Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-45024 State: PUBLISHED Published: 2022-06-17T11:57:47 Last Updated: 2024-08-04T04:32:13.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to XML External Entity (XXE). Additional Analyst Notes: - CVE Program Container: References: - http://asg-zena.com - http://asg.com - https://docs.rocketsoftware.com/bundle/ven1649700711249/page/ayk1652945111726.html
CVE ID: CVE-2021-45025 State: PUBLISHED Published: 2022-06-17T11:57:54 Last Updated: 2024-08-04T04:32:13.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cleartext Storage of Sensitive Information in a Cookie. Additional Analyst Notes: - CVE Program Container: References: - http://asg-zena.com - http://asg.com - https://docs.rocketsoftware.com/bundle/ven1649700711249/page/ayk1652945111726.html
CVE ID: CVE-2021-45026 State: PUBLISHED Published: 2022-06-17T11:58:12 Last Updated: 2024-08-04T04:32:13.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASG technologies ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - http://asg-zena.com - http://asg.com - https://docs.rocketsoftware.com/bundle/ven1649700711249/page/ayk1652945111726.html
CVE ID: CVE-2021-45027 State: PUBLISHED Published: 2022-09-01T17:47:24 Last Updated: 2024-08-04T04:32:13.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file download vulnerability in Oliver v5 Library Server Versions < 5.00.008.053 via the FileServlet function allows for arbitrary file download by an attacker using unsanitized user supplied input. Additional Analyst Notes: - CVE Program Container: References: - https://www.softlinkint.com/product/oliver/ - https://www.exploit-db.com/exploits/50599
CVE ID: CVE-2021-45029 State: PUBLISHED Published: 2022-01-25T13:00:21 Last Updated: 2024-08-04T04:32:13.478Z Vendors: Apache Software Foundation Products: Apache ShenYu (incubating) Problem Types: CWE-94 Description: Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/3zzmwvg3012tg306x8o893fvdcssx639 - http://www.openwall.com/lists/oss-security/2022/01/25/8 - http://www.openwall.com/lists/oss-security/2022/01/26/1
CVE ID: CVE-2021-45031 State: PUBLISHED Published: 2022-03-30T19:55:10.646700Z Last Updated: 2024-09-16T16:59:03.264Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: Mepsan Products: USC+ Problem Types: CWE-305 Description: A vulnerability in MEPSAN's USC+ before version 3.0 has a weakness in login function which lets attackers to generate high privileged accounts passwords. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-22-0269
CVE ID: CVE-2021-45032 State: REJECTED Published: N/A Last Updated: 2023-02-23T05:24:38.921Z Description: No description available.
CVE ID: CVE-2021-45033 State: PUBLISHED Published: 2022-01-11T11:27:17 Last Updated: 2024-08-04T04:32:13.621Z Vendors: Siemens Products: CP-8000 MASTER MODULE WITH I/O -25/+70°C, CP-8000 MASTER MODULE WITH I/O -40/+70°C, CP-8021 MASTER MODULE, CP-8022 MASTER MODULE WITH GPRS Problem Types: CWE-798 Description: A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < V16.20), CP-8021 MASTER MODULE (All versions < V16.20), CP-8022 MASTER MODULE WITH GPRS (All versions < V16.20). An undocumented debug port uses hard-coded default credentials. If this port is enabled by a privileged user, an
6.20). An undocumented debug port uses hard-coded default credentials. If this port is enabled by a privileged user, an attacker aware of the credentials could access an administrative debug shell on the affected device. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-324998.pdf
CVE ID: CVE-2021-45034 State: PUBLISHED Published: 2022-01-11T11:27:17 Last Updated: 2024-08-04T04:32:13.633Z Vendors: Siemens Products: CP-8000 MASTER MODULE WITH I/O -25/+70°C, CP-8000 MASTER MODULE WITH I/O -40/+70°C, CP-8021 MASTER MODULE, CP-8022 MASTER MODULE WITH GPRS Problem Types: CWE-284 Description: A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < V16.20), CP-8021 MASTER MODULE (All versions < V16.20), CP-8022 MASTER MODULE WITH GPRS (All versions < V16.20). The web server of the affected system allows access to logfiles and diagnostic data generated by a privileged use
6.20). The web server of the affected system allows access to logfiles and diagnostic data generated by a privileged user. An unauthenticated attacker could access the files by knowing the corresponding download links. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-324998.pdf - http://seclists.org/fulldisclosure/2022/Apr/20 - http://packetstormsecurity.com/files/166743/Siemens-A8000-CP-8050-CP-8031-SICAM-WEB-Missing-File-Download-Missing-Authentication.html
CVE ID: CVE-2021-45035 State: PUBLISHED Published: 2022-09-23T15:02:18.737Z Last Updated: 2025-05-22T18:24:43.357Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Velneo Products: Velneo vClient Problem Types: CWE-287 Description: Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert.es/en/early-warning/security-advisories/velneo-vclient-improper-authentication - https
