Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-24081 State: PUBLISHED Published: 2021-02-25T23:01:42 Last Updated: 2024-08-03T19:21:18.307Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: Remote Code Execution Description: Microsoft Windows Codecs
indows Server 2016 (Server Core installation) Problem Types: Remote Code Execution Description: Microsoft Windows Codecs Library Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24081
CVE ID: CVE-2021-24082 State: PUBLISHED Published: 2021-02-25T23:01:43 Last Updated: 2024-08-03T19:21:18.209Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: Security Feature Bypass Description: Microsoft.PowerShell
Windows Server 2016 (Server Core installation) Problem Types: Security Feature Bypass Description: Microsoft.PowerShell.Utility Module WDAC Security Feature Bypass Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24082
CVE ID: CVE-2021-24083 State: PUBLISHED Published: 2021-02-25T23:01:44 Last Updated: 2024-11-19T15:36:12.207Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1
7, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Remote Code Execution Description: Windows Address Book Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24083
CVE ID: CVE-2021-24084 State: PUBLISHED Published: 2021-02-25T23:01:44 Last Updated: 2024-08-03T19:21:17.738Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2 Problem Types: Information Disclosure Description: Windows Mobile Device Management Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https
e Management Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24084
CVE ID: CVE-2021-24085 State: PUBLISHED Published: 2021-02-25T23:01:45 Last Updated: 2024-08-03T19:21:17.786Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Exchange Server 2019 Cumulative Update 8, Microsoft Exchange Server 2016 Cumulative Update 19, Microsoft Exchange Server 2019 Cumulative Update 7, Microsoft Exchange Server 2016 Cumulative Update 18 Problem Types: Spoofing Description: Microsoft Exchange Server Spoofing Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24085
CVE ID: CVE-2021-24086 State: PUBLISHED Published: 2021-02-25T23:01:46 Last Updated: 2024-08-03T19:21:17.692Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server
2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2 Problem Types: Denial of Service Description: Windows TCP/IP Denial of Service Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-
ice Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24086 - http://packetstormsecurity.com/files/163499/Windows-TCP-IP-Denial-Of-Service.html
CVE ID: CVE-2021-24087 State: PUBLISHED Published: 2021-02-25T23:01:46 Last Updated: 2024-08-03T19:21:17.297Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: azure-iot-cli-extension Problem Types: Elevation of Privilege Description: Azure IoT CLI extension Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24087
CVE ID: CVE-2021-24088 State: PUBLISHED Published: 2021-02-25T23:01:47 Last Updated: 2024-08-03T19:21:18.068Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server version 20H2, Windows 10 Version 20H2, Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1
7, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Remote Code Execution Description: Windows Local Spooler Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.mi
ote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24088
CVE ID: CVE-2021-24089 State: PUBLISHED Published: 2021-03-11T14:59:59 Last Updated: 2024-08-03T19:21:18.223Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: HEVC Video Extensions Problem Types: Remote Code Execution Description: HEVC Video Extensions Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24089
CVE ID: CVE-2021-24090 State: PUBLISHED Published: 2021-03-11T15:01:25 Last Updated: 2024-08-03T19:21:18.302Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004 Problem Types: Elevation of Privilege Description: Windows Error Reporting Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24090
CVE ID: CVE-2021-24091 State: PUBLISHED Published: 2021-02-25T23:01:47 Last Updated: 2024-08-03T19:21:18.193Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: Remote Code Execution Description: Windows Camera Codec Pac
indows Server 2016 (Server Core installation) Problem Types: Remote Code Execution Description: Windows Camera Codec Pack Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24091 - http://packetstormsecurity.com/files/161713/Microsoft-Windows-WindowsCodecsRaw-COlympusE300LoadRaw-Out-Of-Bounds-Write.html
CVE ID: CVE-2021-24092 State: PUBLISHED Published: 2021-02-25T23:01:48 Last Updated: 2024-08-03T19:21:17.762Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Endpoint Protection, Microsoft System Center Endpoint Protection, Microsoft System Center 2012 R2 Endpoint Protection, Microsoft Security Essentials, Microsoft System Center 2012 Endpoint Protection, Windows Defender Problem Types: Elevation of Privilege Description: Microsoft Defender Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-2
es: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24092
CVE ID: CVE-2021-24093 State: PUBLISHED Published: 2021-02-25T23:01:49 Last Updated: 2024-08-03T19:21:18.254Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: Remote Code Execution Description: Windows Graphics Compone
indows Server 2016 (Server Core installation) Problem Types: Remote Code Execution Description: Windows Graphics Component Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24093 - http://packetstormsecurity.com/files/161582/Microsoft-DirectWrite-fsg_ExecuteGlyph-Buffer-Overflow.html
