Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-23877 State: PUBLISHED Published: 2021-10-26T21:40:08 Last Updated: 2024-08-03T19:14:09.221Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: McAfee Products: McAfee Total Protection (MTP) Problem Types: CWE-269 Description: Privilege escalation vulnerability in the Windows trial installer of McAfee Total Protection (MTP) prior to 16.0.34_x may allow a local user to run arbitrary code as the admin user by replacing a specific temporary file created during the installation of the trial version of MTP. Additional Analyst Notes: - CVE Program Container: References: - https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS103
: - CVE Program Container: References: - https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS103215
CVE ID: CVE-2021-23878 State: PUBLISHED Published: 2021-02-10T09:10:14.580381Z Last Updated: 2024-09-16T19:41:11.060Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: McAfee LLC Products: Endpoint Security (ENS) for Windows Problem Types: CWE-312 Description: Clear text storage of sensitive Information in memory vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows a local user to view ENS settings and credentials via accessing process memory after the ENS administrator has performed specific actions. To exploit this, the local user has to access the relevant memory location immediately after an ENS administrato
ctions. To exploit this, the local user has to access the relevant memory location immediately after an ENS administrator has made a configuration change through the console on their machine Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10345
CVE ID: CVE-2021-23879 State: PUBLISHED Published: 2021-03-15T18:40:15.385768Z Last Updated: 2024-09-17T03:29:09.951Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: McAfee, LLC Products: Endpoint Product Removal Tool Problem Types: CWE-428 Description: Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrators to execute arbitrary code, with higher-level privileges, via execution from a compromised folder. The tool did not enforce and protect the execution path. Local admin privileges are required to place the files in the required location. Additional Analyst Notes: - CVE Program Container: R
rivileges are required to place the files in the required location. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10351
CVE ID: CVE-2021-23880 State: PUBLISHED Published: 2021-02-10T09:15:17.543955Z Last Updated: 2024-09-16T22:45:07.753Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: McAfee LLC Products: Endpoint Security (ENS) for Windows Problem Types: CWE-269 Description: Improper Access Control in attribute in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows authenticated local administrator user to perform an uninstallation of the anti-malware engine via the running of a specific command with the correct parameters. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id
. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10345
CVE ID: CVE-2021-23881 State: PUBLISHED Published: 2021-02-10T10:30:15.368578Z Last Updated: 2024-09-17T01:41:33.007Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: McAfee LLC Products: Endpoint Security (ENS) for Windows Problem Types: CWE-79 Description: A stored cross site scripting vulnerability in ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 February 2021 Update allows an ENS ePO administrator to add a script to a policy event which will trigger the script to be run through a browser block page when a local non-administrator user triggers the policy. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.c
nistrator user triggers the policy. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10345
CVE ID: CVE-2021-23882 State: PUBLISHED Published: 2021-02-10T09:20:14.574684Z Last Updated: 2024-09-16T20:57:39.626Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: McAfee LLC Products: Endpoint Security (ENS) for Windows Problem Types: CWE-269 Description: Improper Access Control vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows local administrators to prevent the installation of some ENS files by placing carefully crafted files where ENS will be installed. This is only applicable to clean installations of ENS as the Access Control rules will prevent modification prior to up an upgrade. Additional Analyst
an installations of ENS as the Access Control rules will prevent modification prior to up an upgrade. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10345
