Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-41297 State: PUBLISHED Published: 2021-09-30T10:41:00.486934Z Last Updated: 2024-09-16T20:22:39.752Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ECOA Products: ECS Router Controller ECS (FLASH), RiskBuster Terminator E6L45, RiskBuster System RB 3.0.0, RiskBuster System TRANE 1.0, Graphic Control Software, SmartHome II E9246, RiskTerminator Problem Types: CWE-522 Description: ECOA BAS controller is vulnerable to weak access control mechanism allowing authenticated user to remotely escalate privileges by disclosing credentials of administrative accounts in plain-text. Additional Analyst Notes: - CVE Program Container: References: - https://w
als of administrative accounts in plain-text. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5133-f3c4b-1.html
CVE ID: CVE-2021-41298 State: PUBLISHED Published: 2021-09-30T10:41:02.047884Z Last Updated: 2024-09-16T20:16:40.291Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ECOA Products: ECS Router Controller ECS (FLASH), RiskBuster Terminator E6L45, RiskBuster System RB 3.0.0, RiskBuster System TRANE 1.0, Graphic Control Software, SmartHome II E9246, RiskTerminator Problem Types: CWE-284 Description: ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers with general user's privilege can remotely bypass authori
r-supplied input. As a result of this vulnerability, attackers with general user's privilege can remotely bypass authorization and access the hidden resources in the system and execute privileged functionalities. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5134-39f74-1.html
CVE ID: CVE-2021-41299 State: PUBLISHED Published: 2021-09-30T10:41:03.577361Z Last Updated: 2024-09-16T17:22:44.543Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ECOA Products: ECS Router Controller ECS (FLASH), RiskBuster Terminator E6L45, RiskBuster System RB 3.0.0, RiskBuster System TRANE 1.0, Graphic Control Software, SmartHome II E9246, RiskTerminator Problem Types: CWE-798 Description: ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers can obtain administrator’s privilege without logging in. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.t
privilege without logging in. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5135-a9f5c-1.html
CVE ID: CVE-2021-41300 State: PUBLISHED Published: 2021-09-30T10:41:05.097264Z Last Updated: 2024-09-16T23:41:00.205Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ECOA Products: ECS Router Controller ECS (FLASH), RiskBuster Terminator E6L45, RiskBuster System RB 3.0.0, RiskBuster System TRANE 1.0, Graphic Control Software, SmartHome II E9246, RiskTerminator Problem Types: CWE-522 Description: ECOA BAS controller’s special page displays user account and passwords in plain text, thus unauthenticated attackers can access the page and obtain privilege with full functionality. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcer
in privilege with full functionality. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5136-3e315-1.html
CVE ID: CVE-2021-41301 State: PUBLISHED Published: 2021-09-30T10:41:06.633278Z Last Updated: 2024-09-16T16:53:19.967Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ECOA Products: ECS Router Controller ECS (FLASH), RiskBuster Terminator E6L45, RiskBuster System RB 3.0.0, RiskBuster System TRANE 1.0, Graphic Control Software, SmartHome II E9246, RiskTerminator Problem Types: CWE-200 Description: ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authenticati
t. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5137-730a6-1.html
CVE ID: CVE-2021-41302 State: PUBLISHED Published: 2021-09-30T10:41:08.156249Z Last Updated: 2024-09-16T20:21:36.719Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: ECOA Products: ECS Router Controller ECS (FLASH), RiskBuster Terminator E6L45, RiskBuster System RB 3.0.0, RiskBuster System TRANE 1.0, Graphic Control Software, SmartHome II E9246, RiskTerminator Problem Types: CWE-311 Description: ECOA BAS controller stores sensitive data (backup exports) in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s privilege. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-13
in user’s privilege. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5138-d40ae-1.html
CVE ID: CVE-2021-41303 State: PUBLISHED Published: 2021-09-17T08:20:12 Last Updated: 2024-08-04T03:08:32.012Z Vendors: Apache Software Foundation Products: Apache Shiro Problem Types: CWE-287 Description: Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/re470be1ffea44bca28ccb0e67a4cf5d744e2d2b981d00fdbbf5abc13%40%3Cannounce.shiro.apache.org%3E - https://lists.apache.org/thread.html/raae98bb934e4bde304465896ea02d9798e257e486d04a42221e2c41b%40%3Cuser.shiro.apache.
