Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4757-893eb-1.html - https://www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344
CVE ID: CVE-2021-32542 State: PUBLISHED Published: 2021-05-28T08:10:27.711774Z Last Updated: 2024-09-16T19:05:10.400Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: SysJust Products: CTS Web Problem Types: CWE-79 Description: The parameters of the specific functions in the CTS Web trading system do not filter special characters, which allows unauthenticated attackers can remotely perform reflected XSS and obtain the users’ connection token that triggered the attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4758-82b05-1.html - https://www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344
CVE ID: CVE-2021-32543 State: PUBLISHED Published: 2021-05-28T08:10:28.395920Z Last Updated: 2024-09-16T22:24:59.184Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: SysJust Products: CTS Web Problem Types: CWE-287 Description: The CTS Web transaction system related to authentication management is implemented incorrectly. After login, remote attackers can manipulate cookies to access other accounts and trade in the stock market with spoofed identity. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4759-92eab-1.html - https://www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344
CVE ID: CVE-2021-32544 State: PUBLISHED Published: 2021-05-11T06:10:19.743682Z Last Updated: 2024-09-17T00:06:50.647Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Intelligent global technology Ltd Products: igt+ Problem Types: CWE-79 Description: Special characters of IGT search function in igt+ are not filtered in specific fields, which allow remote authenticated attackers can inject malicious JavaScript and carry out DOM-based XSS (Cross-site scripting) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4719-e298a-1.html
CVE ID: CVE-2021-32545 State: PUBLISHED Published: 2022-01-15T16:15:24 Last Updated: 2024-08-03T23:25:29.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pexip Infinity before 26 allows remote denial of service because of missing RTMP input validation. Additional Analyst Notes: - CVE Program Container: References: - https://docs.pexip.com/admin/security_bulletins.htm
CVE ID: CVE-2021-32546 State: PUBLISHED Published: 2022-05-31T21:21:18 Last Updated: 2024-08-03T23:25:30.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. An unprivileged attacker (registered user) can overwrite the Git configuration in his repository. This leads to Remote Command Execution, because that configuration can contain an option such as sshCommand, which is executed when a master branch is a remote branch (using an ssh:// URI). The remote branch can also be configured by editing the Git configuration file. One can create a new file in a new reposi
he remote branch can also be configured by editing the Git configuration file. One can create a new file in a new repository, using the GUI, with "\" as its name, and then rename this file to .git/config with the custom configuration content (and then save it). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gogs/gogs/releases - https://github.com/gogs/gogs/security/advisories/GHSA-56j7-2pm8-rgmx
CVE ID: CVE-2021-32547 State: PUBLISHED Published: 2021-06-12T03:40:36.400946Z Last Updated: 2024-09-17T03:18:22.707Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: Canonical Products: apport Problem Types: CWE-59, CWE-61 Description: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-lts package apport hooks, it could expose private data to other local users. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904
CVE ID: CVE-2021-32548 State: PUBLISHED Published: 2021-06-12T03:40:37.135607Z Last Updated: 2024-09-16T18:29:09.540Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: Canonical Products: apport Problem Types: CWE-59, CWE-61 Description: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-8 package apport hooks, it could expose private data to other local users. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904