CVE ID: CVE-2021-24094 State: PUBLISHED Published: 2021-02-25T23:01:50 Last Updated: 2024-08-03T19:21:18.643Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Se
Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24094
CVE ID: CVE-2021-24095 State: PUBLISHED Published: 2021-03-11T15:02:03 Last Updated: 2024-08-03T19:21:18.212Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2 Problem Types: Elevation of Privilege Description: DirectX Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://p
DirectX Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24095
CVE ID: CVE-2021-24096 State: PUBLISHED Published: 2021-02-25T23:01:50 Last Updated: 2024-08-03T19:21:18.254Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: Elevation of Privilege Description: Windows Kernel Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://porta
rnel Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24096
CVE ID: CVE-2021-24098 State: PUBLISHED Published: 2021-02-25T23:01:51 Last Updated: 2024-08-03T19:21:18.700Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation) Problem Types: Denial of Service Description: Windows Console Driver Denial of Service Vulnerability Additional Analyst Notes: - CVE Program Container: References: -
Windows Console Driver Denial of Service Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24098
CVE ID: CVE-2021-24099 State: PUBLISHED Published: 2021-02-25T23:01:51 Last Updated: 2024-08-03T19:21:18.288Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Skype for Business Server 2019 CU2, Skype for Business Server 2015 CU 8, Microsoft Lync Server 2013 Problem Types: Denial of Service Description: Skype for Business and Lync Denial of Service Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24099
CVE ID: CVE-2021-24100 State: PUBLISHED Published: 2021-02-25T23:01:52 Last Updated: 2024-11-19T15:37:07.852Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Edge for Android Problem Types: Information Disclosure Description: Microsoft Edge for Android Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24100
CVE ID: CVE-2021-24101 State: PUBLISHED Published: 2021-02-25T23:01:53 Last Updated: 2024-08-03T19:21:18.251Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Dynamics 365 (on-premises) version 8.2, Microsoft Dynamics 365 (on-premises) version 9.0 Problem Types: Information Disclosure Description: Microsoft Dataverse Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24101
CVE ID: CVE-2021-24102 State: PUBLISHED Published: 2021-02-25T23:01:53 Last Updated: 2024-08-03T19:21:18.380Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1
7, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Elevation of Privilege Description: Windows Event Tracing Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.
evation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24102
CVE ID: CVE-2021-24103 State: PUBLISHED Published: 2021-02-25T23:01:54 Last Updated: 2024-11-19T15:37:34.421Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1
7, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Elevation of Privilege Description: Windows Event Tracing Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
evation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24103
CVE ID: CVE-2021-24104 State: PUBLISHED Published: 2021-03-11T15:02:28 Last Updated: 2024-08-03T19:21:18.217Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N/E:P/RL:W/RC:C) Vendors: Microsoft Products: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Foundation 2013 Service Pack 1 Problem Types: Spoofing Description: Microsoft SharePoint Server Spoofing Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24104
CVE ID: CVE-2021-24105 State: PUBLISHED Published: 2021-02-25T23:01:55 Last Updated: 2024-08-03T19:21:18.208Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Microsoft Products: Package Manager Configurations Problem Types: Remote Code Execution Description: <p>Depending on configuration of various package managers it is possible for an attacker to insert a malicious package into a package manager's repository which can be retrieved and used during development, build, and release processes. This insertion could lead to remote code execution. We believe this vulnerability affects multiple package managers across multiple languages, including but n
de execution. We believe this vulnerability affects multiple package managers across multiple languages, including but not limited to: Python/pip, .NET/NuGet, Java/Maven, JavaScript/npm.</p> <p><strong>Attack scenarios</strong></p> <p>An attacker could take advantage of this ecosystem-wide issue to cause harm in a variety of ways. The original attack scenarios were discovered by Alex Birsan and are detailed in their whitepaper, <a href="https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610">Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies</a>.</p> <ul> <li><p>With basic knowledge of the target ecosystems, an attacker could create an empty she
ther Companies</a>.</p> <ul> <li><p>With basic knowledge of the target ecosystems, an attacker could create an empty shell for a package and insert malicious code in the install scripts, give it a high version, and publish it to the public repository. Vulnerable victim machines will download the higher version of the package between the public and private repositories and attempt to install it. Due to code incompatibility it will probably error out upon import or upon compilation, making it easier to detect; however the attacker would have gained code execution by that point.</p> </li> <li><p>An advanced attacker with some inside knowledge of the target could take a copy of a working package