- https://lists.apache.org/thread.html/raae98bb934e4bde304465896ea02d9798e257e486d04a42221e2c41b%40%3Cuser.shiro.apache.org%3E - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20220609-0001/
CVE ID: CVE-2021-41304 State: PUBLISHED Published: 2021-10-26T04:15:16.660922Z Last Updated: 2024-10-10T16:06:39.135Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Cross-Site Scripting (XSS) Description: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the /secure/admin/ImporterFinishedPage.jspa error message. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72939
CVE ID: CVE-2021-41305 State: PUBLISHED Published: 2021-10-26T04:15:18.259539Z Last Updated: 2024-10-09T16:52:39.165Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Insecure Direct Object References (IDOR) Description: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filters via an Insecure Direct Object References (IDOR) vulnerability in the Average Number of Times in Status Gadget. The affected versions are before version 8.13.12.. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72813
CVE ID: CVE-2021-41306 State: PUBLISHED Published: 2021-10-26T04:15:19.782890Z Last Updated: 2024-10-09T18:21:09.274Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Insecure Direct Object References (IDOR) Description: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an Insecure Direct Object References (IDOR) vulnerability in the Average Time in Status Gadget. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVE
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72915
CVE ID: CVE-2021-41307 State: PUBLISHED Published: 2021-10-26T04:15:21.297549Z Last Updated: 2024-10-09T19:20:41.686Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Insecure Direct Object References (IDOR) Description: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and private filters via an Insecure Direct Object References (IDOR) vulnerability in the Workload Pie Chart Gadget. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.
.20.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72916
CVE ID: CVE-2021-41308 State: PUBLISHED Published: 2021-10-26T04:15:22.911855Z Last Updated: 2024-10-09T19:23:22.782Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: CWE-285 Description: Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings via a Broken Access Control vulnerability in the `ReplicationSettings!default.jspa` endpoint. The affected versions are before version 8.6.0, from version 8.7.0 before 8.13.12, and from version 8.14.0 before 8.20.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.co
0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72940
CVE ID: CVE-2021-41309 State: PUBLISHED Published: 2021-12-08T03:35:10.422291Z Last Updated: 2024-10-10T13:52:47.289Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: CWE-287 Description: Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of another user's Jira Service Management project via a Broken Authentication vulnerability in the /plugins/servlet/audit/resource endpoint. The affected versions of Jira Server and Data Center are before version 8.19.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com
.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72803
CVE ID: CVE-2021-41310 State: PUBLISHED Published: 2021-11-01T22:55:09.292649Z Last Updated: 2024-10-09T20:25:50.011Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Stored Cross-Site Scripting (SXSS) Description: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the Associated Projects feature (/secure/admin/AssociatedProjectsForCustomField.jspa). The affected versions are before version 8.5.19, from version 8.6.0 before 8.13.11, and from version 8.14.0 before 8.19.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnric
re 8.13.11, and from version 8.14.0 before 8.19.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72800
CVE ID: CVE-2021-41311 State: PUBLISHED Published: 2021-12-08T03:35:11.838761Z Last Updated: 2024-10-10T14:00:43.454Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: CWE-287 Description: Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify projects' Users & Roles settings, via a Broken Authentication vulnerability in the /plugins/servlet/project-config/PROJECT/roles endpoint. The affected versions are before version 8.19.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72802