CVE ID: CVE-2021-32549 State: PUBLISHED Published: 2021-06-12T03:40:37.848951Z Last Updated: 2024-09-16T23:11:32.731Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: Canonical Products: apport Problem Types: CWE-59, CWE-61 Description: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package apport hooks, it could expose private data to other local users. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904
CVE ID: CVE-2021-32550 State: PUBLISHED Published: 2021-06-12T03:40:38.559899Z Last Updated: 2024-09-16T23:22:01.152Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: Canonical Products: apport Problem Types: CWE-59, CWE-61 Description: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package apport hooks, it could expose private data to other local users. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904
CVE ID: CVE-2021-32551 State: PUBLISHED Published: 2021-06-12T03:40:39.210630Z Last Updated: 2024-09-16T20:21:31.720Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: Canonical Products: apport Problem Types: CWE-59, CWE-61 Description: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package apport hooks, it could expose private data to other local users. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904
CVE ID: CVE-2021-32552 State: PUBLISHED Published: 2021-06-12T03:40:39.859698Z Last Updated: 2024-09-17T02:37:33.692Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: Canonical Products: apport Problem Types: CWE-59, CWE-61 Description: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904
CVE ID: CVE-2021-32553 State: PUBLISHED Published: 2021-06-12T03:40:40.514625Z Last Updated: 2024-09-16T22:51:04.819Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: Canonical Products: apport Problem Types: CWE-59, CWE-61 Description: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904
CVE ID: CVE-2021-32554 State: PUBLISHED Published: 2021-06-12T03:40:41.158908Z Last Updated: 2024-09-16T23:20:32.516Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: Canonical Products: apport Problem Types: CWE-59, CWE-61 Description: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904
CVE ID: CVE-2021-32555 State: PUBLISHED Published: 2021-06-12T03:40:41.851905Z Last Updated: 2024-09-16T20:47:23.455Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: Canonical Products: apport Problem Types: CWE-59, CWE-61 Description: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg-hwe-18.04 package apport hooks, it could expose private data to other local users. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904
CVE ID: CVE-2021-32556 State: PUBLISHED Published: 2021-06-12T03:40:42.604686Z Last Updated: 2024-09-16T19:51:18.523Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Canonical Products: apport Problem Types: CWE-78 Description: It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904
CVE ID: CVE-2021-32557 State: PUBLISHED Published: 2021-06-12T03:40:43.352244Z Last Updated: 2024-09-16T17:53:05.508Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L) Vendors: Canonical Products: apport Problem Types: CWE-59, CWE-61 Description: It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904
CVE ID: CVE-2021-32558 State: PUBLISHED Published: 2021-07-27T05:19:34 Last Updated: 2024-08-03T23:25:30.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a packet that contains an unsupported media format, a crash can occur. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2021/Jul/49 - http://packetstormsecurity.com/files/163639/Asterisk-Project-Security-Advisory-AST-2021-008.html - https://downloads.asterisk.org/pub/sec
msecurity.com/files/163639/Asterisk-Project-Security-Advisory-AST-2021-008.html - https://downloads.asterisk.org/pub/security/AST-2021-008.html - https://issues.asterisk.org/jira/browse/ASTERISK-29392 - https://lists.debian.org/debian-lts-announce/2021/08/msg00005.html - https://www.debian.org/security/2021/dsa-4999
CVE ID: CVE-2021-32559 State: PUBLISHED Published: 2021-07-06T11:35:05 Last Updated: 2024-08-03T23:25:30.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow exists in pywin32 prior to version b301 when adding an access control entry (ACE) to an access control list (ACL) that would cause the size to be greater than 65535 bytes. An attacker who successfully exploited this vulnerability could crash the vulnerable process. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mhammond/pywin32/releases - https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0017/FEYE-2021-0017.md - https://github.com/mhammond/pywin