rences: - https://www.incibe-cert.es/en/early-warning/security-advisories/velneo-vclient-improper-authentication - https://velneo.es/publicacion-de-incidencia-de-seguridad-en-cve-cve-2021-45035/ - https://www.velneo.com/blog/nueva-revision-velneo-29-2 - https://doc.velneo.com/v/29/velneo/notas-de-la-version#verificacion-de-certificados
CVE ID: CVE-2021-45036 State: PUBLISHED Published: 2022-11-28T15:29:02.063Z Last Updated: 2025-04-25T14:59:40.409Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Velneo Products: Velneo vClient Problem Types: CWE-290 Description: Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/velneo-vclient-improper-authentication-0 - https://www.velneo.com/blog/disponible-la-nueva-version-velneo-32 - https://doc.velne
client-improper-authentication-0 - https://www.velneo.com/blog/disponible-la-nueva-version-velneo-32 - https://doc.velneo.com/v/32/velneo/notas-de-la-version#mejoras-de-seguridad-en-validacion-de-usuario-y-contrasena - https://velneo.es/mivelneo/listado-de-cambios-velneo-32/ - https://doc.velneo.com/v/32/velneo/notas-de-la-version#a-partir-de-esta-version-todos-los-servidores-arrancaran-con-protocolo-vatps - https://doc.velneo.com/v/32/velneo-vserver/funcionalidades/protocolo-vatps - https://doc.velneo.com/v/32/velneo/funcionalidades-comunes/conexion-con-velneo-vserver
CVE ID: CVE-2021-45038 State: PUBLISHED Published: 2021-12-17T00:00:00 Last Updated: 2024-08-04T04:32:13.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. By using an action=rollback query, attackers can view private wiki contents. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T297574 - https://www.mediawiki.org/wiki/2021-12_security_release/FAQ - https://security.gentoo.org/glsa/202305-24
CVE ID: CVE-2021-45039 State: PUBLISHED Published: 2023-05-31T00:00:00 Last Updated: 2025-01-10T16:32:47.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple models of the Uniview IP Camera (e.g., IPC_G6103 B6103.16.10.B25.201218, IPC_G61, IPC21, IPC23, IPC32, IPC36, IPC62, and IPC_HCMN) offer an undocumented UDP service on port 7788 that allows a remote unauthenticated attacker to overflow an internal buffer and achieve code execution. By using this buffer overflow, a remote attacker can start the telnetd service. This service has a hardcoded default username and password (root/123456). Although it has a restrictive shell, this can be easily bypassed via the built-in ECH
ername and password (root/123456). Although it has a restrictive shell, this can be easily bypassed via the built-in ECHO shell command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ssd-disclosure.com/ssd-advisory--uniview-preauth-rce/ - https://www.uniview.com/About_Us/Security/Notice/202112/920471_140493_0.htm
CVE ID: CVE-2021-45040 State: PUBLISHED Published: 2022-03-17T20:22:52 Last Updated: 2024-08-04T04:32:13.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route. Additional Analyst Notes: - CVE Program Container: References: - https://spatie.be/docs/laravel-medialibrary/v9/handling-uploads-with-media-library-pro/processing-uploads-on-the-server - https://cybersecthreat.com/2022/03/14/cve-2021-45040/
CVE ID: CVE-2021-45041 State: PUBLISHED Published: 2021-12-19T08:34:10 Last Updated: 2024-08-04T04:32:13.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project module, involving resource_id and start_date. Additional Analyst Notes: - CVE Program Container: References: - https://docs.suitecrm.com/admin/releases/7.12.x/ - https://docs.suitecrm.com/8.x/admin/releases/8.0/ - https://github.com/manuelz120/CVE-2021-45041
CVE ID: CVE-2021-45042 State: PUBLISHED Published: 2021-12-17T13:38:51 Last Updated: 2024-08-04T04:32:13.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an authenticated user (with write permissions to a kv secrets engine) to cause a panic and denial of service of the storage backend. The earliest affected version is 1.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/vault - https://discuss.hashicorp.com/t/hcsec2-21-33-vault-s-kv-secrets-engine-with-integrated-storag
.com/blog/category/vault - https://discuss.hashicorp.com/t/hcsec2-21-33-vault-s-kv-secrets-engine-with-integrated-storage-exposed-to-authenticated-denial-of-service/33157 - https://security.gentoo.org/glsa/202207-01
CVE ID: CVE-2021-45043 State: PUBLISHED Published: 2021-12-15T07:13:03 Last Updated: 2024-08-04T04:32:13.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/1DlfZz0F8skWy3Mkahx_NMo-sYZh9-eun/view?usp=sharing - https://drive.google.com/file/d/1bx9yCN-IHYuRpd7g3jhMb0LcTC1ARzSX/view?usp=sharing
CVE ID: CVE-2021-45046 State: PUBLISHED Published: 2021-12-14T16:55:09.000Z Last Updated: 2025-10-21T23:25:22.768Z Vendors: Apache Software Foundation Products: Apache Log4j Problem Types: CWE-917 Description: It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote
X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 - https://www.oracle.com/security-alerts/alert-cve-2021-44228.html - https://www.cve.org/CVERecord?id=CVE-2021-44228 - http://www.openwall.com/lists/oss-security/2021/12/14/4 - https://logging.a
://www.cve.org/CVERecord?id=CVE-2021-44228 - http://www.openwall.com/lists/oss-security/2021/12/14/4 - https://logging.apache.org/log4j/2.x/security.html - https://www.kb.cert.org/vuls/id/930724 - https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd - http://www.openwall.com/lists/oss-security/2021/12/15/3 - https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf - https://www.debian.org/security/2021/dsa-5022 - http://www.openwall.com/lists/oss-security/2021/12/18/1 - https://cert-portal
://www.debian.org/security/2021/dsa-5022 - http://www.openwall.com/lists/oss-security/2021/12/18/1 - https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.gentoo.org/glsa
urity-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.gentoo.org/glsa/202310-16
CVE ID: CVE-2021-45051 State: PUBLISHED Published: 2022-01-14T19:04:58.575Z Last Updated: 2025-04-23T19:11:38.295Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Bridge Problem Types: CWE-416 Description: Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an use-after-free vulnerability in the processing of Format event actions that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: -
ires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/bridge/apsb22-03.html
CVE ID: CVE-2021-45052 State: PUBLISHED Published: 2022-01-14T19:04:53.893Z Last Updated: 2025-04-23T19:11:44.943Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Bridge Problem Types: CWE-125 Description: Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
must open a malicious TIF file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/bridge/apsb22-03.html
CVE ID: CVE-2021-45053 State: PUBLISHED Published: 2022-01-13T20:27:32.838Z Last Updated: 2025-04-23T19:12:56.679Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: InCopy Problem Types: CWE-787 Description: Adobe InCopy version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/incopy/apsb22-04.html
CVE ID: CVE-2021-45054 State: PUBLISHED Published: 2022-01-13T20:27:31.538Z Last Updated: 2025-04-23T19:13:03.217Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: InCopy Problem Types: CWE-416 Description: Adobe InCopy version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
ust open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/incopy/apsb22-04.html
CVE ID: CVE-2021-45055 State: PUBLISHED Published: 2022-01-13T20:27:35.140Z Last Updated: 2025-04-23T19:12:45.488Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: InCopy Problem Types: CWE-125 Description: Adobe InCopy version 16.4 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - C
res user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/incopy/apsb22-04.html
CVE ID: CVE-2021-45056 State: PUBLISHED Published: 2022-01-13T20:27:33.948Z Last Updated: 2025-04-23T19:12:51.228Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: InCopy Problem Types: CWE-787 Description: Adobe InCopy version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/incopy/apsb22-04.html
CVE ID: CVE-2021-45057 State: PUBLISHED Published: 2022-01-13T20:27:37.525Z Last Updated: 2025-04-23T19:12:31.676Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: InDesign Problem Types: CWE-787 Description: Adobe InDesign version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious JPEG2000 file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/indesign/apsb22-05.html
CVE ID: CVE-2021-45058 State: PUBLISHED Published: 2022-01-13T20:27:36.330Z Last Updated: 2025-04-23T19:12:39.558Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: InDesign Problem Types: CWE-787 Description: Adobe InDesign version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious JPEG file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/indesign/apsb22-05.html
CVE ID: CVE-2021-45059 State: PUBLISHED Published: 2022-01-13T20:27:38.735Z Last Updated: 2025-04-23T19:12:25.330Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: InDesign Problem Types: CWE-416 Description: Adobe InDesign version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
im must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/indesign/apsb22-05.html
CVE ID: CVE-2021-45060 State: PUBLISHED Published: 2022-01-14T19:05:19.381359Z Last Updated: 2024-09-17T01:35:38.389Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-125 Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victi
to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE ID: CVE-2021-45061 State: PUBLISHED Published: 2022-01-14T19:05:22.191251Z Last Updated: 2024-09-17T00:06:14.395Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-787 Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/s
m must open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat/apsb22-01.html