Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
into an unresponsive state via specifically-crafted long request parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-170
CVE ID: CVE-2021-22125 State: PUBLISHED Published: 2021-07-20T10:28:15 Last Updated: 2024-10-25T13:55:01.159Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) Vendors: Fortinet Products: Fortinet FortiSandbox Problem Types: Execute unauthorized code or commands Description: An instance of improper neutralization of special elements in the sniffer module of FortiSandbox before 3.2.2 may allow an authenticated administrator to execute commands on the underlying system's shell via altering the content of its configuration file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-005
CVE ID: CVE-2021-22126 State: PUBLISHED Published: 2025-03-17T13:05:55.333Z Last Updated: 2025-03-18T03:55:16.635Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiWLC Problem Types: CWE-284 Description: A use of hard-coded password vulnerability in FortiWLC version 8.5.2 and below, version 8.4.8 and below, version 8.3.3 to 8.3.2, version 8.2.7 to 8.2.6 may allow a local, authenticated attacker to connect to the managed Access Point (Meru AP and FortiAP-U) as root using the default hard-coded username and password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR
d password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-20-147
CVE ID: CVE-2021-22127 State: PUBLISHED Published: 2022-04-06T16:00:33 Last Updated: 2024-10-25T13:32:52.692Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiClientLinux Problem Types: Execute unauthorized code or commands Description: An improper input validation vulnerability in FortiClient for Linux 6.4.x before 6.4.3, FortiClient for Linux 6.2.x before 6.2.9 may allow an unauthenticated attacker to execute arbitrary code on the host operating system as root via tricking the user into connecting to a network with a malicious name. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refer
ng to a network with a malicious name. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-241
CVE ID: CVE-2021-22128 State: PUBLISHED Published: 2021-03-04T17:27:43 Last Updated: 2024-10-25T13:59:55.356Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) Vendors: Fortinet Products: Fortinet FortiProxy Problem Types: Improper Access Control Description: An improper access control vulnerability in FortiProxy SSL VPN portal 2.0.0, 1.2.9 and below versions may allow an authenticated, remote attacker to access internal service such as the ZebOS Shell on the FortiProxy appliance through the Quick Connection functionality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-235
CVE ID: CVE-2021-22129 State: PUBLISHED Published: 2021-07-09T18:26:30 Last Updated: 2024-10-25T13:56:52.894Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Fortinet Products: Fortinet FortiMail Problem Types: Execute unauthorized code or commands Description: Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
ically crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-023
CVE ID: CVE-2021-22130 State: PUBLISHED Published: 2021-06-03T10:27:47 Last Updated: 2024-10-25T13:58:00.281Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Fortinet Products: Fortinet FortiProxy Problem Types: Execute unauthorized code or commands Description: A stack-based buffer overflow vulnerability in FortiProxy physical appliance CLI 2.0.0 to 2.0.1, 1.2.0 to 1.2.9, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 may allow an authenticated, remote attacker to perform a Denial of Service attack by running the `diagnose sys cpuset` with a large cpuset mask value. Fortinet is not aware of any successful exploitation of this vulnerability that would lead to code execution
mask value. Fortinet is not aware of any successful exploitation of this vulnerability that would lead to code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-006
CVE ID: CVE-2021-22131 State: PUBLISHED Published: 2022-07-18T16:35:56 Last Updated: 2024-10-22T20:56:26.493Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiTokenAndroid, Fortinet FortiTokeniOS, Fortinet FortiTokenWinApp Problem Types: Information disclosure Description: A improper validation of certificate with host mismatch in Fortinet FortiTokenAndroid version 5.0.3 and below, Fortinet FortiTokeniOS version 5.2.0 and below, Fortinet FortiTokenWinApp version 4.0.3 and below allows attacker to retrieve information disclosed via man-in-the-middle attacks. Additional Analyst Notes: - CVE Program Container: - CIS
o retrieve information disclosed via man-in-the-middle attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-024
CVE ID: CVE-2021-22132 State: PUBLISHED Published: 2021-01-14T19:20:12 Last Updated: 2024-08-03T18:30:23.958Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-522 Description: Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2 Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elasticsearch-7-10-2-security-update/261164 - https://www.oracle
m Container: References: - https://discuss.elastic.co/t/elasticsearch-7-10-2-security-update/261164 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20210219-0004/
CVE ID: CVE-2021-22133 State: PUBLISHED Published: 2021-02-10T18:55:15 Last Updated: 2024-08-03T18:30:24.014Z Vendors: Elastic Products: Elastic APM Agent for Go Problem Types: CWE-532 Description: The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it is possible the headers will not be sanitized before being sent. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-apm-agent-for-go-1-11-0-security-upda
Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-apm-agent-for-go-1-11-0-security-update/263252
CVE ID: CVE-2021-22134 State: PUBLISHED Published: 2021-03-08T20:40:22 Last Updated: 2024-08-03T18:30:23.943Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-200 Description: A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been updated and not yet refreshed in the index. This could result in the search disclosing the existence of documents and fields the attacker should not be able to view. Additional Analyst Notes: - CVE Program Container: Re
e of documents and fields the attacker should not be able to view. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-7-11-0-security-update/265835 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20210430-0006/
CVE ID: CVE-2021-22135 State: PUBLISHED Published: 2021-05-13T17:35:17 Last Updated: 2024-08-03T18:30:23.976Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-200 Description: Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled on the index. Certain queries are able to enable the profiler and suggester which could lead to disclosing the existence of documents and fields the attacker should not be able to view. Additional Analyst Notes: - CV
disclosing the existence of documents and fields the attacker should not be able to view. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125 - https://security.netapp.com/advisory/ntap-20210625-0003/
CVE ID: CVE-2021-22136 State: PUBLISHED Published: 2021-05-13T17:35:17 Last Updated: 2024-08-03T18:30:23.975Z Vendors: Elastic Products: Kibana Problem Types: CWE-613 Description: In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout setting is not being respected. This was caused by background polling activities unintentionally extending authenticated users sessions, preventing a user session from timing out. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125
CVE ID: CVE-2021-22137 State: PUBLISHED Published: 2021-05-13T17:35:18 Last Updated: 2024-08-03T18:30:23.940Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-200 Description: In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain cross-cluster search queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices. Additional Analyst Notes: - CVE Program Container: Refere
gaining additional insight into potentially sensitive indices. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125 - https://security.netapp.com/advisory/ntap-20210625-0003/
CVE ID: CVE-2021-22138 State: PUBLISHED Published: 2021-05-13T17:35:19 Last Updated: 2024-08-03T18:30:24.012Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-295 Description: In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted server CA certificate Logstash would not properly verify the certificate returned by the monitoring server. This could result in a man in the middle style attack against the Logstash monitoring data. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125 - htt
ogram Container: References: - https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125 - https://security.netapp.com/advisory/ntap-20210629-0001/
CVE ID: CVE-2021-22139 State: PUBLISHED Published: 2021-05-13T17:35:19 Last Updated: 2024-08-03T18:30:23.946Z Vendors: Elastic Products: Kibana Problem Types: CWE-400 Description: Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request size. An attacker with permissions to create webhook actions could drain the Kibana host connection pool, making Kibana unavailable for all other users. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/7-12-1-security-update/271433
CVE ID: CVE-2021-22140 State: PUBLISHED Published: 2021-05-13T17:35:20 Last Updated: 2024-08-03T18:30:23.960Z Vendors: Elastic Products: Elastic App Search Problem Types: CWE-611 Description: Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could craft a malicious sitemap.xml to traverse the filesystem of the host running the instance and obtain sensitive files. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/7-12-1-security-update/271433
CVE ID: CVE-2021-22141 State: PUBLISHED Published: 2022-11-18T00:00:00.000Z Last Updated: 2025-04-29T19:36:13.142Z Vendors: Elastic Products: Kibana Problem Types: CWE-601 Description: An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elastic.co/community/security/ - https://discuss.elastic.co/t/elastic-stack-7-13-0-and-6-8-16-security-update/273964
CVE ID: CVE-2021-22142 State: PUBLISHED Published: 2023-11-22T01:00:25.568Z Last Updated: 2024-08-03T18:37:17.271Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Elastic Products: Kibana Problem Types: CWE-1104 Description: Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user with permissions to generate reports is able to render arbitrary HTML with this browser, they may be able to leverage known Chromium vulnerabilities to conduct further attacks. Kibana contains a number of protections to prevent this browser from rendering arbitrary content. Additional Analyst Notes:
na contains a number of protections to prevent this browser from rendering arbitrary content. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-7-13-0-and-6-8-16-security-update/273964/1 - https://www.elastic.co/community/security