b.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0017/FEYE-2021-0017.md - https://github.com/mhammond/pywin32/issues/1700 - https://github.com/mhammond/pywin32/pull/1701
CVE ID: CVE-2021-32560 State: PUBLISHED Published: 2021-05-11T13:36:17 Last Updated: 2024-08-03T23:25:30.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files. Additional Analyst Notes: - CVE Program Container: References: - https://octoprint.org/blog/2021/04/27/new-release-1.6.0/ - https://github.com/OctoPrint/OctoPrint/releases/tag/1.6.0 - https://www.brzozowski.io/web-applications/2021/05/11/the-insecure-story-of-octoprint.html
CVE ID: CVE-2021-32561 State: PUBLISHED Published: 2021-05-11T13:38:43 Last Updated: 2024-08-03T23:25:30.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters. Additional Analyst Notes: - CVE Program Container: References: - https://octoprint.org/blog/2021/04/27/new-release-1.6.0/ - https://github.com/OctoPrint/OctoPrint/releases/tag/1.6.0 - https://www.brzozowski.io/web-applications/2021/05/11/the-insecure-story-of-octoprint.html
CVE ID: CVE-2021-32563 State: PUBLISHED Published: 2021-05-11T00:00:00 Last Updated: 2024-08-03T23:25:30.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.xfce.org/xfce/thunar/-/commit/9165a61f95e43cc0b5abf9b98eee2818a0191e0b - https://gitlab.xfce.org/xfce/thunar/-/commit/3b54d9d7dbd7fd16235e2141c43a7f18718f5664 - https://www.openwall.c
0191e0b - https://gitlab.xfce.org/xfce/thunar/-/commit/3b54d9d7dbd7fd16235e2141c43a7f18718f5664 - https://www.openwall.com/lists/oss-security/2021/05/09/2 - https://gitlab.xfce.org/xfce/thunar/-/tags - http://www.openwall.com/lists/oss-security/2021/05/11/3 - https://gitlab.xfce.org/xfce/thunar/-/commit/1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92d - http://www.openwall.com/lists/oss-security/2023/01/05/1 - http://www.openwall.com/lists/oss-security/2023/01/05/2
CVE ID: CVE-2021-32565 State: PUBLISHED Published: 2021-06-29T11:45:20 Last Updated: 2024-08-03T23:25:30.615Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-444 Description: Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ra1a41ff92a70d25bf576d7da2590575e8ff430393a3f4a0c34de4277%40%3Cusers.trafficserver.apache.org%3E - https://www.debian.org/security/2021/dsa-4957
CVE ID: CVE-2021-32566 State: PUBLISHED Published: 2021-06-30T07:15:19 Last Updated: 2024-08-03T23:25:30.377Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-20 Description: Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ra1a41ff92a70d25bf576d7da2590575e8ff430393a3f4a0c34de4277%40%3Cusers.trafficserver.apache.org%3E - https://www.debian.org/security/2021/dsa-4957
CVE ID: CVE-2021-32567 State: PUBLISHED Published: 2021-06-30T07:15:21 Last Updated: 2024-08-03T23:25:30.398Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-20 Description: Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ra1a41ff92a70d25bf576d7da2590575e8ff430393a3f4a0c34de4277%40%3Cusers.trafficserver.apache.org%3E - https://www.debian.org/security/2021/dsa-4957
CVE ID: CVE-2021-32568 State: PUBLISHED Published: 2021-09-06T11:17:15 Last Updated: 2024-08-03T23:25:30.861Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: zmister2016 Products: zmister2016/mrdoc Problem Types: CWE-502 Description: mrdoc is vulnerable to Deserialization of Untrusted Data Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/04fc04b3-2dc1-4cad-a090-e403cd66b5ad - https://github.com/zmister2016/mrdoc/commit/bb49e1287700b4e7681eab544c61093821ce72f6
CVE ID: CVE-2021-32569 State: PUBLISHED Published: 2021-10-14T17:00:02 Last Updated: 2024-08-03T23:25:30.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OSS-RC systems of the release 18B and older customer documentation browsing libraries under ALEX are subject to Cross-Site Scripting. This problem is completely resolved in new Ericsson library browsing tool ELEX used in systems like Ericsson Network Manager. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Ericsson Network Manager is a new generation OSS system which OSS-RC customers shall upgrade to Additional Analyst Notes: - CVE Program Container: References: - https://www.
