Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-21736 State: PUBLISHED Published: 2021-06-10T11:28:57 Last Updated: 2024-08-03T18:23:28.899Z Vendors: n/a Products: ZXHN HS562 Problem Types: information leak Description: A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end app, users whose sharing permissions have been revoked can still control the camera, such as restarting the camera, restoring factory settings, etc.. This affects ZXHN HS562 V1.0.0.0B2.0000, V1.0.0.0B3.0000E Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015964
CVE ID: CVE-2021-21737 State: PUBLISHED Published: 2021-06-24T10:39:42 Last Updated: 2024-08-03T18:23:29.086Z Vendors: n/a Products: ZXV10 B860H V5.0 Problem Types: permission and access control Description: A smart STB product of ZTE is impacted by a permission and access control vulnerability. Due to insufficient protection of system application, attackers could use this vulnerability to tamper with the system desktop and affect system customization functions. This affects: ZXV10 B860H V5.0, V83011303.0010, V83011303.0016 Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1016004
CVE ID: CVE-2021-21738 State: PUBLISHED Published: 2021-08-05T19:49:37 Last Updated: 2024-08-03T18:23:29.178Z Vendors: n/a Products: <ZXIPTV> Problem Types: XSS Description: ZTE's big video business platform has two reflective cross-site scripting (XSS) vulnerabilities. Due to insufficient input verification, the attacker could implement XSS attacks by tampering with the parameters, to affect the operations of valid users. This affects: <ZXIPTV><ZXIPTV-EAS_PV5.06.04.09> Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1016764
CVE ID: CVE-2021-21739 State: PUBLISHED Published: 2021-08-05T19:48:41 Last Updated: 2024-08-03T18:23:29.405Z Vendors: n/a Products: <ZXCTN 6120H> Problem Types: Insufficient Verification of Data reliability Description: A ZTE's product of the transport network access layer has a security vulnerability. Because the system does not sufficiently verify the data reliability, attackers could replace an authenticated optical module on the equipment with an unauthenticated one, bypassing system authentication and detection, thus affecting signal transmission. This affects: <ZXCTN 6120H><V5.10.00B24> Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support
6120H><V5.10.00B24> Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1017024
CVE ID: CVE-2021-21740 State: PUBLISHED Published: 2021-08-09T15:30:12 Last Updated: 2024-08-03T18:23:29.257Z Vendors: n/a Products: ZXHN H2640 Problem Types: information leak Description: There is an information leak vulnerability in the digital media player (DMS) of ZTE's residential gateway product. The attacker could insert the USB disk with the symbolic link into the residential gateway, and access unauthorized directory information through the symbolic link, causing information leak. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1017244
CVE ID: CVE-2021-21741 State: PUBLISHED Published: 2021-08-30T00:00:00 Last Updated: 2024-08-03T18:23:28.495Z Vendors: n/a Products: ZXV10 M910 Problem Types: command execution Description: There is a command execution vulnerability in a ZTE conference management system. As some services are enabled by default, the attacker could exploit this vulnerability to execute arbitrary commands by sending specific serialization command. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1018424
CVE ID: CVE-2021-21742 State: PUBLISHED Published: 2021-09-24T23:16:33 Last Updated: 2024-08-03T18:23:29.386Z Vendors: n/a Products: ZTE Axon 30 Pro Message Service App Problem Types: Information Leak Description: There is an information leak vulnerability in the message service app of a ZTE mobile phone. Due to improper parameter settings, attackers could use this vulnerability to obtain some sensitive information of users by accessing specific pages. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019084
CVE ID: CVE-2021-21743 State: PUBLISHED Published: 2021-10-20T15:19:32 Last Updated: 2024-08-03T18:23:29.268Z Vendors: n/a Products: MF971R Problem Types: CRLF injection Description: ZTE MF971R product has a CRLF injection vulnerability. An attacker could exploit the vulnerability to modify the HTTP response header information through a specially crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764
CVE ID: CVE-2021-21744 State: PUBLISHED Published: 2021-10-20T15:18:18 Last Updated: 2024-08-03T18:23:29.361Z Vendors: n/a Products: MF971R Problem Types: configuration file control Description: ZTE MF971R product has a configuration file control vulnerability. An attacker could use this vulnerability to modify the configuration parameters of the device, causing some security functions of the device to be disabled. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764
CVE ID: CVE-2021-21745 State: PUBLISHED Published: 2021-10-20T15:20:50 Last Updated: 2024-08-03T18:23:29.386Z Vendors: n/a Products: MF971R Problem Types: Referer authentication bypass Description: ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use this vulnerability to perform illegal authorization operations by sending a request to the user to click. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764
CVE ID: CVE-2021-21746 State: PUBLISHED Published: 2021-10-20T14:34:39 Last Updated: 2024-08-03T18:23:29.382Z Vendors: n/a Products: MF971R Problem Types: XSS Description: ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764
CVE ID: CVE-2021-21747 State: PUBLISHED Published: 2021-10-20T14:38:33 Last Updated: 2024-08-03T18:23:29.149Z Vendors: n/a Products: MF971R Problem Types: XSS Description: ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764
