(NVD) →

우선순위 = KEV(실제로 악용 중) + EPSS(30일 이내 악용될 확률) + CVSS(심각도)의 종합. 방어를 목적으로 한 피드이며, 공격 코드나 PoC는 다루지 않습니다. 각 CVE는 공식 출처(NVD)로 연결됩니다.