Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-35963 State: PUBLISHED Published: 2021-07-19T11:55:38.082534Z Last Updated: 2024-09-17T01:41:56.794Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Learningdigital.com, Inc. Products: Orca HCM Problem Types: CWE-434 Description: The specific parameter of upload function of the Orca HCM digital learning platform does not filter file format, which allows remote unauthenticated attackers to upload files containing malicious script to execute RCE attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4923-d68e6-1.html - https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25
CVE ID: CVE-2021-35964 State: PUBLISHED Published: 2021-07-19T11:55:40.300848Z Last Updated: 2024-09-16T23:11:42.591Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Learningdigital.com, Inc. Products: Orca HCM Problem Types: CWE-285 Description: The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management function without logging in, access members’ information, modify and delete the courses in system, thus causing users fail to access the learning content. Additional Analyst Notes: - CVE Program Container: References: - https://www.chtsecurity.com/news/ba7b3ae7-1
ng content. Additional Analyst Notes: - CVE Program Container: References: - https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25 - https://www.twcert.org.tw/tw/cp-132-4924-f74d5-1.html
CVE ID: CVE-2021-35965 State: PUBLISHED Published: 2021-07-19T11:55:41.987303Z Last Updated: 2024-09-17T01:11:36.678Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Learningdigital.com, Inc. Products: Orca HCM Problem Types: CWE-522 Description: The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text, thus remote attackers can obtain administrator’s privilege without logging in. Additional Analyst Notes: - CVE Program Container: References: - https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25 - https://www.twcert.org.tw/tw/cp-132-4925-
ces: - https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25 - https://www.twcert.org.tw/tw/cp-132-4925-86733-1.html
CVE ID: CVE-2021-35966 State: PUBLISHED Published: 2021-07-19T11:55:43.534568Z Last Updated: 2024-09-16T17:54:15.142Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Learningdigital.com, Inc. Products: Orca HCM Problem Types: CWE-601 Description: The specific function of the Orca HCM digital learning platform does not filter input parameters properly, which causing the URL can be redirected to any website. Remote attackers can use the vulnerability to execute phishing attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25 - https://www.twcert.org.tw/tw/cp-132-4926-dc06b-
https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25 - https://www.twcert.org.tw/tw/cp-132-4926-dc06b-1.html
CVE ID: CVE-2021-35967 State: PUBLISHED Published: 2021-07-19T11:55:45.090296Z Last Updated: 2024-09-16T16:27:48.675Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Learningdigital.com, Inc. Products: Orca HCM Problem Types: CWE-22 Description: The directory page parameter of the Orca HCM digital learning platform does not filter special characters. Remote attackers can access the system directory thru Path Traversal without logging in. Additional Analyst Notes: - CVE Program Container: References: - https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25 - https://www.twcert.org.tw/tw/cp-132-4927-bbf01-1.html
CVE ID: CVE-2021-35968 State: PUBLISHED Published: 2021-07-19T11:55:47.851205Z Last Updated: 2024-09-17T01:01:11.960Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Learningdigital.com, Inc. Products: Orca HCM Problem Types: CWE-22 Description: The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system directory thru Path Traversal with users’ privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25 - https://www.twcert.org.tw/tw/cp-132-4928-7e87b-1.html
CVE ID: CVE-2021-35969 State: PUBLISHED Published: 2022-01-15T16:25:42 Last Updated: 2024-08-04T00:47:42.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pexip Infinity before 26 allows temporary remote Denial of Service (abort) because of missing call-setup input validation. Additional Analyst Notes: - CVE Program Container: References: - https://docs.pexip.com/admin/security_bulletins.htm
CVE ID: CVE-2021-35970 State: PUBLISHED Published: 2021-06-30T14:18:10 Last Updated: 2024-08-04T00:47:43.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permission checks use an incorrect data type. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/coralproject/talk/issues/3600 - https://github.com/coralproject/talk/pull/3599 - https://docs.coralproject.net/coral/api/graphql/#User - https://github.com/coralproject/talk/compare/v4.12.0...v4.12.1
CVE ID: CVE-2021-35971 State: PUBLISHED Published: 2021-06-30T14:28:51 Last Updated: 2024-08-04T00:47:43.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft .NET remoting. Additional Analyst Notes: - CVE Program Container: References: - https://www.veeam.com/kb4126 - https://www.veeam.com/kb4180
