Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-43018 State: PUBLISHED Published: 2023-09-07T12:54:34.086Z Last Updated: 2024-08-04T03:47:13.144Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Photoshop Desktop Problem Types: CWE-787 Description: Adobe Photoshop versions 23.0.2 and 22.5.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious JPG file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/photoshop/apsb21-113.html
CVE ID: CVE-2021-43019 State: PUBLISHED Published: 2021-11-23T18:03:45.300Z Last Updated: 2025-04-23T19:18:45.457Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Creative Cloud (desktop component) Problem Types: CWE-732 Description: Adobe Creative Cloud version 5.5 (and earlier) are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An unauthenticated attacker could leverage this vulnerability to remove files and escalate privileges under the context of SYSTEM . An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability
ust first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability on the product installer. User interaction is required before product installation to abuse this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/creative-cloud/apsb21-111.html
CVE ID: CVE-2021-43021 State: PUBLISHED Published: 2021-12-20T20:08:30.918Z Last Updated: 2025-04-23T19:17:48.394Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Premiere Rush Problem Types: CWE-788 Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious EXR file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/premiere_rush
CVE ID: CVE-2021-43022 State: PUBLISHED Published: 2021-12-20T20:08:32.421Z Last Updated: 2025-04-23T19:17:36.176Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Premiere Rush Problem Types: CWE-788 Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious PNG file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/premiere_rush
CVE ID: CVE-2021-43023 State: PUBLISHED Published: 2021-12-20T20:08:37.719Z Last Updated: 2025-04-23T19:16:52.994Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Premiere Problem Types: CWE-788 Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious EPS/TIFF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/premiere_rush
CVE ID: CVE-2021-43024 State: PUBLISHED Published: 2021-12-20T20:08:33.174Z Last Updated: 2025-04-23T19:17:30.282Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Premiere Rush Problem Types: CWE-787 Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/premiere_rush
CVE ID: CVE-2021-43025 State: PUBLISHED Published: 2021-12-20T20:08:36.818Z Last Updated: 2025-04-23T19:16:59.012Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Premiere Problem Types: CWE-788 Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious SVG file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/premiere_rush/apsb
E Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE ID: CVE-2021-43026 State: PUBLISHED Published: 2021-12-20T20:08:27.722Z Last Updated: 2025-04-23T19:18:17.686Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Premiere Rush Problem Types: CWE-788 Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious MXF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/premiere_rush
CVE ID: CVE-2021-43027 State: PUBLISHED Published: 2023-09-07T12:54:29.014Z Last Updated: 2025-02-27T21:00:17.560Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: After Effects Problem Types: CWE-125 Description: Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Co
issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/after_effects/apsb21-115.html
CVE ID: CVE-2021-43028 State: PUBLISHED Published: 2021-12-20T20:08:29.394Z Last Updated: 2025-04-23T19:18:04.257Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Premiere Rush Problem Types: CWE-788 Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/premiere_rush
CVE ID: CVE-2021-43029 State: PUBLISHED Published: 2021-12-20T20:08:30.239Z Last Updated: 2025-04-23T19:17:54.855Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Premiere Rush Problem Types: CWE-788 Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/premiere_rush
CVE ID: CVE-2021-43030 State: PUBLISHED Published: 2021-12-20T20:08:36.104Z Last Updated: 2025-04-23T19:17:05.416Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Premiere Rush Problem Types: CWE-824 Description: Adobe Premiere Rush versions 1.5.16 (and earlier) allows access to an uninitialized pointer vulnerability that allows remote attackers to disclose arbitrary data on affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MP4 files. The issue results from the lack of proper initialization of m
The specific flaw exists within the parsing of MP4 files. The issue results from the lack of proper initialization of memory prior to accessing it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE ID: CVE-2021-43032 State: PUBLISHED Published: 2021-11-03T19:54:44 Last Updated: 2024-08-04T03:47:13.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and save an XSS payload in the body of the HTML document. This payload will execute globally on the client side. Additional Analyst Notes: - CVE Program Container: References: - https://xenforo.com/community/forums/announcements/ - https://github.com/SakuraSamuraii/CVE-2021-43032
