Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
bugreport.cgi?bug=999804 - https://sourceforge.net/p/isync/isync/ref/master/tags/ - https://sourceforge.net/p/isync/isync/commit_browser - http://www.openwall.com/lists/oss-security/2021/12/03/2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CYZ2GNB4ZO2T27D2XNUWMCS3THZYSJQU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCBSY7OZ57XNC6ZYXF6WU5KBSWITZVDX/ - https://security.gentoo.org/glsa/202208-15
CVE ID: CVE-2021-44144 State: PUBLISHED Published: 2021-11-22T20:28:50 Last Updated: 2024-08-04T04:17:23.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: Croatia Control Asterix 2.8.1 has a heap-based buffer over-read, with additional details to be disclosed at a later date. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CroatiaControlLtd/asterix/issues/183
CVE ID: CVE-2021-44145 State: PUBLISHED Published: 2021-12-17T08:50:09 Last Updated: 2024-08-04T04:17:24.439Z Vendors: Apache Software Foundation Products: Apache NiFi Problem Types: Sensitive information disclosure Description: In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://nifi.apache.org/security.html#1.15.1-vulnerabilities - http://www.openwall.com/lists/oss-security/2021/12/17/1
CVE ID: CVE-2021-44147 State: PUBLISHED Published: 2021-11-22T21:26:04 Last Updated: 2024-08-04T04:17:24.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose local files via a crafted XML/Excel document and perform server-side request forgery attacks. Additional Analyst Notes: - CVE Program Container: References: - https://davidhamann.de/2021/11/18/filemaker-xxe-vulnerability/ - https://support.claris.com/s/answerview?anum=000035751
CVE ID: CVE-2021-44148 State: PUBLISHED Published: 2021-12-07T21:03:05 Last Updated: 2024-08-04T04:17:23.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: GL.iNet GL-AR150 2.x before 3.x devices, configured as repeaters, allow cgi-bin/router_cgi?action=scanwifi XSS when an attacker creates an SSID with an XSS payload as the name. Additional Analyst Notes: - CVE Program Container: References: - https://beaugraham.com/CVE-2021-44148-xss.html
CVE ID: CVE-2021-44149 State: PUBLISHED Published: 2021-12-07T20:59:43 Last Updated: 2024-08-04T04:17:24.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a v cycle. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OP-TEE/optee_os/tags - https://github.com/f-secure-foundry/advisories/blob/master/Security_Ad
nces: - https://github.com/OP-TEE/optee_os/tags - https://github.com/f-secure-foundry/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2021-0002-OP-TEE_TrustZone_bypass_at_wakeup.txt
CVE ID: CVE-2021-44150 State: PUBLISHED Published: 2021-11-22T21:51:56 Last Updated: 2024-08-04T04:17:24.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tusdotnet/tusdotnet/issues/157
CVE ID: CVE-2021-44151 State: PUBLISHED Published: 2021-12-13T00:00:00 Last Updated: 2024-08-04T04:17:23.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Reprise RLM 14.2. As the session cookies are small, an attacker can hijack any existing sessions by bruteforcing the 4 hex-character session cookie on the Windows version (the Linux version appears to have 8 characters). An attacker can obtain the static part of the cookie (cookie name) by first making a request to any page on the application (e.g., /goforms/menu) and saving the name of the cookie sent with the response. The attacker can then use the name of the cookie and try to request that same p
me of the cookie sent with the response. The attacker can then use the name of the cookie and try to request that same page, setting a random value for the cookie. If any user has an active session, the page should return with the authorized content, when a valid cookie value is hit. Additional Analyst Notes: - CVE Program Container: References: - https://reprisesoftware.com/admin/rlm-admin-download.php?&euagree=yes - http://packetstormsecurity.com/files/165191/Reprise-License-Manager-14.2-Session-Hijacking.html - https://www.reprisesoftware.com/RELEASE_NOTES
CVE ID: CVE-2021-44152 State: PUBLISHED Published: 2021-12-13T00:00:00 Last Updated: 2024-08-04T04:17:23.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. This allows an attacker to change the password of any known user, thereby preventing valid users from accessing the system and granting the attacker full access to that user's account. Additional Analyst Notes: - CVE Program Container: References: - https://reprisesoftware.com/admin/rlm-admin-download.php?&euagree=yes - http:
es: - CVE Program Container: References: - https://reprisesoftware.com/admin/rlm-admin-download.php?&euagree=yes - http://packetstormsecurity.com/files/165186/Reprise-License-Manager-14.2-Unauthenticated-Password-Change.html - https://www.reprisesoftware.com/RELEASE_NOTES
CVE ID: CVE-2021-44153 State: PUBLISHED Published: 2021-12-13T03:33:19 Last Updated: 2024-08-04T04:17:23.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Reprise RLM 14.2. When editing the license file, it is possible for an admin user to enable an option to run arbitrary executables, as demonstrated by an ISV demo "C:\Windows\System32\calc.exe" entry. An attacker can exploit this to run a malicious binary on startup, or when triggering the Reread/Restart Servers function on the webserver. (Exploitation does not require CVE-2018-15573, because the license file is meant to be changed in the application.) Additional Analyst Notes: - CVE Program Contain
73, because the license file is meant to be changed in the application.) Additional Analyst Notes: - CVE Program Container: References: - https://reprisesoftware.com/admin/rlm-admin-download.php?&euagree=yes - http://packetstormsecurity.com/files/165194/Reprise-License-Manager-14.2-Remote-Binary-Execution.html
CVE ID: CVE-2021-44154 State: PUBLISHED Published: 2021-12-13T03:34:44 Last Updated: 2024-08-04T04:17:25.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Reprise RLM 14.2. By using an admin account, an attacker can write a payload to /goform/edit_opt, which will then be triggered when running the diagnostics (via /goform/diagnostics_doit), resulting in a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://reprisesoftware.com/admin/rlm-admin-download.php?&euagree=yes - http://packetstormsecurity.com/files/165193/Reprise-License-Manager-14.2-Buffer-Overflow.html
CVE ID: CVE-2021-44155 State: PUBLISHED Published: 2021-12-13T00:00:00 Last Updated: 2024-08-04T04:17:24.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Failed, but does not include this string if the username is invalid. This allows an attacker to enumerate valid users. Additional Analyst Notes: - CVE Program Container: References: - https://reprisesoftware.com/admin/rlm-admin-download.php?&euagree=yes - http://packetstormsecurity.com/files/165182/Reprise-License-Manager-14.2-User-Enumeration.html - https://www.repriseso
- http://packetstormsecurity.com/files/165182/Reprise-License-Manager-14.2-User-Enumeration.html - https://www.reprisesoftware.com/RELEASE_NOTES
CVE ID: CVE-2021-44158 State: PUBLISHED Published: 2022-01-03T10:10:18.551223Z Last Updated: 2024-09-16T16:52:58.821Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ASUS Products: RT-AX56U Problem Types: CWE-121 Description: ASUS RT-AX56U Wi-Fi Router is vulnerable to stack-based buffer overflow due to improper validation for httpd parameter length. An authenticated local area network attacker can launch arbitrary code execution to control the system or disrupt service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5431-d23be-1.html
CVE ID: CVE-2021-44159 State: PUBLISHED Published: 2021-12-20T03:10:19.975975Z Last Updated: 2024-09-17T00:11:07.348Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: 4MOSAn Products: GCB Doctor Problem Types: CWE-434 Description: 4MOSAn GCB Doctor’s file upload function has improper user privilege control. A remote attacker can upload arbitrary files including webshell files without authentication and execute arbitrary code in order to perform arbitrary system operations or deny of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5395-eee40-1.html
CVE ID: CVE-2021-44160 State: PUBLISHED Published: 2021-12-29T07:15:15.313516Z Last Updated: 2024-09-16T23:15:39.424Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Carinal Tien Hospital Products: Health Report System Problem Types: CWE-639 Description: Carinal Tien Hospital Health Report System’s login page has improper authentication, a remote attacker can acquire another general user’s privilege by modifying the cookie parameter without authentication. The attacker can then perform limited operations on the system or modify data, making the service partially unavailable to the user. Additional Analyst Notes: - CVE Program Container: References: - https://w
he service partially unavailable to the user. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5429-4185b-1.html
