Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-42085 State: PUBLISHED Published: 2021-10-07T19:36:50 Last Updated: 2024-08-04T03:22:25.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2021-17
CVE ID: CVE-2021-42086 State: PUBLISHED Published: 2021-10-07T19:36:39 Last Updated: 2024-08-04T03:22:25.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2021-09
CVE ID: CVE-2021-42087 State: PUBLISHED Published: 2021-10-07T19:36:27 Last Updated: 2024-08-04T03:22:25.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2021-15
CVE ID: CVE-2021-42088 State: PUBLISHED Published: 2021-10-07T19:36:07 Last Updated: 2024-08-04T03:22:26.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2021-12
CVE ID: CVE-2021-42089 State: PUBLISHED Published: 2021-10-07T19:35:54 Last Updated: 2024-08-04T03:22:25.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2021-13
CVE ID: CVE-2021-42090 State: PUBLISHED Published: 2021-10-07T19:35:41 Last Updated: 2024-08-04T03:22:25.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserialization is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2021-14
CVE ID: CVE-2021-42091 State: PUBLISHED Published: 2021-10-07T19:35:28 Last Updated: 2024-08-04T03:22:25.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 4.1.1. SSRF can occur via GitHub or GitLab integration. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2021-08
CVE ID: CVE-2021-42092 State: PUBLISHED Published: 2021-10-07T19:35:17 Last Updated: 2024-08-04T03:22:25.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2021-16
CVE ID: CVE-2021-42093 State: PUBLISHED Published: 2021-10-07T19:35:02 Last Updated: 2024-08-04T03:22:25.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a crafted request that manipulates triggers. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2021-10
CVE ID: CVE-2021-42094 State: PUBLISHED Published: 2021-10-07T19:34:41 Last Updated: 2024-08-04T03:22:25.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 4.1.1. Command Injection can occur via custom Packages. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2021-18
CVE ID: CVE-2021-42095 State: PUBLISHED Published: 2021-10-07T20:14:10 Last Updated: 2024-08-04T03:22:25.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xshell before 7.0.0.76 allows attackers to cause a crash by triggering rapid changes to the title bar. Additional Analyst Notes: - CVE Program Container: References: - https://www.netsarang.com/en/xshell-update-history/
CVE ID: CVE-2021-42096 State: PUBLISHED Published: 2021-10-21T00:40:34 Last Updated: 2024-08-04T03:22:25.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password. Additional Analyst Notes: - CVE Program Container: References: - https://mail.python.org/archives/list/mailman-announce%40python.org/thread/IKCO6JU755AP5G5TKMBJL6IEZQTTNPDQ/ - https://bugs.launchpad.net/mailman/+bug/1947639 - http://www.openwall.com/lists/oss-security/2021/10/21/4 - https://www.debian.org/security/2021/dsa-49
man/+bug/1947639 - http://www.openwall.com/lists/oss-security/2021/10/21/4 - https://www.debian.org/security/2021/dsa-4991
CVE ID: CVE-2021-42097 State: PUBLISHED Published: 2021-10-21T00:45:13 Last Updated: 2024-08-04T03:22:25.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover). Additional Analyst Notes: - CVE Program Container: References: - https://mail.python.org/archives/list/mailman-announce%40python.org/thread/IKCO6JU755AP5G5TKMBJL6IEZQTTNPDQ/ - https://bugs.launchpad.net/mailman/+bug/1947640 - http://w
ounce%40python.org/thread/IKCO6JU755AP5G5TKMBJL6IEZQTTNPDQ/ - https://bugs.launchpad.net/mailman/+bug/1947640 - http://www.openwall.com/lists/oss-security/2021/10/21/4 - https://www.debian.org/security/2021/dsa-4991
CVE ID: CVE-2021-42098 State: PUBLISHED Published: 2021-10-18T13:22:57 Last Updated: 2024-08-04T03:22:25.977Z Vendors: Devolutions Products: Remote Desktop Manager Problem Types: Insecure Permissions Description: An incomplete permission check on entries in Devolutions Remote Desktop Manager before 2021.2.16 allows attackers to bypass permissions via batch custom PowerShell. Additional Analyst Notes: - CVE Program Container: References: - https://devolutions.net - https://devolutions.net/security/advisories/DEVO-2021-0006
CVE ID: CVE-2021-42099 State: PUBLISHED Published: 2021-11-30T18:47:17 Last Updated: 2024-08-04T03:22:26.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/microsoft-365-management-reporting/release-notes.html#4421
CVE ID: CVE-2021-42101 State: PUBLISHED Published: 2021-10-21T07:46:04 Last Updated: 2024-08-04T03:22:25.786Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: Uncontrolled Search Path Element Privilege Escalation Description: An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar but not identical to CVE-2021-42103. Additional Analyst Notes: - CVE Program Container: References: - https://s
similar but not identical to CVE-2021-42103. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000289229 - https://www.zerodayinitiative.com/advisories/ZDI-21-1219/
CVE ID: CVE-2021-42102 State: PUBLISHED Published: 2021-10-21T07:46:05 Last Updated: 2024-08-04T03:22:25.977Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: Uncontrolled Search Path Element Privilege Escalation Description: An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service agents could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000289229 - https://www.zerod
lyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000289229 - https://www.zerodayinitiative.com/advisories/ZDI-21-1222/
CVE ID: CVE-2021-42103 State: PUBLISHED Published: 2021-10-21T07:46:06 Last Updated: 2024-08-04T03:22:25.872Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: Uncontrolled Search Path Element Privilege Escalation Description: An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar but not identical to CVE-2021-42101. Additional Analyst Notes: - CVE Program Container: References: - https://s
similar but not identical to CVE-2021-42101. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000289229 - https://www.zerodayinitiative.com/advisories/ZDI-21-1213/
CVE ID: CVE-2021-42104 State: PUBLISHED Published: 2021-10-21T07:46:07 Last Updated: 2024-08-04T03:22:25.988Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro Worry-Free Business Security Problem Types: Unnecessary Privileges Local Privilege Escalation Description: Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is simi
y to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-42105, 42106 and 42107. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000289229 - https://success.trendmicro.com/solution/000289230 - https://www.zerodayinitiative.com/advisories/ZDI-21-1216/
CVE ID: CVE-2021-42105 State: PUBLISHED Published: 2021-10-21T07:46:08 Last Updated: 2024-08-04T03:22:25.842Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro Worry-Free Business Security Problem Types: Unnecessary Privileges Local Privilege Escalation Description: Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is simi
y to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-42104, 42106 and 42107. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000289229 - https://success.trendmicro.com/solution/000289230 - https://www.zerodayinitiative.com/advisories/ZDI-21-1215/
CVE ID: CVE-2021-42106 State: PUBLISHED Published: 2021-10-21T07:46:09 Last Updated: 2024-08-04T03:22:25.939Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro Worry-Free Business Security Problem Types: Unnecessary Privileges Local Privilege Escalation Description: Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is simi
y to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-42104, 42105 and 42107. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000289229 - https://success.trendmicro.com/solution/000289230 - https://www.zerodayinitiative.com/advisories/ZDI-21-1218/
CVE ID: CVE-2021-42107 State: PUBLISHED Published: 2021-10-21T07:46:10 Last Updated: 2024-08-04T03:22:25.899Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro Worry-Free Business Security Problem Types: Unnecessary Privileges Local Privilege Escalation Description: Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is simi
y to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-42104, 42105 and 42106. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000289229 - https://success.trendmicro.com/solution/000289230 - https://www.zerodayinitiative.com/advisories/ZDI-21-1214/
CVE ID: CVE-2021-42108 State: PUBLISHED Published: 2021-10-21T07:46:11 Last Updated: 2024-08-04T03:22:25.952Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro Worry-Free Business Security Problem Types: Unnecessary Privileges Local Privilege Escalation Description: Unnecessary privilege vulnerabilities in the Web Console of Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Contai
vileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000289229 - https://success.trendmicro.com/solution/000289230 - https://www.zerodayinitiative.com/advisories/ZDI-21-1217/
CVE ID: CVE-2021-42109 State: PUBLISHED Published: 2021-10-08T17:45:26 Last Updated: 2024-08-04T03:22:25.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: VITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root. Additional Analyst Notes: - CVE Program Container: References: - https://whitehoodhacker.net/posts/2021-10-04-the-big-rick - https://www.exterity.com
CVE ID: CVE-2021-42110 State: PUBLISHED Published: 2021-12-08T15:42:31.000Z Last Updated: 2025-05-30T16:01:45.661Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AC:L/AV:A/A:N/C:H/I:L/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Allegro Windows (formerly Popsy Windows) before 3.3.4156.1. A standard user can escalate privileges to SYSTEM if the FTP module is installed, because of DLL hijacking. Additional Analyst Notes: - CVE Program Container: References: - https://excellium-services.com/cert-xlm-advisory/CVE-2021-42110 - http://www.popsy.com/Documents/Setups/Setup.Allegro.3.3.4154.2.exe - https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-42110
CVE ID: CVE-2021-42111 State: PUBLISHED Published: 2021-11-10T18:03:00.000Z Last Updated: 2025-05-30T16:01:57.231Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AC:L/AV:L/A:N/C:H/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the RCDevs OpenOTP app 1.4.13 and 1.4.14 for iOS. If it is installed on a jailbroken device, it is possible to retrieve the PIN code used to access the application. The IOS app version 1.4.1631262629 resolves this issue by storing a hash PIN code. Additional Analyst Notes: - CVE Program Container: References: - https://excellium-services.com/cve-2021-42111/ - https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-42111