CVE ID: CVE-2021-23883 State: PUBLISHED Published: 2021-02-10T09:25:13.493250Z Last Updated: 2024-09-17T01:41:53.554Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: McAfee LLC Products: Endpoint Security (ENS) for Windows Problem Types: CWE-476 Description: A Null Pointer Dereference vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows a local administrator to cause Windows to crash via a specific system call which is not handled correctly. This varies by machine and had partial protection prior to this update. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/in
rior to this update. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10345
CVE ID: CVE-2021-23884 State: PUBLISHED Published: 2021-04-15T07:30:15 Last Updated: 2024-08-03T19:14:09.417Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: McAfee,LLC Products: McAfee Content Security Reporter (CSR) Problem Types: CWE-319 Description: Cleartext Transmission of Sensitive Information vulnerability in the ePO Extension of McAfee Content Security Reporter (CSR) prior to 2.8.0 allows an ePO administrator to view the unencrypted password of the McAfee Web Gateway (MWG) or the password of the McAfee Web Gateway Cloud Server (MWGCS) read only user used to retrieve log files for analysis in CSR. Additional Analyst Notes: - CVE Program Container: Re
CS) read only user used to retrieve log files for analysis in CSR. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10353
CVE ID: CVE-2021-23885 State: PUBLISHED Published: 2021-02-17T09:20:14 Last Updated: 2024-08-03T19:14:09.417Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Web Gateway (MWG) Problem Types: CWE-269 Description: Privilege escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.8 allows an authenticated user to gain elevated privileges through the User Interface and execute commands on the appliance via incorrect improper neutralization of user input in the troubleshooting page. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10349
CVE ID: CVE-2021-23886 State: PUBLISHED Published: 2021-04-15T07:50:15 Last Updated: 2024-08-03T19:14:09.648Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: McAfee,LLC Products: McAfee Data Loss Prevention (DLP) Endpoint for Windows Problem Types: CWE-755 Description: Denial of Service vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to cause a BSoD through suspending a process, modifying the processes memory and restarting it. This is triggered by the hdlphook driver reading invalid memory. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com
ok driver reading invalid memory. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10354 - https://kc.mcafee.com/corporate/index?page=content&id=SB10357
CVE ID: CVE-2021-23887 State: PUBLISHED Published: 2021-04-15T07:55:15 Last Updated: 2024-08-03T19:14:09.191Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Data Loss Prevention (DLP) Endpoint for Windows Problem Types: CWE-269 Description: Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to write to arbitrary controlled kernel addresses. This is achieved by launching applications, suspending them, modifying the memory and restarting them when they are monitored by McAfee DLP through the hdlphook driver. Additional Analyst Notes:
memory and restarting them when they are monitored by McAfee DLP through the hdlphook driver. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10354 - https://kc.mcafee.com/corporate/index?page=content&id=SB10357
CVE ID: CVE-2021-23888 State: PUBLISHED Published: 2021-03-26T09:30:21 Last Updated: 2024-08-03T19:14:09.497Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: McAfee,LLC Products: McAfee ePolicy Orchestrator (ePO) Problem Types: CWE-601 Description: Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 could cause an authenticated ePO user to load an untrusted site in an ePO iframe which could steal information from the authenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10352
CVE ID: CVE-2021-23889 State: PUBLISHED Published: 2021-03-26T09:30:15 Last Updated: 2024-08-03T19:14:09.155Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: McAfee,LLC Products: McAfee ePolicy Orchestrator (ePO) Problem Types: CWE 79: Cross-Site Scripting (XSS) Description: Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10352
CVE ID: CVE-2021-23890 State: PUBLISHED Published: 2021-03-26T09:35:15 Last Updated: 2024-08-03T19:14:09.188Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: McAfee,LLC Products: McAfee ePolicy Orchestrator (ePO) Problem Types: CWE-200 Description: Information leak vulnerability in the Agent Handler of McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows an unauthenticated user to download McAfee product packages (specifically McAfee Agent) available in ePO repository and install them on their own machines to have it managed and then in turn get policy details from the ePO server. This can only happen when the ePO Agent Handler is installed in a
