CVE-2021-35053

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Possible system denial of service in case of arbitrary changing Firefox browser parameters. An attacker could change specific Firefox browser parameters file in a certain way and then reboot the system to make the system unbootable.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
n/a	Kaspersky Endpoint Security for Windows	KES versions from 11.1 to 11.6 (inclusively)

References

https://support.kaspersky.com/general/vulnerability.aspx?el=12430#01112021Broken Link
https://www.zerodayinitiative.com/advisories/ZDI-21-1280/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-431/Third Party Advisory, VDB Entry
https://support.kaspersky.com/general/vulnerability.aspx?el=12430#01112021Broken Link
https://www.zerodayinitiative.com/advisories/ZDI-21-1280/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-431/Third Party Advisory, VDB Entry

Timeline

Published: Nov 3, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-350547.5Minecraft before 1.17.1, when online-mode=false is configured, allows path traversal for deletion of arbitrary JSON files.CVE-2021-350558.8MediaTek microchips, as used in NETGEAR devices through 2021-11-11 and other devices, mishandle the WPS (Wi-Fi Protected Setup) protocol. (A CVE-2021-350566.7Unisys Stealth 5.1 before 5.1.025.0 and 6.0 before 6.0.055.0 has an unquoted Windows search path for a scheduled task. An unintended executa CVE-2021-350596.1OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way4acs/enroll action parameter.CVE-2021-35067.1An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. CVE-2021-350605.3/way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whethe CVE-2021-350616.1Multiple cross-site scripting (XSS) vulnerabilities in DRK Odenwaldkreis Testerfassung March-2021 allow remote attackers to inject arbitrary CVE-2021-350628.1A Shell Metacharacter Injection vulnerability in result.php in DRK Odenwaldkreis Testerfassung March-2021 allow an attacker with a valid tok CVE-2021-350637.5Suricata before 5.0.7 and 6.x before 6.0.3 has a "critical evasion."CVE-2021-350649.8KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits running of multiple dang CVE-2021-350657.5The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular e CVE-2021-350669.8An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132.