CVE ID: CVE-2021-42112 State: PUBLISHED Published: 2021-10-08T20:45:23 Last Updated: 2024-08-04T03:22:25.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.limesurvey.org/view.php?id=17562 - https://github.com/LimeSurvey/LimeSurvey/commit/d56619a50cfd191bbffd0adb660638a5e438070d - https://www.on-x.com/sites/default/files/on-x_-_security_advisory_-_limesurvey_-_cve-2021-42112.pdf
CVE ID: CVE-2021-42113 State: PUBLISHED Published: 2022-02-03T01:46:08.000Z Last Updated: 2025-11-04T19:12:42.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in StorageSecurityCommandDxe in Insyde InsydeH2O with Kernel 5.1 before 05.14.28, Kernel 5.2 before 05.24.28, and Kernel 5.3 before 05.32.25. An SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM. Additional Analyst Notes: - CVE Program Container: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022008 - https://security.net
ces: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022008 - https://security.netapp.com/advisory/ntap-20220216-0012/ - https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
CVE ID: CVE-2021-42114 State: PUBLISHED Published: 2021-11-16T11:45:20.110793Z Last Updated: 2024-09-17T02:52:19.518Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Micron, Samsung, SK Hynix Products: Micron ddr4_sdram, Samsung ddr4_sdram, SK Hynix ddr4_sdram, Micron lpddr4, Samsung lpddr4, SK Hynix lpddr4 Problem Types: CWE-20 Description: Modern DRAM devices (PC-DDR4, LPDDR4X) are affected by a vulnerability in their internal Target Row Refresh (TRR) mitigation against Rowhammer attacks. Novel non-uniform Rowhammer access patterns, consisting of aggressors with different frequencies, phases, and amplitudes allow triggering bit flips on affected memory mod
sting of aggressors with different frequencies, phases, and amplitudes allow triggering bit flips on affected memory modules using our Blacksmith fuzzer. The patterns generated by Blacksmith were able to trigger bitflips on all 40 PC-DDR4 DRAM devices in our test pool, which cover the three major DRAM manufacturers: Samsung, SK Hynix, and Micron. This means that, even when chips advertised as Rowhammer-free are used, attackers may still be able to exploit Rowhammer. For example, this enables privilege-escalation attacks against the kernel or binaries such as the sudo binary, and also triggering bit flips in RSA-2048 keys (e.g., SSH keys) to gain cross-tenant virtual-machine access. We can co
, and also triggering bit flips in RSA-2048 keys (e.g., SSH keys) to gain cross-tenant virtual-machine access. We can confirm that DRAM devices acquired in July 2020 with DRAM chips from all three major DRAM vendors (Samsung, SK Hynix, Micron) are affected by this vulnerability. For more details, please refer to our publication. Additional Analyst Notes: - CVE Program Container: References: - https://comsec.ethz.ch/research/dram/blacksmith/ - https://github.com/comsec-group/blacksmith - https://comsec.ethz.ch/wp-content/files/blacksmith_sp22.pdf
CVE ID: CVE-2021-42115 State: PUBLISHED Published: 2021-11-30T11:28:07 Last Updated: 2024-08-04T03:22:25.999Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Business-DNA Solutions GmbH Products: TopEase Problem Types: CWE-1004 Description: Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie UID. Additional Analyst Notes: - CVE Program Container: References: - https://confluence.topease.ch/confluence/display/DOC/Relea
itional Analyst Notes: - CVE Program Container: References: - https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE ID: CVE-2021-42116 State: PUBLISHED Published: 2021-11-30T11:28:08 Last Updated: 2024-08-04T03:22:25.987Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Business-DNA Solutions GmbH Products: TopEase Problem Types: CWE-284 Description: Incorrect Access Control in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote attacker to view the Shape Editor and Settings, which are functionality for higher privileged users, via identifying said components in the front-end source code or other means. Additional Analyst Notes: - CVE Program Container: References: - https://confluence.topease.c
ource code or other means. Additional Analyst Notes: - CVE Program Container: References: - https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE ID: CVE-2021-42117 State: PUBLISHED Published: 2021-11-30T11:28:09 Last Updated: 2024-08-04T03:22:26.061Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Business-DNA Solutions GmbH Products: TopEase Problem Types: CWE-20 Description: Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote attacker with Object Modification privileges to insert arbitrary HTML without code execution. Additional Analyst Notes: - CVE Program Container: References: - https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE ID: CVE-2021-42118 State: PUBLISHED Published: 2021-11-30T11:28:10 Last Updated: 2024-08-04T03:30:37.684Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Business-DNA Solutions GmbH Products: TopEase Problem Types: CWE-79 Description: Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Structure Component allows an authenticated remote attacker with Object Modification privileges to inject arbitrary HTML and JavaScript code in an object attribute, which is then rendered in the Structure Component, to alter the intended functionality and steal cookies, the latter allowing
is then rendered in the Structure Component, to alter the intended functionality and steal cookies, the latter allowing for account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://confluence.topease.ch/confluence/display/DOC/Release+Notes