Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-28490 State: PUBLISHED Published: 2021-08-19T18:44:38 Last Updated: 2024-08-03T21:47:32.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token. Additional Analyst Notes: - CVE Program Container: References: - https://owasp.org/www-project-csrfguard/ - https://github.com/reidmefirst/vuln-disclosure/blob/main/2021-01.txt
CVE ID: CVE-2021-28492 State: PUBLISHED Published: 2021-04-20T13:01:22 Last Updated: 2024-08-03T21:47:32.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unisys Stealth (core) 5.x before 5.0.048.0, 5.1.x before 5.1.017.0, and 6.x before 6.0.037.0 stores passwords in a recoverable format. Additional Analyst Notes: - CVE Program Container: References: - https://public.support.unisys.com/common/public/vulnerability/NVD_Home.aspx - https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=63
CVE ID: CVE-2021-28493 State: PUBLISHED Published: 2021-09-09T12:45:32 Last Updated: 2024-08-03T21:47:31.828Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) Vendors: Arista Products: Metamako Operating System Problem Types: CWE-287 Description: In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, a user may be able to execute commands despite not having the privileges to do so. This issue affects: Arista Metamako Operating System All releases in the MOS-0.1x train MOS-0.32.0 and prior releases Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisor
rior releases Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/12915-security-advisory-67
CVE ID: CVE-2021-28494 State: PUBLISHED Published: 2021-09-09T12:46:58 Last Updated: 2024-08-03T21:47:31.799Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) Vendors: Arista Products: Metamako Operating System Problem Types: CWE-287 Description: In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, authentication is bypassed by unprivileged users who are accessing the Web UI. This issue affects: Arista Metamako Operating System MOS-0.34.0 and prior releases Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/129
tes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/12916-security-advisory-68
CVE ID: CVE-2021-28495 State: PUBLISHED Published: 2021-09-09T12:43:57 Last Updated: 2024-08-03T21:47:32.686Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: Arista Products: Metamako Operating System Problem Types: CWE-287 Description: In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, user authentication can be bypassed when API access is enabled via the JSON-RPC APIs. This issue affects: Arista Metamako Operating System All releases in the MOS-0.1x train MOS-0.13 and post releases in the MOS-0.1x train MOS-0.26.6 and below releases in the MOS-0.2x train MOS-0.31.1 and below releases in
post releases in the MOS-0.1x train MOS-0.26.6 and below releases in the MOS-0.2x train MOS-0.31.1 and below releases in the MOS-0.3x train Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/12914-security-advisory-66
CVE ID: CVE-2021-28496 State: PUBLISHED Published: 2021-10-21T16:41:47.224918Z Last Updated: 2024-09-16T17:39:06.302Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Arista Networks Products: Arista EOS Problem Types: CWE-311 Description: On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectional Forwarding Detection (BFD) will be leaked when displaying output over eAPI or other JSON outputs to other authenticated users on the device. The affected EOS Versions are: all releases in 4.22.x train, 4.23.9 and below releases in the 4.23.x train, 4.24.7 and below
ffected EOS Versions are: all releases in 4.22.x train, 4.23.9 and below releases in the 4.23.x train, 4.24.7 and below releases in the 4.24.x train, 4.25.4 and below releases in the 4.25.x train, 4.26.1 and below releases in the 4.26.x train Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/13243-security-advisory-0069
CVE ID: CVE-2021-28497 State: PUBLISHED Published: 2021-09-09T12:41:37 Last Updated: 2024-08-03T21:47:32.634Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Arista Products: Metamako Operating System Problem Types: CWE-264 Description: In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, the bash shell might be accessible to unprivileged users in situations where they should not have access. This issue affects: Arista Metamako Operating System All releases in the MOS-0.1x train MOS-0.26.6 and below releases in the MOS-0.2x train MOS-0.31.1 and below releases in the MOS-0.3x train Additio
1x train MOS-0.26.6 and below releases in the MOS-0.2x train MOS-0.31.1 and below releases in the MOS-0.3x train Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/12913-security-advisory-65
CVE ID: CVE-2021-28498 State: PUBLISHED Published: 2021-09-09T12:38:21 Last Updated: 2024-08-03T21:47:32.550Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H) Vendors: Arista Products: Metamako Operating System Problem Types: CWE-255 Description: In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user enable passwords set in clear text could result in unprivileged users getting complete access to the systems. This issue affects: Arista Metamako Operating System MOS-0.13 and post releases in the MOS-0.1x train MOS-0.26.6 and prior releases in the MOS-0.2x train MOS-0.31.1 and prior releases in the MOS-0.3x train Additional A
ain MOS-0.26.6 and prior releases in the MOS-0.2x train MOS-0.31.1 and prior releases in the MOS-0.3x train Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/12912-security-advisory-64