CVE ID: CVE-2021-43033 State: PUBLISHED Published: 2021-12-06T00:00:00 Last Updated: 2024-08-04T03:47:13.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Multiple functions in the bpserverd daemon were vulnerable to arbitrary remote code execution as root. The vulnerability was caused by untrusted input (received by the server) being passed to system calls. Additional Analyst Notes: - CVE Program Container: References: - https://helpdesk.kaseya.com/hc/en-gb/articles/4412762258961 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1 - https://www.cyberonesecurity.c
tps://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-2
CVE ID: CVE-2021-43034 State: PUBLISHED Published: 2021-12-06T00:00:00 Last Updated: 2024-08-04T03:47:13.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A world writable file allowed local users to execute arbitrary code as the user apache, leading to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://helpdesk.kaseya.com/hc/en-gb/articles/4412762258961 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-2
CVE ID: CVE-2021-43035 State: PUBLISHED Published: 2021-12-06T00:00:00 Last Updated: 2024-08-04T03:47:13.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Two unauthenticated SQL injection vulnerabilities were discovered, allowing arbitrary SQL queries to be injected and executed under the postgres superuser account. Remote code execution was possible, leading to full access to the postgres user account. Additional Analyst Notes: - CVE Program Container: References: - https://helpdesk.kaseya.com/hc/en-gb/articles/4412762258961 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-ap
kaseya.com/hc/en-gb/articles/4412762258961 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-2
CVE ID: CVE-2021-43036 State: PUBLISHED Published: 2021-12-06T00:00:00 Last Updated: 2024-08-04T03:47:13.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The password for the PostgreSQL wguest account is weak. Additional Analyst Notes: - CVE Program Container: References: - https://helpdesk.kaseya.com/hc/en-gb/articles/4412762258961 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-2
CVE ID: CVE-2021-43037 State: PUBLISHED Published: 2021-12-06T00:00:00 Last Updated: 2024-08-04T03:47:13.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The Unitrends Windows agent was vulnerable to DLL injection and binary planting due to insecure default permissions. This allowed privilege escalation from an unprivileged user to SYSTEM. Additional Analyst Notes: - CVE Program Container: References: - https://helpdesk.kaseya.com/hc/en-gb/articles/4412762258961 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1 - https://www.cyberonesecurity.com/blog/exploiting
security.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-2
CVE ID: CVE-2021-43038 State: PUBLISHED Published: 2021-12-06T00:00:00 Last Updated: 2024-08-04T03:47:13.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The wguest account could execute commands by injecting into PostgreSQL trigger functions. This allowed privilege escalation from the wguest user to the postgres user. Additional Analyst Notes: - CVE Program Container: References: - https://helpdesk.kaseya.com/hc/en-gb/articles/4412762258961 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-bac
loiting-kaseya-unitrends-backup-appliance-part-1 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-2
CVE ID: CVE-2021-43039 State: PUBLISHED Published: 2021-12-06T00:00:00 Last Updated: 2024-08-04T03:47:13.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The Samba file sharing service allowed anonymous read/write access. Additional Analyst Notes: - CVE Program Container: References: - https://helpdesk.kaseya.com/hc/en-gb/articles/4412762258961 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-2
CVE ID: CVE-2021-43040 State: PUBLISHED Published: 2021-12-06T00:00:00 Last Updated: 2024-08-04T03:47:13.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The privileged vaultServer could be leveraged to create arbitrary writable files, leading to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://helpdesk.kaseya.com/hc/en-gb/articles/4412762258961 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-2
CVE ID: CVE-2021-43041 State: PUBLISHED Published: 2021-12-06T00:00:00 Last Updated: 2024-08-04T03:47:13.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A crafted HTTP request could induce a format string vulnerability in the privileged vaultServer application. Additional Analyst Notes: - CVE Program Container: References: - https://helpdesk.kaseya.com/hc/en-gb/articles/4412762258961 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-2
