Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ews/secadv/20210216.txt - https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1 - https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2 - https://www.debian.org/security/2021/dsa-4855 - https://security.gentoo.org/glsa/202103-03 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.tenable.com/security/tns-2021-10 - https://www.tenable.com/security/tns-2021-09 - https://security.netapp.com/advisory/ntap-20210219-0009/ - https://www.tenable.com/security/tns-2021-03 - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.b
s-2021-03 - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E - https://www.oracle.com//security-alerts/cpujul2021.html - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://kc.mcafee.com/corporate/index?page=content&id=SB10366 - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389
.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2021-23841 State: PUBLISHED Published: 2021-02-16T16:55:18.817258Z Last Updated: 2024-09-16T22:39:57.576Z Vendors: OpenSSL Products: OpenSSL Problem Types: NULL pointer dereference Description: The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_
n a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed
dates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.openssl.org/news/secadv/20210216.txt - https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=122a19ab48091c657f7cb1fb3af9fc07bd557bbf - https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8252ee4d90f3f2004d3d0aeeed003ad49c9a7807 - https://www.debian.org/security/2021/dsa-4855 - https://security.gentoo.org/glsa/202103-03 - http://seclists.org/fulldisclosure/202
.debian.org/security/2021/dsa-4855 - https://security.gentoo.org/glsa/202103-03 - http://seclists.org/fulldisclosure/2021/May/70 - http://seclists.org/fulldisclosure/2021/May/68 - http://seclists.org/fulldisclosure/2021/May/67 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.tenable.com/security/tns-2021-09 - https://security.netapp.com/advisory/ntap-20210513-0002/ - https://security.netapp.com/advisory/ntap-20210219-0009/ - https://www.tenable.com/security/tns-2021-03 - https://support.apple.com/kb/HT212529 - https://support.apple.com/kb/HT212528 - https://support.apple.com/kb/HT212534 - https://www.oracle.com//security-alerts/cpujul2021.html - https://kb.pulsesecure.n
tps://support.apple.com/kb/HT212534 - https://www.oracle.com//security-alerts/cpujul2021.html - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2021-23842 State: PUBLISHED Published: 2022-01-19T20:38:54.368368Z Last Updated: 2024-09-16T21:56:51.896Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Bosch Products: AMS, APE, BIS, AMC2 Problem Types: CWE-321 Description: Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the firmware to decrypt network traffic between the AMC2 and the host system. Thus, an attacker can exploit this vulnerability to decrypt and modify network traffic, decrypt and further investigate the device\'s firmware file, and change the device configuration. The atta
work traffic, decrypt and further investigate the device\'s firmware file, and change the device configuration. The attacker needs to have access to the local network, typically even the same subnet. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-940448-BT.html
CVE ID: CVE-2021-23843 State: PUBLISHED Published: 2022-01-19T20:38:55.465356Z Last Updated: 2024-09-16T23:01:30.470Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Bosch Products: AMS, APE, BIS, AMC2 Problem Types: CWE-306 Description: The Bosch software tools AccessIPConfig.exe and AmcIpConfig.exe are used to configure certains settings in AMC2 devices. The tool allows putting a password protection on configured devices to restrict access to the configuration of an AMC2. An attacker can circumvent this protection and make unauthorized changes to configuration data on the device. An attacker can exploit this vulnerability to manipulate the device\'s configur
ges to configuration data on the device. An attacker can exploit this vulnerability to manipulate the device\'s configuration or make it unresponsive in the local network. The attacker needs to have access to the local network, typically even the same subnet. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-940448-BT.html
CVE ID: CVE-2021-23845 State: PUBLISHED Published: 2021-06-18T13:38:31.304203Z Last Updated: 2024-09-16T21:57:38.685Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Bosch Products: B426 Firmware, B426-CN/B429- CN Firmware, B426-M Firmware Problem Types: CWE-284 Description: This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. This vulnerability was discovered by a security researcher in B426 and found during internal product tests in B426-CN/B429-CN, and B426-M and has been fixed already starting from version 3.08 on, which was released on June 2019. Additional Analyst Notes: - CVE Program Containe
already starting from version 3.08 on, which was released on June 2019. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/bosch-sa-196933-bt.html
CVE ID: CVE-2021-23846 State: PUBLISHED Published: 2021-06-18T13:38:38.275340Z Last Updated: 2024-09-16T16:38:12.268Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bosch Products: B426 Firmware Problem Types: CWE-319 Description: When using http protocol, the user password is transmitted as a clear text parameter for which it is possible to be obtained by an attacker through a MITM attack. This will be fixed starting from Firmware version 3.11.5, which will be released on the 30th of June, 2021. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/bosch-sa-196933-bt.html