em which OSS-RC customers shall upgrade to Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/innovazione/servizi-digitali/cybersecurity/red-team.html
CVE ID: CVE-2021-32570 State: PUBLISHED Published: 2022-08-25T23:28:42 Last Updated: 2024-08-03T23:25:30.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Ericsson Network Manager (ENM) releases before 21.2, users belonging to the same AMOS authorization group can retrieve the data from certain log files. All AMOS users are considered to be highly privileged users in ENM system and all must be previously defined and authorized by the Security Administrator. Those users can access some log’s files, under a common path, and read information stored in the log’s files in order to conduct privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https
s files in order to conduct privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://www.ericsson.com - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2021-32571 State: PUBLISHED Published: 2021-10-14T17:03:18 Last Updated: 2024-08-03T23:25:30.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OSS-RC systems of the release 18B and older during data migration procedures certain files containing usernames and passwords are left in the system undeleted but in folders accessible by top privileged accounts only. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Ericsson Network Manager is a new generation OSS system which OSS-RC customers shall upgrade to Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/innovazione/servizi-digita
Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/innovazione/servizi-digitali/cybersecurity/red-team.html
CVE ID: CVE-2021-32572 State: PUBLISHED Published: 2021-05-12T15:59:19 Last Updated: 2024-08-03T23:25:29.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: Speco Web Viewer through 2021-05-12 allows Directory Traversal via GET request for a URI with /.. at the beginning, as demonstrated by reading the /etc/passwd file. Additional Analyst Notes: - CVE Program Container: References: - https://www.jamescarroll.me/blog/specoweb-directory-traversal - https://www.specotech.com
CVE ID: CVE-2021-32573 State: PUBLISHED Published: 2021-05-11T16:46:14 Last Updated: 2024-08-03T23:25:30.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin) via a user input field for product options. NOTE: the vendor states that this "would rely on an admin hacking his/her own website. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/395944
CVE ID: CVE-2021-32574 State: PUBLISHED Published: 2021-07-17T17:28:11 Last Updated: 2024-08-03T23:25:30.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/consul - https://github.com/hashicorp/consul/releases/tag/v1.10.1 - https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26
p.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856 - https://security.gentoo.org/glsa/202208-09
CVE ID: CVE-2021-32575 State: PUBLISHED Published: 2021-06-17T18:28:21 Last Updated: 2024-08-03T23:25:30.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/nomad - https://discuss.hashicorp.com/t/hcsec-2021-14-nomad-bridge-networking-mode-allows-arp-spoofing-from-other-bridged-tasks-on-same-node/24296
CVE ID: CVE-2021-32576 State: PUBLISHED Published: 2021-08-05T19:07:57 Last Updated: 2024-08-03T23:25:30.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 1 of 2). Additional Analyst Notes: - CVE Program Container: References: - https://kb.acronis.com/content/68419
CVE ID: CVE-2021-32577 State: PUBLISHED Published: 2021-08-05T19:21:04 Last Updated: 2024-08-03T23:25:29.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: Acronis True Image prior to 2021 Update 5 for Windows allowed local privilege escalation due to insecure folder permissions. Additional Analyst Notes: - CVE Program Container: References: - https://kb.acronis.com/content/68413
CVE ID: CVE-2021-32578 State: PUBLISHED Published: 2021-08-05T19:16:41 Last Updated: 2024-08-03T23:25:30.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 2 of 2). Additional Analyst Notes: - CVE Program Container: References: - https://kb.acronis.com/content/68419
CVE ID: CVE-2021-32579 State: PUBLISHED Published: 2021-08-05T19:04:57 Last Updated: 2024-08-03T23:25:30.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: Acronis True Image prior to 2021 Update 4 for Windows and Acronis True Image prior to 2021 Update 5 for macOS allowed an unauthenticated attacker (who has a local code execution ability) to tamper with the micro-service API. Additional Analyst Notes: - CVE Program Container: References: - https://kb.acronis.com/content/68419 - https://kb.acronis.com/content/68413
CVE ID: CVE-2021-32580 State: PUBLISHED Published: 2021-08-05T19:06:36 Last Updated: 2024-08-03T23:25:30.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to DLL hijacking. Additional Analyst Notes: - CVE Program Container: References: - https://kb.acronis.com/content/68419