Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-43925 State: PUBLISHED Published: 2022-02-07T02:15:11.105045Z Last Updated: 2024-09-17T03:22:38.760Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Synology Products: DiskStation Manager (DSM) Problem Types: CWE-89 Description: Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_22_01
CVE ID: CVE-2021-43926 State: PUBLISHED Published: 2022-02-07T02:15:16.305057Z Last Updated: 2024-09-16T20:48:02.019Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Synology Products: DiskStation Manager (DSM) Problem Types: CWE-89 Description: Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_22_01
CVE ID: CVE-2021-43927 State: PUBLISHED Published: 2022-02-07T02:15:21.419274Z Last Updated: 2024-09-16T20:21:27.425Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Synology Products: DiskStation Manager (DSM) Problem Types: CWE-89 Description: Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_22_01
CVE ID: CVE-2021-43928 State: PUBLISHED Published: 2022-02-07T02:15:26.417504Z Last Updated: 2024-09-17T00:10:57.112Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Synology Products: Mail Station Problem Types: CWE-78 Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving component in Synology Mail Station before 20211105-10315 allows remote authenticated users to execute arbitrary commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_21_28
CVE ID: CVE-2021-43929 State: PUBLISHED Published: 2022-02-07T02:15:31.468664Z Last Updated: 2024-09-16T20:58:16.813Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Synology Products: DiskStation Manager (DSM) Problem Types: CWE-74 Description: Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_22_01
CVE ID: CVE-2021-43930 State: PUBLISHED Published: 2022-04-28T14:53:29.000Z Last Updated: 2025-04-16T16:27:52.498Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Elcomplus Products: SmartPTT Problem Types: CWE-22 Description: Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-04
CVE ID: CVE-2021-43931 State: PUBLISHED Published: 2021-12-06T17:40:45 Last Updated: 2024-08-04T04:10:17.161Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Distributed Data Systems Products: WebHMI Problem Types: Authentication Bypass by Primary Weakness Description: The authentication algorithm of the WebHMI portal is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-336-03
CVE ID: CVE-2021-43932 State: PUBLISHED Published: 2022-04-28T14:54:57.000Z Last Updated: 2025-04-16T17:55:04.470Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Elcomplus Products: SmartPTT Problem Types: CWE-79 Description: Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-04
CVE ID: CVE-2021-43933 State: PUBLISHED Published: 2022-04-20T15:30:30.872Z Last Updated: 2025-04-16T16:28:45.372Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: FANUC Products: ROBOGUIDE Problem Types: CWE-400 Description: The affected product is vulnerable to a network-based attack by threat actors sending unimpeded requests to the receiving server, which could cause a denial-of-service condition due to lack of heap memory resources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-03
CVE ID: CVE-2021-43934 State: PUBLISHED Published: 2022-04-28T14:54:20.000Z Last Updated: 2025-04-16T16:27:44.690Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Elcomplus Products: SmartPTT Problem Types: CWE-434 Description: Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload arbitrary files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-04
CVE ID: CVE-2021-43935 State: PUBLISHED Published: 2021-12-15T18:05:16.799122Z Last Updated: 2024-09-16T23:11:47.219Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hillrom Products: Welch Allyn Q-Stress Cardiac Stress Testing System, Welch Allyn X-Scribe Cardiac Stress Testing System, Welch Allyn Diagnostic Cardiology Suite, Welch Allyn Vision Express, Welch Allyn H-Scribe Holter Analysis System, Welch Allyn R-Scribe Resting ECG System, Welch Allyn Connex Cardio Problem Types: CWE-288 Description: The impacted products, when configured to use SSO, are affected by an improper authentication vulnerability. This vulnerability allows the application to accept ma
se SSO, are affected by an improper authentication vulnerability. This vulnerability allows the application to accept manual entry of any active directory (AD) account provisioned in the application without supplying a password, resulting in access to the application as the supplied AD account, with all associated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-21-343-01
CVE ID: CVE-2021-43936 State: PUBLISHED Published: 2021-12-06T17:39:24 Last Updated: 2024-08-04T04:10:16.987Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Distributed Data Systems Products: WebHMI Problem Types: Unrestricted Upload of File with Dangerous Type Description: The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's environment or lead to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-336-03 - http://packetstormsecurity.com/files/165252/WebHMI-4.0-Remo