CVE ID: CVE-2021-21748 State: PUBLISHED Published: 2021-10-20T15:24:44 Last Updated: 2024-08-03T18:23:29.459Z Vendors: n/a Products: MF971R Problem Types: stack-based buffer overflow Description: ZTE MF971R product has two stack-based buffer overflow vulnerabilities. An attacker could exploit the vulnerabilities to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764
CVE ID: CVE-2021-21749 State: PUBLISHED Published: 2021-10-20T15:22:06 Last Updated: 2024-08-03T18:23:29.469Z Vendors: n/a Products: MF971R Problem Types: stack-based buffer overflow Description: ZTE MF971R product has two stack-based buffer overflow vulnerabilities. An attacker could exploit the vulnerabilities to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764
CVE ID: CVE-2021-21750 State: PUBLISHED Published: 2021-12-27T18:48:25 Last Updated: 2024-08-03T18:23:29.459Z Vendors: n/a Products: ZXIN10 CMS Problem Types: privilege escalation Description: ZTE BigVideo Analysis product has a privilege escalation vulnerability. Due to improper management of the timed task modification privilege, an attacker with ordinary user permissions could exploit this vulnerability to gain unauthorized access. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1021884
CVE ID: CVE-2021-21751 State: PUBLISHED Published: 2021-12-27T18:48:25 Last Updated: 2024-08-03T18:23:29.321Z Vendors: n/a Products: ZXIN10 CMS Problem Types: input verification Description: ZTE BigVideo analysis product has an input verification vulnerability. Due to the inconsistency between the front and back verifications when configuring the large screen page, an attacker with high privileges could exploit this vulnerability to tamper with the URL and cause service exception. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1021884
CVE ID: CVE-2021-21772 State: PUBLISHED Published: 2021-03-10T00:00:00 Last Updated: 2024-08-03T18:23:29.264Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: 3MF Problem Types: use-after-free Description: A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2020-1226 - https://lists.fedoraproject.org/archives/list/package-ann
/talosintelligence.com/vulnerability_reports/TALOS-2020-1226 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDGGB65YBQL662M3MOBNNJJNRNURW4TG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHMMHD2EOMIVJ7EKZTJJMX4C7E6ZRWDL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPBS642OYVA6DUKK3HZHEINVWEDZSMEU/ - https://www.debian.org/security/2021/dsa-4887 - https://security.gentoo.org/glsa/202208-01 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1226
CVE ID: CVE-2021-21773 State: PUBLISHED Published: 2021-03-31T13:59:31 Last Updated: 2024-08-03T18:23:29.228Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Accusoft Problem Types: CWE-131 Description: An out-of-bounds write vulnerability exists in the TIFF header count-processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1227
CVE ID: CVE-2021-21774 State: REJECTED Published: 2021-08-30T17:05:59 Last Updated: 2021-08-30T17:05:59 Description: No description available.
CVE ID: CVE-2021-21775 State: PUBLISHED Published: 2021-07-07T21:18:18 Last Updated: 2024-08-03T18:23:29.399Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: n/a Products: Webkit Problem Types: CWE-416 Description: A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory corruption. In order to trigger the vulnerability, a victim must be tricked into visiting a malicious webpage. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALO
dditional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1229 - http://www.openwall.com/lists/oss-security/2021/07/23/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V4QORERLPDN3UNNJFJSOMHZZCU2G75Q6/ - https://www.debian.org/security/2021/dsa-4945 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYMMBQN4PRVDLMIJT2LY2BWHLYBD57P3/
CVE ID: CVE-2021-21776 State: PUBLISHED Published: 2021-03-31T14:00:37 Last Updated: 2024-08-03T18:23:29.474Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Accusoft Problem Types: CWE-131 Description: An out-of-bounds write vulnerability exists in the SGI Format Buffer Size Processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1232
CVE ID: CVE-2021-21777 State: PUBLISHED Published: 2021-06-17T10:48:54 Last Updated: 2024-08-03T18:23:29.512Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: EIP Stack Group Problem Types: out of bounds read Description: An information disclosure vulnerability exists in the Ethernet/IP UDP handler functionality of EIP Stack Group OpENer 2.3 and development commit 8c73bf3. A specially crafted network request can lead to an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1234
CVE ID: CVE-2021-21778 State: PUBLISHED Published: 2021-08-25T18:27:21 Last Updated: 2024-08-03T18:23:29.380Z Vendors: n/a Products: MZ Automation" Problem Types: denial of service Description: A denial of service vulnerability exists in the ASDU message processing functionality of MZ Automation GmbH lib60870.NET 2.2.0. A specially crafted network request can lead to loss of communications. An attacker can send an unauthenticated message to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1236
CVE ID: CVE-2021-21779 State: PUBLISHED Published: 2021-07-08T11:21:56 Last Updated: 2024-08-03T18:23:29.206Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: n/a Products: Webkit Problem Types: CWE-416 Description: A use-after-free vulnerability exists in the way Webkit’s GraphicsContext handles certain events in WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1238 - http:/