CVE ID: CVE-2021-44161 State: PUBLISHED Published: 2021-12-29T07:15:16.708094Z Last Updated: 2024-09-16T16:38:54.142Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Changing Products: MOTP(Mobile One Time Password) Problem Types: CWE-89 Description: Changing MOTP (Mobile One Time Password) system’s specific function parameter has insufficient validation for user input. A attacker in local area network can perform SQL injection attack to read, modify or delete backend database without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5423-84a13-1.html
CVE ID: CVE-2021-44162 State: PUBLISHED Published: 2021-12-20T03:10:21.588678Z Last Updated: 2024-09-16T23:42:02.518Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Chain Sea Information Integration Co., Ltd Products: ai chatbot system Problem Types: CWE-22 Description: Chain Sea ai chatbot system’s specific file download function has path traversal vulnerability. The function has improper filtering of special characters in URL parameters, which allows a remote attacker to download arbitrary system files without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5397-b1f40-1.html
CVE ID: CVE-2021-44163 State: PUBLISHED Published: 2021-12-20T03:10:22.998905Z Last Updated: 2024-09-16T16:43:57.373Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Chain Sea Information Integration Co., Ltd Products: ai chatbot system Problem Types: CWE-79 Description: Chain Sea ai chatbot backend has improper filtering of special characters in URL parameters, which allows a remote attacker to perform JavaScript injection for XSS (reflected Cross-site scripting) attack without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5399-03b81-1.html
CVE ID: CVE-2021-44164 State: PUBLISHED Published: 2021-12-20T03:10:24.327303Z Last Updated: 2024-09-16T18:59:15.351Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Chain Sea Information Integration Co., Ltd Products: ai chatbot system Problem Types: CWE-434 Description: Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker to by-pass file type validation, upload malicious script and execute arbitrary code without authentication, in order to take control of the system or terminate service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twce
ol of the system or terminate service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5400-c31d1-1.html
CVE ID: CVE-2021-44165 State: PUBLISHED Published: 2021-12-14T12:06:52 Last Updated: 2024-08-04T04:17:24.538Z Vendors: Siemens Products: POWER METER SICAM Q100 Problem Types: CWE-121 Description: A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41). The affected firmware contains a buffer overflow vulnerability in the web application that could allow a remote attacker with engineer or admin priviliges to potentially perform remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://cer
potentially perform remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-496292.pdf
CVE ID: CVE-2021-44166 State: PUBLISHED Published: 2022-03-02T10:00:26 Last Updated: 2024-10-22T21:00:22.919Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N/E:F/RL:U/RC:R) Vendors: Fortinet Products: Fortinet FortiTokenAndroid Problem Types: Improper access control Description: An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the legitimate user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
tton is clicked by the legitimate user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-210
CVE ID: CVE-2021-44167 State: PUBLISHED Published: 2022-05-11T14:25:10 Last Updated: 2024-10-22T20:57:17.576Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:U/RL:W/RC:C) Vendors: Fortinet Products: Fortinet FortiClientLinux Problem Types: Information disclosure Description: An incorrect permission assignment for critical resource vulnerability [CWE-732] in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below may allow an unauthenticated attacker to access sensitive information in log files and directories via symbolic links. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://
s via symbolic links. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-232
CVE ID: CVE-2021-44168 State: PUBLISHED Published: 2022-01-04T12:38:04.000Z Last Updated: 2025-10-21T23:15:50.019Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Execute unauthorized code or commands Description: A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-201