CVE ID: CVE-2021-35973 State: PUBLISHED Published: 2021-06-30T14:41:04 Last Updated: 2024-08-04T00:47:43.087Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: NETGEAR WAC104 devices before 1.0.4.15 are affected by an authentication bypass vulnerability in /usr/sbin/mini_httpd, allowing an unauthenticated attacker to invoke any action by adding the &currentsetting.htm substring to the HTTP query, a related issue to CVE-2020-27866. This directly allows the attacker to change the web UI password, and eventually to enable debug mode (telnetd) and gain a shell on the device as the admin limited-user account (howe
rd, and eventually to enable debug mode (telnetd) and gain a shell on the device as the admin limited-user account (however, escalation to root is simple because of weak permissions on the /etc/ directory). Additional Analyst Notes: - CVE Program Container: References: - https://gynvael.coldwind.pl/?lang=en&id=736 - https://kb.netgear.com/000063785/Security-Advisory-for-Authentication-Bypass-on-WAC104-PSV-2021-0075
CVE ID: CVE-2021-35975 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-08-04T00:47:43.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute path traversal vulnerability in the Systematica SMTP Adapter component (up to v2.0.1.101) in Systematica Radius (up to v.3.9.256.777) allows remote attackers to read arbitrary files via a full pathname in GET parameter "file" in URL. Also: affected components in same product - HTTP Adapter (up to v.1.8.0.15), MSSQL MessageBus Proxy (up to v.1.1.06), Financial Calculator (up to v.1.3.05), FIX Adapter (up to v.2.4.0.25) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fbkcs/CVE-2021-3
(up to v.2.4.0.25) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fbkcs/CVE-2021-35975
CVE ID: CVE-2021-35976 State: PUBLISHED Published: 2021-09-10T11:08:18 Last Updated: 2024-08-04T00:47:43.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62467. The attacker could execute JavaScript code in the victim's browser by using the link to preview sites hosted on the server. Authentication is not required to exploit the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.bouali.io/cves/cve-2021-35976 - https://support.plesk.com/hc/en-us/articles/4402990507026 - https://tare
: - https://www.bouali.io/cves/cve-2021-35976 - https://support.plesk.com/hc/en-us/articles/4402990507026 - https://tarekbouali.com/cves/cve-2021-35976
CVE ID: CVE-2021-35977 State: PUBLISHED Published: 2021-10-08T14:19:04 Last Updated: 2024-08-04T00:47:43.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Digi RealPort for Windows through 4.8.488.0. A buffer overflow exists in the handling of ADDP discovery response messages. This could result in arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt
CVE ID: CVE-2021-35978 State: PUBLISHED Published: 2021-12-10T12:18:39 Last Updated: 2024-08-04T00:47:42.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows arbitrary remote command execution with SUPER privileges. This allows an attacker (with knowledge of the protocol) to execute arbitrary code on the controller including overwriting firmware, adding/removing users, disabling the internal firewall, etc. Additional Analyst Notes: - CVE Program Container: References: - https://digi.com - https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt
CVE ID: CVE-2021-35979 State: PUBLISHED Published: 2021-10-08T14:21:22 Last Updated: 2024-08-04T00:47:42.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Digi RealPort through 4.8.488.0. The 'encrypted' mode is vulnerable to man-in-the-middle attacks and does not perform authentication. Additional Analyst Notes: - CVE Program Container: References: - https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt
CVE ID: CVE-2021-35980 State: PUBLISHED Published: 2023-09-06T13:08:07.188Z Last Updated: 2024-08-04T00:47:43.331Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-22 Description: Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Path traversal vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program
CVE ID: CVE-2021-35981 State: PUBLISHED Published: 2021-08-20T18:10:07.447087Z Last Updated: 2024-09-16T17:14:27.832Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-416 Description: Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Pro
CVE ID: CVE-2021-35982 State: PUBLISHED Published: 2021-09-29T15:36:38.931877Z Last Updated: 2024-09-16T19:30:38.219Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-427 Description: Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an Uncontrolled Search Path Element vulnerability. A local attacker with non-administrative privileges can plant a malicious DLL to achieve arbitrary code execution in the context of the current user via DLL hijacking. Exploitation of this issue requires user interaction. Additional Analyst Notes: -