tes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1238 - http://www.openwall.com/lists/oss-security/2021/07/23/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V4QORERLPDN3UNNJFJSOMHZZCU2G75Q6/ - https://www.debian.org/security/2021/dsa-4945 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYMMBQN4PRVDLMIJT2LY2BWHLYBD57P3/
CVE ID: CVE-2021-21781 State: PUBLISHED Published: 2021-08-18T14:37:46 Last Updated: 2024-08-03T18:23:29.351Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Linux Kernel Problem Types: CWE-908 Description: An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222 4.19.177 5.4.99 5.10.17 5.11 Addit
fic offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222 4.19.177 5.4.99 5.10.17 5.11 Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1243 - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-21782 State: PUBLISHED Published: 2021-03-31T14:00:57 Last Updated: 2024-08-03T18:23:29.470Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Accusoft Problem Types: CWE-131 Description: An out-of-bounds write vulnerability exists in the SGI format buffer size processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1244
CVE ID: CVE-2021-21783 State: PUBLISHED Published: 2021-03-25T16:01:12 Last Updated: 2024-08-03T18:23:29.363Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Genivia Problem Types: CWE-680 Description: A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1245 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.or
ence.com/vulnerability_reports/TALOS-2021-1245 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2021-21784 State: PUBLISHED Published: 2021-04-13T18:08:43 Last Updated: 2024-08-03T18:23:29.401Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Accusoft Problem Types: CWE-119 Description: An out-of-bounds write vulnerability exists in the JPG format SOF marker processing of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1248
CVE ID: CVE-2021-21785 State: PUBLISHED Published: 2021-08-05T20:06:11 Last Updated: 2024-08-03T18:23:29.488Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a Products: IOBit Problem Types: CWE-782 Description: An information disclosure vulnerability exists in the IOCTL 0x9c40a148 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A specially crafted I/O request packet (IRP) can lead to a disclosure of sensitive information. An attacker can send a malicious IRP to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1252
CVE ID: CVE-2021-21786 State: PUBLISHED Published: 2021-07-07T16:49:38 Last Updated: 2024-08-03T18:23:29.529Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Iobit Problem Types: CWE-782 Description: A privilege escalation vulnerability exists in the IOCTL 0x9c406144 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A specially crafted I/O request packet (IRP) can lead to increased privileges. An attacker can send a malicious IRP to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1253
CVE ID: CVE-2021-21787 State: PUBLISHED Published: 2021-07-07T16:39:44 Last Updated: 2024-08-03T18:23:29.434Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Iobit Problem Types: CWE-782 Description: A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0d8, the first dword passed in the input buffer is the device port to write to and the byte at offset 4 is the value to write via the OUT instruction. The OUT instruction can write one byte to the given I/O device port, potentially leading to escalated privileges of unprivileged users.
ion can write one byte to the given I/O device port, potentially leading to escalated privileges of unprivileged users. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1254
CVE ID: CVE-2021-21788 State: PUBLISHED Published: 2021-07-07T16:39:51 Last Updated: 2024-08-03T18:23:29.463Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Iobit Problem Types: CWE-782 Description: A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0dc, the first dword passed in the input buffer is the device port to write to and the word at offset 4 is the value to write via the OUT instruction. The OUT instruction can write one byte to the given I/O device port, potentially leading to escalated privileges of unprivileged users.
ion can write one byte to the given I/O device port, potentially leading to escalated privileges of unprivileged users. A local attacker can send a malicious IRP to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1254
CVE ID: CVE-2021-21789 State: PUBLISHED Published: 2021-07-07T16:40:02 Last Updated: 2024-08-03T18:23:29.383Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Iobit Problem Types: CWE-782 Description: A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0e0, the first dword passed in the input buffer is the device port to write to and the dword at offset 4 is the value to write via the OUT instruction. A local attacker can send a malicious IRP to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References:
r can send a malicious IRP to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1254
CVE ID: CVE-2021-21790 State: PUBLISHED Published: 2021-08-05T20:04:59 Last Updated: 2024-08-03T18:23:29.411Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a Products: IOBit Problem Types: CWE-782 Description: An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A specially crafted I/O request packet (IRP) can lead to privileged reads in the context of a driver which can result in sensitive information disclosure from the kernel. The IN instruction can read two bytes from the given I/O device, potentially leaking sensitive device data to unprivileged users
nstruction can read two bytes from the given I/O device, potentially leaking sensitive device data to unprivileged users. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1255