漏洞快報
正在遭實際利用的漏洞(CISA KEV)依最新排序。每個 CVE 均附上利用機率(EPSS)與嚴重程度(CVSS)，從防禦視角協助你判斷「是否需要立即修復」的資訊流。
A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited..
KEV 收錄: 2021-11-03官方(NVD) →This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing maliciously crafted web content may lead to universal cross site scripting. Apple is aware of a report that this issue may have been actively exploited..
KEV 收錄: 2021-11-03官方(NVD) →Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
KEV 收錄: 2021-11-03官方(NVD) →In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode.
KEV 收錄: 2021-11-03官方(NVD) →Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability
KEV 收錄: 2021-11-03官方(NVD) →Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
KEV 收錄: 2021-11-03官方(NVD) →Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability
KEV 收錄: 2021-11-03官方(NVD) →A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5, watchOS 5.3.7. Processing a maliciously crafted mail message may lead to heap corruption.
KEV 收錄: 2021-11-03官方(NVD) →<p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, the attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers, and then convince a user to view the website. The attacker could also take advantage of compromised websites, or websites that accept or host user-provided content or advertisements, by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically via an enticement in email or instant message, or by getting them to open an email attachment.</p> <p>The security update addresses the vulnerability by modifying how Microsoft browsers handle objects in memory.</p>
KEV 收錄: 2021-11-03官方(NVD) →
優先順序 = KEV(正在遭實際利用) ＋ EPSS(30 天內遭利用的機率) ＋ CVSS(嚴重程度) 的綜合。本資訊流以防禦為目的，不涉及攻擊程式碼或 PoC。各 CVE 的詳情連結至官方來源(NVD)。