CVE ID: CVE-2021-23847 State: PUBLISHED Published: 2021-06-09T14:19:47.260870Z Last Updated: 2024-09-17T02:46:39.127Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Bosch Products: CPP Firmware Problem Types: CWE-287 Description: A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected. Additional Analyst Not
8 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html
CVE ID: CVE-2021-23848 State: PUBLISHED Published: 2021-06-09T14:18:46.544463Z Last Updated: 2024-09-16T16:27:51.671Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Bosch Products: CPP Firmware Problem Types: CWE-79 Description: An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user, which will execute javascript code in the context of the user. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html
CVE ID: CVE-2021-23849 State: PUBLISHED Published: 2021-08-05T19:23:32.655475Z Last Updated: 2024-09-16T17:23:27.843Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bosch Products: CPP Firmware Problem Types: CWE-352 Description: A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or opening a malicious website while being logged in into the camera. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories
the camera. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/bosch-sa-033305-bt.html
CVE ID: CVE-2021-23850 State: PUBLISHED Published: 2022-03-30T16:03:03.708903Z Last Updated: 2024-09-17T02:57:11.806Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Bosch Products: CPP Firmware Problem Types: CWE-121 Description: A specially crafted TCP/IP packet may cause a camera recovery image telnet interface to crash. It may also cause a buffer overflow which could enable remote code execution. The recovery image can only be booted with administrative rights or with physical access to the camera and allows the upload of a new firmware in case of a damaged firmware. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com
in case of a damaged firmware. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html
CVE ID: CVE-2021-23851 State: PUBLISHED Published: 2022-03-30T16:03:04.883322Z Last Updated: 2024-09-16T18:39:12.509Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Bosch Products: CPP Firmware Problem Types: CWE-121 Description: A specially crafted TCP/IP packet may cause the camera recovery image web interface to crash. It may also cause a buffer overflow which could enable remote code execution. The recovery image can only be booted with administrative rights or with physical access to the camera and allows the upload of a new firmware in case of a damaged firmware. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/
CVE ID: CVE-2021-23852 State: PUBLISHED Published: 2021-06-09T14:18:24.707515Z Last Updated: 2024-09-16T22:03:24.110Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Bosch Products: CPP Firmware Problem Types: CWE-400 Description: An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to become unresponsive for a few seconds and cause a Denial of Service (DoS). Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html
CVE ID: CVE-2021-23853 State: PUBLISHED Published: 2021-06-09T14:19:24.674361Z Last Updated: 2024-09-17T00:25:32.494Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Bosch Products: CPP Firmware Problem Types: CWE-20 Description: In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html
CVE ID: CVE-2021-23854 State: PUBLISHED Published: 2021-06-09T14:20:14.134834Z Last Updated: 2024-09-16T17:32:50.243Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Bosch Products: CPP Firmware Problem Types: CWE-79 Description: An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html
CVE ID: CVE-2021-23855 State: PUBLISHED Published: 2021-10-04T17:32:29 Last Updated: 2024-08-03T19:14:09.329Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Rexroth Products: IndraMotion MLC IndraMotion XLC Problem Types: CWE-200 Description: The user and password data base is exposed by an unprotected web server resource. Passwords are hashed with a weak hashing algorithm and therefore allow an attacker to determine the password by using rainbow tables. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/bosch-sa-741752.html
CVE ID: CVE-2021-23856 State: PUBLISHED Published: 2021-10-04T17:32:15.652787Z Last Updated: 2024-09-17T04:19:37.450Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Rexroth Products: IndraMotion MLC L20, L40 Problem Types: CWE-79 Description: The web server is vulnerable to reflected XSS and therefore an attacker might be able to execute scripts on a client’s computer by sending the client a manipulated URL. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/bosch-sa-741752.html
CVE ID: CVE-2021-23857 State: PUBLISHED Published: 2021-10-04T17:32:36 Last Updated: 2024-08-03T19:14:09.701Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Rexroth Products: IndraMotion MLC L25, L45, L65, L75, L85, XM21, XM22, XM41 and XM42 IndraMotion XLC, IndraMotion MLC L20, L40 Problem Types: CWE-836 Description: Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password. Combined with CVE-2021-23858, this allows an attacker to subsequently login to the system. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/b
e system. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/bosch-sa-741752.html
CVE ID: CVE-2021-23858 State: PUBLISHED Published: 2021-10-04T17:32:22 Last Updated: 2024-08-03T19:14:09.398Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Rexroth Products: IndraMotion MLC L25, L45, L65, L75, L85, XM21, XM22, XM41 and XM42 IndraControl XLC, IndraMotion MLC L20, L40 Problem Types: CWE-200 Description: Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another unprotected web server resource. Additional Analyst
which include the serial number and the firmware version by another unprotected web server resource. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/bosch-sa-741752.html