CVE ID: CVE-2021-41312 State: PUBLISHED Published: 2021-11-03T03:50:33.432948Z Last Updated: 2024-10-10T13:45:52.185Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: CWE-287 Description: Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Management to enable and disable Issue Collectors on Jira Service Management projects via an Improper Authentication vulnerability in the /secure/ViewCollectors endpoint. The affected versions are before version 8.19.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72801
CVE ID: CVE-2021-41313 State: PUBLISHED Published: 2021-11-01T03:05:09.100335Z Last Updated: 2024-10-08T14:22:21.571Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: CWE-285 Description: Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurations via an Improper Authorization vulnerability in the /secure/admin/ConfigureBatching!default.jspa endpoint. The affected versions are before version 8.20.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72898
CVE ID: CVE-2021-41314 State: PUBLISHED Published: 2021-09-16T22:00:37 Last Updated: 2024-08-04T03:08:31.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of the authentication scheme - allows the attacker to create (or overwrite) a file with specific content (e.g., the "2" string). This leads to admin session crafting and therefore gaining full web UI admin privileges by an unauthenticated attacker. This affects GC108P before 1.0.8.2, GC108PP before 1.0.8.2, GS108Tv3 before 7.0.7.2, GS110TPP before 7.0.7.2, GS110TPv3 before 7.0.7.2, GS110TUP befor
.8.2, GC108PP before 1.0.8.2, GS108Tv3 before 7.0.7.2, GS110TPP before 7.0.7.2, GS110TPv3 before 7.0.7.2, GS110TUP before 1.0.5.3, GS308T before 1.0.3.2, GS310TP before 1.0.3.2, GS710TUP before 1.0.5.3, GS716TP before 1.0.4.2, GS716TPP before 1.0.4.2, GS724TPP before 2.0.6.3, GS724TPv2 before 2.0.6.3, GS728TPPv2 before 6.0.8.2, GS728TPv2 before 6.0.8.2, GS750E before 1.0.1.10, GS752TPP before 6.0.8.2, GS752TPv2 before 6.0.8.2, MS510TXM before 1.0.4.2, and MS510TXUP before 1.0.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000063978/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Smart-Switches-PSV-2021-0140-PSV-2021-0144-PSV-2021-0145 - ht
978/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Smart-Switches-PSV-2021-0140-PSV-2021-0144-PSV-2021-0145 - https://gynvael.coldwind.pl/?id=742
CVE ID: CVE-2021-41315 State: PUBLISHED Published: 2021-09-17T14:46:17 Last Updated: 2024-08-04T03:08:32.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Device42 Remote Collector before 17.05.01 does not sanitize user input in its SNMP Connectivity utility. This allows an authenticated attacker (with access to the console application) to execute arbitrary OS commands and escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://docs.device42.com/auto-discovery/remote-collector-rc/ - https://blog.device42.com/2021/09/critical-fixes-in-17-05-01/
CVE ID: CVE-2021-41316 State: PUBLISHED Published: 2021-09-17T14:45:53 Last Updated: 2024-08-04T03:08:31.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility. An attacker (with permissions to add or edit jobs run by this utility) can inject an extra argument to overwrite arbitrary files as the root user on the Remote Collector. Additional Analyst Notes: - CVE Program Container: References: - https://docs.device42.com/auto-discovery/remote-collector-rc/ - https://blog.device42.com/2021/09/critical-fixes-in-17-05-01/ - https://docs.device42.com/auto-discovery/nmap-autodiscovery/
CVE ID: CVE-2021-41317 State: PUBLISHED Published: 2021-09-17T15:11:54 Last Updated: 2024-08-04T03:08:31.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mandatoryprogrammer/xsshunter-express/commit/56bb44ed9024849f64173f71583ecb7d873baba0 - https://docs.google.com/document/d/12rq4YIFZLSmZlEsq7d7hYCI1qO5xyIxA1Wrs1m4y9-4/preview - https://vuln.ryotak.me/advisories/57
CVE ID: CVE-2021-41318 State: PUBLISHED Published: 2021-09-28T17:40:25 Last Updated: 2024-08-04T03:08:32.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input. which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://knowledgebase.progress.com/articles/Knowledge/WhatsUp-Gold-Security-Bulletin-September-2021 - http://packetstormsecurity.com/files/164359/WhatsUpGold-21.0.3-Cross-Site-Scripting.html