then in turn get policy details from the ePO server. This can only happen when the ePO Agent Handler is installed in a Demilitarized Zone (DMZ) to service machines not connected to the network through a VPN. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10352
CVE ID: CVE-2021-23891 State: PUBLISHED Published: 2021-05-12T09:00:15 Last Updated: 2024-08-03T19:14:09.739Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Total Protection (MTP) Problem Types: CWE-269 Description: Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.32 allows a local user to gain elevated privileges by impersonating a client token which could lead to the bypassing of MTP self-defense. Additional Analyst Notes: - CVE Program Container: References: - http://service.mcafee.com/FAQDocument.aspx?&id=TS103146
CVE ID: CVE-2021-23892 State: PUBLISHED Published: 2021-05-12T09:05:13 Last Updated: 2024-08-03T19:14:09.649Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Endpoint Security (ENS) for Linux Problem Types: CWE-59 Description: By exploiting a time of check to time of use (TOCTOU) race condition during the Endpoint Security for Linux Threat Prevention and Firewall (ENSL TP/FW) installation process, a local user can perform a privilege escalation attack to obtain administrator privileges for the purpose of executing arbitrary code through insecure use of predictable temporary file locations. Additional Analyst Notes: - CVE Program Con
arbitrary code through insecure use of predictable temporary file locations. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10355
CVE ID: CVE-2021-23893 State: PUBLISHED Published: 2021-10-01T09:25:11 Last Updated: 2024-08-03T19:14:09.452Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Drive Encryption (MDE) Problem Types: CWE-269 Description: Privilege Escalation vulnerability in a Windows system driver of McAfee Drive Encryption (DE) prior to 7.3.0 could allow a local non-admin user to gain elevated system privileges via exploiting an unutilized memory buffer. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10361
CVE ID: CVE-2021-23894 State: PUBLISHED Published: 2021-06-02T13:05:15 Last Updated: 2024-08-03T19:14:09.394Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Database Security (DBSec) Problem Types: CWE-502 Description: Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote unauthenticated attacker to create a reverse shell with administrator privileges on the DBSec server via carefully constructed Java serialized object sent to the DBSec server. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB1035
ional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10359
CVE ID: CVE-2021-23895 State: PUBLISHED Published: 2021-06-02T13:05:20 Last Updated: 2024-08-03T19:14:09.408Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Database Security (DBSec) Problem Types: CWE-502 Description: Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to create a reverse shell with administrator privileges on the DBSec server via carefully constructed Java serialized object sent to the DBSec server. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10359
CVE ID: CVE-2021-23896 State: PUBLISHED Published: 2021-06-02T13:10:15 Last Updated: 2024-08-03T19:14:09.467Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: McAfee,LLC Products: McAfee Database Security (DBSec) Problem Types: CWE-319 Description: Cleartext Transmission of Sensitive Information vulnerability in the administrator interface of McAfee Database Security (DBSec) prior to 4.8.2 allows an administrator to view the unencrypted password of the McAfee Insights Server used to pass data to the Insights Server. This user is restricted to only have access to DBSec data in the Insights Server. Additional Analyst Notes: - CVE Program Container: References: - h
nly have access to DBSec data in the Insights Server. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10359
CVE ID: CVE-2021-23897 State: REJECTED Published: 2021-07-22T15:50:42 Last Updated: 2021-07-22T15:50:42 Description: No description available.
CVE ID: CVE-2021-23899 State: PUBLISHED Published: 2021-01-13T15:49:56 Last Updated: 2024-08-03T19:14:09.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OWASP/json-sanitizer/compare/v1.2.1...v1.2.2 - https://groups.google.com/g/json-sanitizer-support/c/dAW1AeNMoA0 - https://github.com/OWASP/json-sanitizer/commit/a37f594f7378a1c76b3283e0dab9e1ab1dc0247e
CVE ID: CVE-2021-23900 State: PUBLISHED Published: 2021-01-13T15:50:51 Last Updated: 2024-08-03T19:14:09.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the application is not prepared to handle these situations. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OWASP/json-sanitizer/compare/v1.2.1...v1.2.2 - https://groups.google.com/g/json-sanitizer-support/c/dAW1AeNMoA0 - https://github.com/OWASP/json-sanitizer/commit/a37f594f7378a1c76b3283e0dab9e1ab1dc0247e