CVE ID: CVE-2021-23859 State: PUBLISHED Published: 2021-12-08T21:17:23.528438Z Last Updated: 2024-09-16T19:45:43.543Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Bosch Products: BVMS, DIVAR IP 7000 R2, DIVAR IP all-in-one 5000, DIVAR IP all-in-one 7000, VRM, VRM Exporter, APE, AEC, BIS Problem Types: CWE-703 Description: An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS with VRM installation this crash also opens the possibility to send further unauthenticated commands to the service. On some products the interface is only local accessible lowering the CVSS base score
henticated commands to the service. On some products the interface is only local accessible lowering the CVSS base score. For a list of modified CVSS scores, please see the official Bosch Advisory Appendix chapter Modified CVSS Scores for CVE-2021-23859 Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html
CVE ID: CVE-2021-23860 State: PUBLISHED Published: 2021-12-08T21:17:28.106105Z Last Updated: 2024-09-17T03:52:42.674Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Bosch Products: BVMS, DIVAR IP 7000 R2, DIVAR IP all-in-one 5000, DIVAR IP all-in-one 7000, VRM Problem Types: CWE-79 Description: An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface. To exploit this vulnerability an attack must be able to modify the HTTP header that is sent. This issue also affects installations of the DIVAR IP and BVMS with VRM installed. Additional Analyst Notes: - CVE Program Container: References: - https://psirt
the DIVAR IP and BVMS with VRM installed. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html
CVE ID: CVE-2021-23861 State: PUBLISHED Published: 2021-12-08T21:17:32.737248Z Last Updated: 2024-09-16T17:49:16.784Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Bosch Products: BVMS, DIVAR IP 7000 R2, DIVAR IP all-in-one 5000, DIVAR IP all-in-one 7000, VRM Problem Types: CWE-489 Description: By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or availability of the installed software. This issue also affects installations of the DIVAR IP and BVMS with VRM installed. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.
AR IP and BVMS with VRM installed. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html
CVE ID: CVE-2021-23862 State: PUBLISHED Published: 2021-12-08T21:17:37.519370Z Last Updated: 2024-09-16T19:30:25.389Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Bosch Products: BVMS, DIVAR IP 7000 R2, DIVAR IP all-in-one 5000, DIVAR IP all-in-one 7000, VRM, VJD-8000, VJD-7513 Problem Types: CWE-20 Description: A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affects installations of the VRM, DIVAR IP, BVMS with VRM installed, the VIDEOJET decoder (VJD-7513 and VJD-8000). Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosc
JET decoder (VJD-7513 and VJD-8000). Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html
CVE ID: CVE-2021-23863 State: PUBLISHED Published: 2022-01-28T19:09:53.667620Z Last Updated: 2024-09-16T18:24:00.479Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: HTML code injection vulnerability in Android Application, Bosch Video Security, version 3.2.3. or earlier, when successfully exploited allows an attacker to inject random HTML code into a component loaded by WebView, thus allowing the Application to display web resources controlled by the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/bosch-sa-844050.html
CVE ID: CVE-2021-23872 State: PUBLISHED Published: 2021-05-12T09:00:23 Last Updated: 2024-08-03T19:14:09.378Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Total Protection (MTP) Problem Types: CWE-59 Description: Privilege Escalation vulnerability in the File Lock component of McAfee Total Protection (MTP) prior to 16.0.32 allows a local user to gain elevated privileges by manipulating a symbolic link in the IOCTL interface. Additional Analyst Notes: - CVE Program Container: References: - http://service.mcafee.com/FAQDocument.aspx?&id=TS103146
CVE ID: CVE-2021-23873 State: PUBLISHED Published: 2021-02-10T10:20:15 Last Updated: 2024-08-03T19:14:09.882Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Total Protection (MTP) Problem Types: CWE-59 Description: Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and perform arbitrary file deletion as the SYSTEM user potentially causing Denial of Service via manipulating Junction link, after enumerating certain files, at a specific time. Additional Analyst Notes: - CVE Program Container: References: - http://service.mcafee.com/FAQDocument.aspx?&id=T
time. Additional Analyst Notes: - CVE Program Container: References: - http://service.mcafee.com/FAQDocument.aspx?&id=TS103114 - https://www.zerodayinitiative.com/advisories/ZDI-21-175/
CVE ID: CVE-2021-23874 State: PUBLISHED Published: 2021-02-10T10:25:24.000Z Last Updated: 2025-10-21T23:35:28.347Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Total Protection (MTP) Problem Types: CWE-269 Description: Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP self-defense. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://service.mcafee.com/FAQDocument.aspx?&id=TS103114
CVE ID: CVE-2021-23876 State: PUBLISHED Published: 2021-02-10T10:25:15 Last Updated: 2024-08-03T19:14:09.349Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Total Protection (MTP) Problem Types: CWE-269 Description: Bypass Remote Procedure call in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and perform arbitrary file modification as the SYSTEM user potentially causing Denial of Service via executing carefully constructed malware. Additional Analyst Notes: - CVE Program Container: References: - http://service.mcafee.com/FAQDocument.aspx?&id=TS103114