: - https://us-cert.cisa.gov/ics/advisories/icsa-21-336-03 - http://packetstormsecurity.com/files/165252/WebHMI-4.0-Remote-Code-Execution.html
CVE ID: CVE-2021-43937 State: PUBLISHED Published: 2022-04-29T15:17:35.000Z Last Updated: 2025-04-16T16:27:36.910Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Elcomplus Products: SmartPTT SCADA Server Problem Types: CWE-200 Description: Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-05
CVE ID: CVE-2021-43938 State: PUBLISHED Published: 2022-04-29T15:18:14.000Z Last Updated: 2025-04-16T17:54:48.244Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Elcomplus Products: SmartPTT SCADA Server Problem Types: CWE-200 Description: Elcomplus SmartPTT SCADA Server is vulnerable to an unauthenticated user can request various files from the server without any authentication or authorization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-05
CVE ID: CVE-2021-43939 State: PUBLISHED Published: 2022-04-28T14:55:52.000Z Last Updated: 2025-04-16T17:54:55.849Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Elcomplus Products: SmartPTT Problem Types: CWE-285 Description: Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests directly to the desired endpoints. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-04
CVE ID: CVE-2021-43940 State: PUBLISHED Published: 2022-02-15T03:15:09.899432Z Last Updated: 2024-10-08T16:38:51.537Z Vendors: Atlassian Products: Confluence Server, Confluence Data Center Problem Types: CWE-427 Description: Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking vulnerability in the Confluence installer. This vulnerability only affects installations of Confluence Server and Data Center on Windows. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
10, and from version 7.5.0 before 7.12.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/CONFSERVER-66550
CVE ID: CVE-2021-43941 State: PUBLISHED Published: 2022-02-15T03:30:09.668920Z Last Updated: 2024-10-08T17:37:25.273Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Cross Site Request Forgery (CSRF) Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPage.jspa and ImporterValueMappingsPage.jspa) via a Cross-Site Request Forgery (CSRF) vulnerability in the jira-importers-plugin. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.at
before 8.20.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-73073
CVE ID: CVE-2021-43942 State: PUBLISHED Published: 2022-01-04T02:40:09.824497Z Last Updated: 2024-10-08T14:23:31.116Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Reflected Cross-Site Scripting (RXSS) Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue, the attacker must trick a user into visiting a malicious website. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. Additional Analyst Notes: - CVE Program Contain
sions are before version 8.13.15, and from version 8.14.0 before 8.20.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-73068
CVE ID: CVE-2021-43943 State: PUBLISHED Published: 2022-02-24T04:40:09.642056Z Last Updated: 2024-10-04T18:12:24.195Z Vendors: Atlassian Products: Jira Service Management Server, Jira Service Management Data Center Problem Types: Stored XSS (SXSS) Description: Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the "Object Schema" field of /secure/admin/InsightDefaultCustomFieldConfig.jspa. The affected versions are before version 4.21.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
before version 4.21.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JSDSERVER-10980
CVE ID: CVE-2021-43944 State: PUBLISHED Published: 2022-03-08T02:00:13.209320Z Last Updated: 2024-10-04T18:45:21.133Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Remote Code Execution (RCE) Description: This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3
in the Email Templates feature. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-73072
CVE ID: CVE-2021-43945 State: PUBLISHED Published: 2022-02-28T00:20:09.118520Z Last Updated: 2024-10-04T18:12:49.031Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Stored Cross-Site Scripting (SXSS) Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrary HTML or JavaScript via a Stored Cross-Site Scripting (SXSS) vulnerability in the /rest/jpo/1.0/hierarchyConfiguration endpoint. The affected versions are before version 8.20.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-73069
CVE ID: CVE-2021-43946 State: PUBLISHED Published: 2022-01-05T03:40:09.602779Z Last Updated: 2024-10-08T14:24:15.786Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Improper Authorization Description: Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscriptions via a Broken Access Control vulnerability in the /secure/EditSubscription.jspa endpoint. The affected versions are before version 8.13.21, and from version 8.14.0 before 8.20.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-73071