CVE ID: CVE-2021-28499 State: PUBLISHED Published: 2021-09-09T12:38:50 Last Updated: 2024-08-03T21:47:32.839Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: Arista Products: Metamako Operating System Problem Types: CWE-255 Description: In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user account passwords set in clear text could leak to users without any password. This issue affects: Arista Metamako Operating System MOS-0.18 and post releases in the MOS-0.1x train All releases in the MOS-0.2x train MOS-0.31.1 and prior releases in the MOS-0.3x train Additional Analyst Notes: - CVE Program Container: Referenc
2x train MOS-0.31.1 and prior releases in the MOS-0.3x train Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/12912-security-advisory-64
CVE ID: CVE-2021-28500 State: PUBLISHED Published: 2022-01-14T19:11:36.486990Z Last Updated: 2024-09-16T18:44:53.535Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Arista Networks Products: Arista EOS Problem Types: CWE-285 Description: An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071
CVE ID: CVE-2021-28501 State: PUBLISHED Published: 2022-01-14T19:04:48.898457Z Last Updated: 2024-09-17T03:43:50.014Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Arista Networks Products: Terminattr Problem Types: CWE-285 Description: An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071
CVE ID: CVE-2021-28503 State: PUBLISHED Published: 2022-02-04T22:29:27.998573Z Last Updated: 2024-09-16T23:06:02.607Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Arista Networks Products: Arista EOS Problem Types: CWE-305 Description: The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/13605-security-advisory-0072
CVE ID: CVE-2021-28504 State: PUBLISHED Published: 2022-04-01T22:17:50 Last Updated: 2024-08-03T21:47:32.630Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Arista Networks Products: EOS Problem Types: CWE-284 Description: On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol field as expected. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/15267-security-advisory-0073
CVE ID: CVE-2021-28505 State: PUBLISHED Published: 2022-04-14T20:05:50.059934Z Last Updated: 2024-09-16T16:58:06.559Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Arista Networks Products: EOS Problem Types: CWE-284 Description: On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/15267-security-advisory-0073
CVE ID: CVE-2021-28506 State: PUBLISHED Published: 2022-01-14T19:04:50.282050Z Last Updated: 2024-09-16T22:09:48.017Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Arista Networks Products: EOS Problem Types: CWE-285 Description: An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071
CVE ID: CVE-2021-28507 State: PUBLISHED Published: 2022-01-14T19:04:51.398195Z Last Updated: 2024-09-17T04:20:33.347Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N) Vendors: Arista Networks Products: EOS Problem Types: CWE-284 Description: An issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF might be bypassed, which results in the denied requests being forwarded to the agent. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071
CVE ID: CVE-2021-28508 State: PUBLISHED Published: 2022-05-26T19:48:13.716111Z Last Updated: 2024-09-16T19:47:13.903Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Arista Networks Products: Arista EOS, Arista TerminAttr Problem Types: CWE-255 Description: This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport protocols. The impact of this vulnerability is that, in certain conditions, TerminAttr might leak IPsec sensitive data in clear text in CVP to other authorized users, which could cause IPsec traffic to be decrypted or modified by other authorized users o
n CVP to other authorized users, which could cause IPsec traffic to be decrypted or modified by other authorized users on the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/15484-security-advisory-0077
CVE ID: CVE-2021-28509 State: PUBLISHED Published: 2022-05-26T19:50:36.432905Z Last Updated: 2024-09-16T20:32:30.399Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: Arista Networks Products: Arista EOS, Arista TerminAttr Problem Types: CWE-255 Description: This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport protocols. The impact of this vulnerability is that, in certain conditions, TerminAttr might leak MACsec sensitive data in clear text in CVP to other authorized users, which could cause MACsec traffic to be decrypted or modified by other authorized users
in CVP to other authorized users, which could cause MACsec traffic to be decrypted or modified by other authorized users on the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/15484-security-advisory-0077
CVE ID: CVE-2021-28510 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-01T18:44:26.214Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Arista Networks Products: EOS Problem Types: CWE-400 Description: For certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PTP agent to restart. Repeated restarts of the service will make the service unavailable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/15439-security-advisory-0076
CVE ID: CVE-2021-28511 State: PUBLISHED Published: 2022-08-05T16:47:31.584165Z Last Updated: 2024-09-16T17:15:30.137Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Arista Networks Products: EOS Problem Types: CWE-284 Description: This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the security ACL drop rule might be bypassed if a NAT ACL rule filter with permit action matches the packet flow. This could allow a host with an IP address in a range that matches the range allowed by a NAT ACL and a range denied by a Security ACL to be forwarded incorrectly as it