CVE ID: CVE-2021-22143 State: PUBLISHED Published: 2023-11-22T01:21:58.888Z Last Updated: 2024-10-11T18:06:35.965Z Severity: LOW (CVSS 2.1 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: Elastic Products: Elastic APM .NET Agent Problem Types: CWE-200 Description: The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application error it is possible the headers will not be sanitized before being sent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
sanitized before being sent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/elastic-apm-net-agent-1-10-0-security-update/274668 - https://www.elastic.co/community/security
CVE ID: CVE-2021-22144 State: PUBLISHED Published: 2021-07-26T11:48:40 Last Updated: 2024-08-03T18:37:17.733Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpuapr2022.html - https://discuss.elastic.co/t/elasticsearch-7-13-3-and-6-8-17-security-update/2
cle.com/security-alerts/cpuapr2022.html - https://discuss.elastic.co/t/elasticsearch-7-13-3-and-6-8-17-security-update/278100 - https://security.netapp.com/advisory/ntap-20210827-0006/
CVE ID: CVE-2021-22145 State: PUBLISHED Published: 2021-07-21T11:20:52 Last Updated: 2025-07-08T10:53:02.606Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-200 Description: A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/c
ation details. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20210827-0006/ - https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177 - http://packetstormsecurity.com/files/163648/ElasticSearch-7.13.3-Memory-Disclosure.html - https://gist.github.com/lucasdrufva/f9c5d7c9e26ee087b736d727953afd34
CVE ID: CVE-2021-22146 State: PUBLISHED Published: 2021-07-21T11:28:12 Last Updated: 2024-08-03T18:37:18.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to gain insight into certain details of a deployed cluster. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180 - http://packetstormsecurity.com/fi
nces: - https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180 - http://packetstormsecurity.com/files/163655/Elasticsearch-ECE-7.13.3-Database-Disclosure.html - https://security.netapp.com/advisory/ntap-20210819-0005/
CVE ID: CVE-2021-22147 State: PUBLISHED Published: 2021-09-15T11:36:19 Last Updated: 2024-08-03T18:37:17.551Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-732 Description: Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security/ - https://discuss.elastic.co/t/elastic-stack-7-14-0-security-update/280344 - https://security.netapp.com/advisory/ntap-20211008-0002/
CVE ID: CVE-2021-22148 State: PUBLISHED Published: 2021-09-15T11:49:35 Last Updated: 2024-08-03T18:37:16.710Z Vendors: Elastic Products: Elastic Enterprise Search Problem Types: CWE-732 Description: Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to the same engines as their creator. This could lead to a less privileged user gaining access to unauthorized engines. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security/ - https://discuss.elastic.co/t/elastic-stack-7-14-0-security-update/280344
CVE ID: CVE-2021-22149 State: PUBLISHED Published: 2021-09-15T11:44:31 Last Updated: 2024-08-03T18:37:17.257Z Vendors: Elastic Products: Elastic Enterprise Search Problem Types: CWE-732 Description: Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using this vulnerability, an authenticated attacker could utilize API keys belonging to higher privileged users. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security/ - https://discuss.elastic.co/t/elastic-stack-7-14-0-security-update/280344
CVE ID: CVE-2021-22150 State: PUBLISHED Published: 2023-11-22T00:30:56.115Z Last Updated: 2024-12-02T20:33:49.277Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Elastic Products: Kibana Problem Types: CWE-94 Description: It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077 - https://www.elas
Vulnrichment: References: - https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077 - https://www.elastic.co/community/security
CVE ID: CVE-2021-22151 State: PUBLISHED Published: 2023-11-22T00:36:51.150Z Last Updated: 2024-10-11T18:06:45.178Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Elastic Products: Kibana Problem Types: CWE-22 Description: It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077 - https://www.elastic.co/community/security
CVE ID: CVE-2021-22152 State: PUBLISHED Published: 2021-05-13T10:43:47 Last Updated: 2024-08-03T18:37:16.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial of Service due to Improper Input Validation vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially to prevent any new user connections. Additional Analyst Notes: - CVE Program Container: References: - https://support.blackberry.com/kb/articleDetail?articleNumber=000078971
CVE ID: CVE-2021-22153 State: PUBLISHED Published: 2021-05-13T10:43:52 Last Updated: 2024-08-03T18:37:17.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially cause the spreadsheet application to run commands on the victim’s local machine with the authority of the user. Additional Analyst Notes: - CVE Program Container: References: - https://support.blackberry.com/kb/articleDetail?articleNumber=000078971
CVE ID: CVE-2021-22154 State: PUBLISHED Published: 2021-05-13T10:44:01 Last Updated: 2024-08-03T18:37:16.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Information Disclosure vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially gain access to a victim's web history. Additional Analyst Notes: - CVE Program Container: References: - https://support.blackberry.com/kb/articleDetail?articleNumber=000078971