CVE ID: CVE-2021-41320 State: PUBLISHED Published: 2021-10-15T15:39:00.000Z Last Updated: 2025-05-30T16:01:56.119Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AC:L/AV:L/A:N/C:H/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: A technical user has hardcoded credentials in Wallstreet Suite TRM 7.4.83 (64-bit edition) with higher privilege than the average authenticated user. NOTE: the vendor disputes this because the password is not hardcoded (it can be changed during installation or at any later time). Additional Analyst Notes: - CVE Program Container: References: - https://iongroup.com/ion-treasury/products/wallstreet-suite/ - https://excellium-services.com/cert-xlm-advi
eferences: - https://iongroup.com/ion-treasury/products/wallstreet-suite/ - https://excellium-services.com/cert-xlm-advisory/CVE-2021-41320 - https://client-connect.iongroup.com/library/content/treasury-management/wallstreet-suite/security/suite-7-4-83/user-passwords/ - https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-41320
CVE ID: CVE-2021-41322 State: PUBLISHED Published: 2021-10-04T05:52:06 Last Updated: 2024-08-04T03:08:31.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: Poly VVX 400/410 5.3.1 allows low-privileged users to change the Admin password by modifying a POST parameter to 120 during the password reset process. Additional Analyst Notes: - CVE Program Container: References: - https://support.polycom.com/content/support.html - https://packetstormsecurity.com/files/140753/Polycom-VVX-Web-Interface-Privilege-Escalation.html
CVE ID: CVE-2021-41323 State: PUBLISHED Published: 2021-09-30T18:48:46 Last Updated: 2024-08-04T03:08:32.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal in the Compress feature in Pydio Cells 2.2.9 allows remote authenticated users to overwrite personal files, or Cells files belonging to any user, via the format parameter. Additional Analyst Notes: - CVE Program Container: References: - https://pydio.com/fr/community/releases/pydio-cells/pydio-cells-enterprise-2212 - https://github.com/pydio/cells/releases/tag/v2.2.12 - https://charonv.net/Pydio-Broken-Access-Control/
CVE ID: CVE-2021-41324 State: PUBLISHED Published: 2021-09-30T20:39:57 Last Updated: 2024-08-04T03:08:32.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal files (or Cells files belonging to any user) via the nodes parameter (for Copy and Move) or via the Path parameter (for Delete). Additional Analyst Notes: - CVE Program Container: References: - https://pydio.com/fr/community/releases/pydio-cells/pydio-cells-enterprise-2212 - https://github.com/pydio/cells/releases/tag/v2.2.12 - https://charonv.net/Pydio-Broken-Access-Control/
CVE ID: CVE-2021-41325 State: PUBLISHED Published: 2021-09-30T18:52:32 Last Updated: 2024-08-04T03:08:32.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter. (In addition, such users can be granted several admin permissions via the Roles parameter.) Additional Analyst Notes: - CVE Program Container: References: - https://pydio.com/fr/community/releases/pydio-cells/pydio-cells-enterprise-2212 - https://github.com/pydio/cells/releases/tag/v2.2.12 - https://charonv.net/Pydio-Broken-Access-Control/
CVE ID: CVE-2021-41326 State: PUBLISHED Published: 2021-09-17T00:00:00 Last Updated: 2024-08-04T03:08:32.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/e36f73947e741bc97320f0c42199acd1a94c7051 - https://github.com/MISP/MISP/compare/v2.4.147...v2.4.148 - https://zigrin.com/advisories/misp-command-injection-vulnerability-in-opendata-export/
CVE ID: CVE-2021-41329 State: PUBLISHED Published: 2021-09-27T05:45:31 Last Updated: 2024-08-04T03:08:31.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: Datalust Seq before 2021.2.6259 allows users (with view filters applied to their accounts) to see query results not constrained by their view filter. This information exposure, caused by an internal cache key collision, occurs when the user's view filter includes an array or IN clause, and when another user has recently executed an identical query differing only by the array elements. Additional Analyst Notes: - CVE Program Container: References: - https://blog.datalust.co - https://github.com/datalust/seq-tickets/issues/1322
CVE ID: CVE-2021-41330 State: PUBLISHED Published: 2021-10-13T00:27:43 Last Updated: 2024-08-04T03:08:32.010Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2 Problem Types: Remote Code Execution Description: Microsoft Windows Media Foundation Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://portal
n Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41330