CVE ID: CVE-2021-23901 State: PUBLISHED Published: 2021-01-25T09:25:14.000Z Last Updated: 2025-02-13T16:27:46.383Z Vendors: Apache Software Foundation Products: Apache Nutch Problem Types: CWE-611 Description: An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is
filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Nutch 1.18. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r090321840b44cc91086c4e317bf2baffa270749dde6c1273b6567f7c%40%3Cdev.nutch.apache.org%3E - https://issues.apache.org/jira/browse/NUTCH-2841 - https://lists.apache.org/thread.html/r7ddfd680aa7ea001ca8da63bb23e3f8caa095a8b4f2261e46bade5c7%40%3Cdev.nutch.apache.org%3E - https://lists.apache.org/thread.html/r5e2f7737b42c73a3325f3c2c8cdee1ec27631b3a0e144104d84d70e6%40%3Cannounce.apache.org%3E - https://security.netapp.com/advisory/ntap-20210513-0003/
CVE ID: CVE-2021-23906 State: PUBLISHED Published: 2021-05-13T18:56:32 Last Updated: 2024-08-03T19:14:09.454Z Severity: LOW (CVSS 1.8 CVSS:3.1/AC:H/AV:P/A:N/C:N/I:L/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A Message Length is not checked in the HiQnet Protocol, leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://media.daimler.com/marsMediaSite/en/instance/ko.xhtml?oid=49946866 - https://keenlab.tencent.com/en/2021/05/12/Tencent-Security-Keen-Lab-Experimental-Security-Assessment-on-Mercedes-
6866 - https://keenlab.tencent.com/en/2021/05/12/Tencent-Security-Keen-Lab-Experimental-Security-Assessment-on-Mercedes-Benz-Cars/ - https://keenlab.tencent.com/en/whitepapers/Mercedes_Benz_Security_Research_Report_Final.pdf
CVE ID: CVE-2021-23907 State: PUBLISHED Published: 2021-05-13T18:56:51 Last Updated: 2024-08-03T19:14:09.387Z Severity: LOW (CVSS 2.9 CVSS:3.1/AC:H/AV:P/A:N/C:L/I:L/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The count in MultiSvGet, GetAttributes, and MultiSvSet is not checked in the HiQnet Protocol, leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://media.daimler.com/marsMediaSite/en/instance/ko.xhtml?oid=49946866 - https://keenlab.tencent.com/en/2021/05/12/Tencent-Security-Keen-Lab-Experim
ediaSite/en/instance/ko.xhtml?oid=49946866 - https://keenlab.tencent.com/en/2021/05/12/Tencent-Security-Keen-Lab-Experimental-Security-Assessment-on-Mercedes-Benz-Cars/ - https://keenlab.tencent.com/en/whitepapers/Mercedes_Benz_Security_Research_Report_Final.pdf
CVE ID: CVE-2021-23908 State: PUBLISHED Published: 2021-05-13T18:57:21 Last Updated: 2024-08-03T19:14:09.466Z Severity: LOW (CVSS 2.9 CVSS:3.1/AC:H/AV:P/A:N/C:L/I:L/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A type confusion issue affects MultiSvSetAttributes in the HiQnet Protocol, leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://media.daimler.com/marsMediaSite/en/instance/ko.xhtml?oid=49946866 - https://keenlab.tencent.com/en/2021/05/12/Tencent-Security-Keen-Lab-Experimental-Security-Ass
ce/ko.xhtml?oid=49946866 - https://keenlab.tencent.com/en/2021/05/12/Tencent-Security-Keen-Lab-Experimental-Security-Assessment-on-Mercedes-Benz-Cars/ - https://keenlab.tencent.com/en/whitepapers/Mercedes_Benz_Security_Research_Report_Final.pdf
CVE ID: CVE-2021-23909 State: PUBLISHED Published: 2021-05-13T18:57:38 Last Updated: 2024-08-03T19:14:09.561Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AC:L/AV:L/A:H/C:L/I:H/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The SH2 MCU allows remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://media.daimler.com/marsMediaSite/en/instance/ko.xhtml?oid=49946866 - https://keenlab.tencent.com/en/2021/05/12/Tencent-Security-Keen-Lab-Experimental-Security-Assessment-on-Mercedes-Benz-Cars/ - https://keenlab.tencent.com/en/whitepap
cent-Security-Keen-Lab-Experimental-Security-Assessment-on-Mercedes-Benz-Cars/ - https://keenlab.tencent.com/en/whitepapers/Mercedes_Benz_Security_Research_Report_Final.pdf
CVE ID: CVE-2021-23910 State: PUBLISHED Published: 2021-05-13T18:57:47 Last Updated: 2024-08-03T19:14:09.624Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:L/A:L/C:L/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. There is an out-of-bounds array access in RemoteDiagnosisApp. Additional Analyst Notes: - CVE Program Container: References: - https://media.daimler.com/marsMediaSite/en/instance/ko.xhtml?oid=49946866 - https://keenlab.tencent.com/en/2021/05/12/Tencent-Security-Keen-Lab-Experimental-Security-Assessment-on-Mercedes-Benz-Cars/ - https://keenlab.ten
om/en/2021/05/12/Tencent-Security-Keen-Lab-Experimental-Security-Assessment-on-Mercedes-Benz-Cars/ - https://keenlab.tencent.com/en/whitepapers/Mercedes_Benz_Security_Research_Report_Final.pdf