of the current user via DLL hijacking. Exploitation of this issue requires user interaction. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat/apsb21-55.html
CVE ID: CVE-2021-35983 State: PUBLISHED Published: 2021-08-20T18:10:05.619326Z Last Updated: 2024-09-17T00:40:37.527Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-416 Description: Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Pro
CVE ID: CVE-2021-35984 State: PUBLISHED Published: 2021-08-20T18:10:10.113685Z Last Updated: 2024-09-16T17:18:20.212Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-476 Description: Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Null pointer dereference vulnerability. An authenticated attacker could leverage this vulnerability achieve an application denial-of-service in the context of the current user. Exploitation of this issue does not requires user interaction. Additional Analyst Notes: - CVE Program Container: Refer
Exploitation of this issue does not requires user interaction. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE ID: CVE-2021-35985 State: PUBLISHED Published: 2021-08-20T18:10:06.536155Z Last Updated: 2024-09-16T16:12:43.766Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-476 Description: Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analy
user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE ID: CVE-2021-35986 State: PUBLISHED Published: 2021-08-20T18:10:08.345956Z Last Updated: 2024-09-16T23:25:45.679Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-843 Description: Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Type Confusion vulnerability. An unauthenticated attacker could leverage this vulnerability to read arbitrary system information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Pro
of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat/apsb21-51.html - https://www.zerodayinitiative.com/advisories/ZDI-21-1145/
CVE ID: CVE-2021-35987 State: PUBLISHED Published: 2021-08-20T18:10:09.217537Z Last Updated: 2024-09-17T00:15:46.022Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-125 Description: Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: -
itation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE ID: CVE-2021-35988 State: PUBLISHED Published: 2021-08-20T18:10:11.044635Z Last Updated: 2024-09-17T00:25:32.948Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-125 Description: Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: -
CVE ID: CVE-2021-35989 State: PUBLISHED Published: 2021-08-20T18:10:11.986Z Last Updated: 2025-04-23T19:38:57.752Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Bridge Problem Types: CWE-787 Description: Adobe Bridge version 11.0.2 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refer
t a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/bridge/apsb21-53.html
CVE ID: CVE-2021-35990 State: PUBLISHED Published: 2021-08-20T18:10:14.792Z Last Updated: 2025-04-23T19:38:43.833Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Bridge Problem Types: CWE-787 Description: Adobe Bridge version 11.0.2 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refer
CVE ID: CVE-2021-35991 State: PUBLISHED Published: 2021-08-20T18:10:12.884960Z Last Updated: 2024-09-17T00:52:27.719Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Bridge Problem Types: CWE-824 Description: Adobe Bridge version 11.0.2 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References:
interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/bridge/apsb21-53.html
CVE ID: CVE-2021-35992 State: PUBLISHED Published: 2021-08-20T18:10:15.726Z Last Updated: 2025-04-23T19:38:37.406Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Bridge Problem Types: CWE-125 Description: Adobe Bridge version 11.0.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/bridge/apsb21-53.html
CVE ID: CVE-2021-35993 State: PUBLISHED Published: 2021-09-02T17:00:21.625Z Last Updated: 2025-04-23T19:29:24.689Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: After Effects Problem Types: CWE-787 Description: Adobe After Effects version 18.2.1 (and earlier) is affected by an out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
raction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/after_effects/apsb21-54.html
CVE ID: CVE-2021-35994 State: PUBLISHED Published: 2021-09-02T17:00:41.494Z Last Updated: 2025-04-23T19:29:08.205Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: After Effects Problem Types: CWE-787 Description: Adobe After Effects version 18.2.1 (and earlier) is affected by an out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
CVE ID: CVE-2021-35995 State: PUBLISHED Published: 2021-09-02T17:00:27.748Z Last Updated: 2025-04-23T19:29:16.609Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: After Effects Problem Types: CWE-20 Description: Adobe After Effects version 18.2.1 (and earlier) is affected by an Improper input validation vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA
user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/after_effects/apsb21-54.html