CVE ID: CVE-2021-44169 State: PUBLISHED Published: 2022-04-06T09:30:20 Last Updated: 2024-10-25T13:33:13.879Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiClientWindows Problem Types: Escalation of privilege Description: A improper initialization in Fortinet FortiClient (Windows) version 6.0.10 and below, version 6.2.9 and below, version 6.4.7 and below, version 7.0.3 and below allows attacker to gain administrative privileges via placing a malicious executable inside the FortiClient installer's directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortigua
's directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-238
CVE ID: CVE-2021-44170 State: PUBLISHED Published: 2022-07-18T16:35:11 Last Updated: 2024-10-25T13:31:34.279Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiProxy, FortiOS Problem Types: Execute unauthorized code or commands Description: A stack-based buffer overflow vulnerability [CWE-121] in the command line interpreter of FortiOS before 7.0.4 and FortiProxy before 2.0.8 may allow an authenticated attacker to execute unauthorized code or commands via specially crafted command line arguments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-179
CVE ID: CVE-2021-44171 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-10-25T13:29:48.848Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Execute unauthorized code or commands Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiOS version 6.0.0 through 6.0.14, FortiOS version 6.2.0 through 6.2.10, FortiOS version 6.4.0 through 6.4.8, FortiOS version 7.0.0 through 7.0.3 allows attacker to execute privileged commands on a linked FortiSwitch via diagnostic CLI commands. Additional Analyst Notes: - CVE Progra
execute privileged commands on a linked FortiSwitch via diagnostic CLI commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-242
CVE ID: CVE-2021-44172 State: PUBLISHED Published: 2023-09-13T12:30:09.839Z Last Updated: 2024-09-24T19:55:20.426Z Severity: LOW (CVSS 3.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:U) Vendors: Fortinet Products: FortiClientEMS Problem Types: CWE-200 Description: An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClientEMS versions 7.0.0 through 7.0.4, 7.0.6 through 7.0.7, in all 6.4 and 6.2 version management interface may allow an unauthenticated attacker to gain information on environment variables such as the EMS installation path. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://for
installation path. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-244
CVE ID: CVE-2021-44173 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:17.564Z Description: No description available.
CVE ID: CVE-2021-44174 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:17.122Z Description: No description available.
CVE ID: CVE-2021-44175 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:16.683Z Description: No description available.
CVE ID: CVE-2021-44176 State: PUBLISHED Published: 2022-01-13T20:27:21.624754Z Last Updated: 2024-09-16T18:34:16.790Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Adobe Products: Experience Manager Problem Types: CWE-79 Description: AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.ado
CVE ID: CVE-2021-44177 State: PUBLISHED Published: 2022-01-13T20:27:19.530923Z Last Updated: 2024-09-16T18:14:23.151Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Adobe Products: Experience Manager Problem Types: CWE-79 Description: AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.ado
CVE ID: CVE-2021-44178 State: PUBLISHED Published: 2022-01-13T20:27:15.721606Z Last Updated: 2024-09-16T23:56:01.697Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Adobe Products: Experience Manager Problem Types: CWE-79 Description: AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a reflected Cross-Site Scripting (XSS) vulnerability via the itemResourceType parameter. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser Additional Analyst Notes: - CVE Program Container: References: - https://help
within the context of the victim's browser Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html
CVE ID: CVE-2021-44179 State: PUBLISHED Published: 2021-12-20T20:08:39.926Z Last Updated: 2025-04-23T19:16:34.431Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Dimension Problem Types: CWE-788 Description: Adobe Dimension versions 3.4.3 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious GIF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/dimension/apsb21-116.
rogram Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/dimension/apsb21-116.html - https://www.zerodayinitiative.com/advisories/ZDI-21-1569/