CVE ID: CVE-2021-43042 State: PUBLISHED Published: 2021-12-06T00:00:00 Last Updated: 2024-08-04T03:47:13.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A buffer overflow existed in the vaultServer component. This was exploitable by a remote unauthenticated attacker. Additional Analyst Notes: - CVE Program Container: References: - https://helpdesk.kaseya.com/hc/en-gb/articles/4412762258961 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-2
CVE ID: CVE-2021-43043 State: PUBLISHED Published: 2021-12-06T00:00:00 Last Updated: 2024-08-04T03:47:13.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecure Sudo rule. Additional Analyst Notes: - CVE Program Container: References: - https://helpdesk.kaseya.com/hc/en-gb/articles/4412762258961 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-2
CVE ID: CVE-2021-43044 State: PUBLISHED Published: 2021-12-06T00:00:00 Last Updated: 2024-08-04T03:47:13.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The SNMP daemon was configured with a weak default community. Additional Analyst Notes: - CVE Program Container: References: - https://helpdesk.kaseya.com/hc/en-gb/articles/4412762258961 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1 - https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-2
CVE ID: CVE-2021-43045 State: PUBLISHED Published: 2022-01-06T18:00:12 Last Updated: 2024-08-04T03:47:13.525Z Vendors: Apache Software Foundation Products: Apache Avro Problem Types: CWE-770 Description: A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/5fttw9vk6gd2p3b846nox7hcj5469xfd - http://www.openwall.com/lists/oss-security/2022/01/06/8
CVE ID: CVE-2021-43046 State: PUBLISHED Published: 2021-11-16T17:50:10.945300Z Last Updated: 2024-09-16T18:54:31.908Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO PartnerExpress Problem Types: In the worst case, if the victim is a privileged administrator, successful execution of this vulnerability can result in an attacker gaining full administrative access to the affected system. Description: The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain an easily exploitable vulnerability that allows an unauthenticated attacker with network access to obtain session tokens for th
ly exploitable vulnerability that allows an unauthenticated attacker with network access to obtain session tokens for the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO PartnerExpress: versions 6.2.1 and below. Additional Analyst Notes: - CVE Program Container: References: - https://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2021/11/tibco-security-advisory-november-16-2021-tibco-partnerexpress-2021-43046
CVE ID: CVE-2021-43047 State: PUBLISHED Published: 2021-11-16T17:50:12.472586Z Last Updated: 2024-09-16T23:15:25.061Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO PartnerExpress Problem Types: In the worst case, if the victim is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system or the victim's local system. Description: The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain easily exploitable Stored and Reflected Cross Site Scripting (XSS) vulnerabilities that allow
BCO PartnerExpress contain easily exploitable Stored and Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO PartnerExpress: versions 6.2.1 and below. Additional Analyst Notes: - CVE Program Container: References: - https://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2021/11/tibco-security-advisory-november-16-2021-tibco-p
s/support/advisories - https://www.tibco.com/support/advisories/2021/11/tibco-security-advisory-november-16-2021-tibco-partnerexpress-2021-43047
CVE ID: CVE-2021-43048 State: PUBLISHED Published: 2021-11-16T17:50:14.025564Z Last Updated: 2024-09-17T03:27:29.314Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO PartnerExpress Problem Types: The impact of this vulnerability includes the theoretical possibility that an attacker gains full administrative access to the affected system. Description: The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain a vulnerability that theoretically allows an unauthenticated attacker with network access to execute a clickjacking attack on the affected system. A successful attack usin
enticated attacker with network access to execute a clickjacking attack on the affected system. A successful attack using this vulnerability does not require human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO PartnerExpress: versions 6.2.1 and below. Additional Analyst Notes: - CVE Program Container: References: - https://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2021/11/tibco-security-advisory-november-16-2021-tibco-partnerexpress-2021-43048
CVE ID: CVE-2021-43049 State: PUBLISHED Published: 2022-02-15T17:55:11.326208Z Last Updated: 2024-09-17T01:40:32.611Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO BusinessConnect Container Edition Problem Types: In the worst case, if the victim is a privileged administrator, successful execution of this vulnerability can result in an attacker gaining full administrative access to the affected system. Description: The Database component of TIBCO Software Inc.'s TIBCO BusinessConnect Container Edition contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to obtain the u