range that matches the range allowed by a NAT ACL and a range denied by a Security ACL to be forwarded incorrectly as it should have been denied by the Security ACL. This can enable an ACL bypass. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/15862-security-advisory-0078
CVE ID: CVE-2021-28543 State: PUBLISHED Published: 2021-03-16T14:43:04 Last Updated: 2024-08-03T21:47:32.984Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AC:H/AV:N/A:L/C:N/I:N/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in some configurations. This does not affect organizations that only install the Varnish Cache product; however, it is common to install both Varnish Cache and varnish-modules. Specifically, an assertion failure or NULL pointer dereference can be triggered in Varnish Cache through the varnish-modules header.append() and header.copy() functions. For s
ference can be triggered in Varnish Cache through the varnish-modules header.append() and header.copy() functions. For some Varnish Configuration Language (VCL) files, this gives remote clients an opportunity to cause a Varnish Cache restart. A restart reduces overall availability and performance due to an increased number of cache misses, and may cause higher load on backend servers. Additional Analyst Notes: - CVE Program Container: References: - https://varnish-cache.org/security/VSV00006.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPFBRQUJNWHCB3GQHSSAPRLQU6Q6PY43/
CVE ID: CVE-2021-28544 State: PUBLISHED Published: 2022-04-12T17:50:13 Last Updated: 2024-08-03T21:47:32.637Z Vendors: Apache Software Foundation Products: Apache Subversion Problem Types: CWE-200 Description: Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable. Additional
pied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://subversion.apache.org/security/CVE-2021-28544-advisory.txt - https://www.debian.org/security/2022/dsa-5119 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R/ - https://support.apple.com/kb/HT213345 - http://seclists.org/fulldisclosure/2022/Jul/18
CVE ID: CVE-2021-28545 State: PUBLISHED Published: 2021-04-01T13:35:24.968885Z Last Updated: 2024-09-17T03:03:35.066Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-353 Description: Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are missing support for an integrity check. An unauthenticated attacker would have the ability to completely manipulate data in a certified PDF without invalidating the original certification. Exploitation of this issue requires user interaction in that a victim must open the tampered file. Additional Anal
tion. Exploitation of this issue requires user interaction in that a victim must open the tampered file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE ID: CVE-2021-28546 State: PUBLISHED Published: 2021-04-01T13:35:46.332288Z Last Updated: 2024-09-16T23:10:26.406Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-353 Description: Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are missing support for an integrity check. An unauthenticated attacker could leverage this vulnerability to modify content in a certified PDF without invalidating the certification. Exploitation of this issue requires user interaction in that a victim must open the tampered file. Additional Analyst Note
ploitation of this issue requires user interaction in that a victim must open the tampered file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE ID: CVE-2021-28547 State: PUBLISHED Published: 2021-09-29T15:45:48.968Z Last Updated: 2025-04-23T19:25:36.174Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Creative Cloud (desktop component) Problem Types: CWE-20 Description: Adobe Creative Cloud Desktop Application for macOS version 5.3 (and earlier) is affected by a privilege escalation vulnerability that could allow a normal user to delete the OOBE directory and get permissions of any directory under the administrator authority. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/creative-cloud/apsb21-18.h
m Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/creative-cloud/apsb21-18.html
CVE ID: CVE-2021-28548 State: PUBLISHED Published: 2021-04-15T13:56:14.166Z Last Updated: 2025-04-23T19:41:33.961Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Photoshop Problem Types: CWE-120 Description: Adobe Photoshop versions 21.2.6 (and earlier) and 22.3 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted JSX file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container:
quires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/photoshop/apsb21-28.html
CVE ID: CVE-2021-28549 State: PUBLISHED Published: 2021-04-15T13:53:00.395Z Last Updated: 2025-04-23T19:41:59.329Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Photoshop Problem Types: CWE-120 Description: Adobe Photoshop versions 21.2.6 (and earlier) and 22.3 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted JSX file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container:
CVE ID: CVE-2021-28550 State: PUBLISHED Published: 2021-09-02T16:07:20.687Z Last Updated: 2025-10-21T23:25:35.586Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-416 Description: Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes:
oitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/acrobat/apsb21-29.html