CVE ID: CVE-2021-43947 State: PUBLISHED Published: 2022-01-06T01:05:10.045123Z Last Updated: 2024-10-08T14:34:08.233Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Remote Code Execution (RCE) Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Execution (RCE) vulnerability in the Email Templates feature. This issue bypasses the fix of https://jira.atlassian.com/browse/JSDSERVER-8665. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Ref
, and from version 8.14.0 before 8.20.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-73067
CVE ID: CVE-2021-43948 State: PUBLISHED Published: 2022-02-15T03:35:10.202942Z Last Updated: 2024-10-08T17:38:45.124Z Vendors: Atlassian Products: Jira Service Management Server, Jira Service Management Data Center Problem Types: Improper Authorization Description: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of private objects via an Improper Authorization vulnerability in the "Move objects" feature. The affected versions are before version 4.21.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JSDSERVER-10981
CVE ID: CVE-2021-43949 State: PUBLISHED Published: 2022-01-10T15:26:24.469303Z Last Updated: 2024-10-04T18:11:30.539Z Vendors: Atlassian Products: Jira Service Management Server, Jira Service Management Data Center Problem Types: Improper Authorization Description: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects via a Broken Access Control vulnerability in the Custom Fields feature. The affected versions are before version 4.21.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JSDSERVER-10982
CVE ID: CVE-2021-43950 State: PUBLISHED Published: 2022-02-15T03:10:09.438944Z Last Updated: 2024-10-08T14:50:26.957Z Vendors: Atlassian Products: Jira Service Management Server, Jira Service Management Data Center Problem Types: Improper Authorization Description: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source configuration information via a Broken Access Control vulnerability in the Insight Import Source feature. The affected versions are before version 4.21.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JSDSERVER-10983
CVE ID: CVE-2021-43951 State: PUBLISHED Published: 2022-01-10T15:26:14.791209Z Last Updated: 2024-10-08T14:34:52.907Z Vendors: Atlassian Products: Jira Service Management Server, Jira Service Management Data Center Problem Types: Improper Authorization Description: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import configuration details via an Information Disclosure vulnerability in the Create Object type mapping feature. The affected versions are before version 4.21.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JSDSERVER-10984
CVE ID: CVE-2021-43952 State: PUBLISHED Published: 2022-02-15T00:45:10.037761Z Last Updated: 2024-10-04T18:11:59.302Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Cross-Site Request Forgery (CSRF) Description: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/RestoreDefaults.jspa endpoint. The affected versions are before version 8.21.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-73138
CVE ID: CVE-2021-43953 State: PUBLISHED Published: 2022-02-15T02:40:10.288350Z Last Updated: 2024-10-08T14:38:59.629Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Cross-Site Request Forgery (CSRF) Description: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU monitoring settings via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/ViewInstrumentation.jspa endpoint. The affected versions are before version 8.13.16, and from version 8.14.0 before 8.20.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.a
before 8.20.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-73170
CVE ID: CVE-2021-43954 State: PUBLISHED Published: 2022-03-14T01:45:18.016064Z Last Updated: 2024-10-04T18:45:42.732Z Vendors: Atlassian Products: Fisheye, Crucible Problem Types: Server Side Request Forgery (SSRF) Description: The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/FE-7384 - https://jira.atlassian.com/browse/CRUC-8520
CVE ID: CVE-2021-43955 State: PUBLISHED Published: 2022-03-16T00:55:15.263201Z Last Updated: 2024-10-03T14:32:10.648Z Vendors: Atlassian Products: Fisheye, Crucible Problem Types: Information Disclosure Description: The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about installation directories via information disclosure vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/FE-7397 - https://jira.atlassian.com/browse/CRUC-8533
CVE ID: CVE-2021-43956 State: PUBLISHED Published: 2022-03-16T00:55:16.739962Z Last Updated: 2024-10-03T14:32:50.447Z Vendors: Atlassian Products: Fisheye, Crucible Problem Types: Cross Site Scripting (XSS) Description: The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/FE-7395 - https://jira.atlassian.com/browse/CRUC-8531
CVE ID: CVE-2021-43957 State: PUBLISHED Published: 2022-03-16T00:55:18.206995Z Last Updated: 2024-10-04T18:50:25.464Z Vendors: Atlassian Products: Fisheye, Crucible Problem Types: Insecure Direct Object References (IDOR) Description: Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/FE-7388 - https://jira.atlassian.com/brow
iner: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/FE-7388 - https://jira.atlassian.com/browse/CRUC-8524