auren-research/cyber-sec huggingface dataset:
cveID: CVE-2020-6572
vendorProject: Google
product: Chrome Media
vulnerabilityName: Google Chrome Media Use-After-Free Vulnerability
dateAdded: 2022-01-10
shortDescription: Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-6572
cwes: CWE-416
cveID: CVE-2019-1458
vendorProject: Microsoft
product: Win32k
vulnerabilityName: Microsoft Win32k Privilege Escalation Vulnerability
dateAdded: 2022-01-10
shortDescription: A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-10
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2019-1458
cveID: CVE-2013-3900
vendorProject: Microsoft
product: WinVerifyTrust function
vulnerabilityName: Microsoft WinVerifyTrust function Remote Code Execution
dateAdded: 2022-01-10
shortDescription: A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2013-3900
cwes: CWE-20
cveID: CVE-2019-2725
vendorProject: Oracle
product: WebLogic Server
vulnerabilityName: Oracle WebLogic Server, Injection
dateAdded: 2022-01-10
shortDescription: Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-10
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2019-2725
cwes: CWE-74
cveID: CVE-2019-9670
vendorProject: Synacor
product: Zimbra Collaboration Suite (ZCS)
vulnerabilityName: Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
dateAdded: 2022-01-10
shortDescription: Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2019-9670
cwes: CWE-611
cveID: CVE-2018-13382
vendorProject: Fortinet
product: FortiOS and FortiProxy
vulnerabilityName: Fortinet FortiOS and FortiProxy Improper Authorization
dateAdded: 2022-01-10
shortDescription: An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-10
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2018-13382
cwes: CWE-285
cveID: CVE-2018-13383
vendorProject: Fortinet
product: FortiOS and FortiProxy
vulnerabilityName: Fortinet FortiOS and FortiProxy Out-of-bounds Write
dateAdded: 2022-01-10
shortDescription: A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-10
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2018-13383
cwes: CWE-787
cveID: CVE-2019-1579
vendorProject: Palo Alto Networks
product: PAN-OS
vulnerabilityName: Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
dateAdded: 2022-01-10
shortDescription: Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-10
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2019-1579
cwes: CWE-134
cveID: CVE-2019-10149
vendorProject: Exim
product: Mail Transfer Agent (MTA)
vulnerabilityName: Exim Mail Transfer Agent (MTA) Improper Input Validation
dateAdded: 2022-01-10
shortDescription: Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2019-10149
cwes: CWE-78
cveID: CVE-2015-7450
vendorProject: IBM
product: WebSphere Application Server and Server Hypervisor Edition
vulnerabilityName: IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
dateAdded: 2022-01-10
shortDescription: Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2015-7450
cwes: CWE-94
cveID: CVE-2017-1000486
vendorProject: Primetek
product: Primefaces Application
vulnerabilityName: Primetek Primefaces Remote Code Execution Vulnerability
dateAdded: 2022-01-10
shortDescription: Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2017-1000486
cwes: CWE-326
cveID: CVE-2019-7609
vendorProject: Elastic
product: Kibana
vulnerabilityName: Kibana Arbitrary Code Execution
dateAdded: 2022-01-10
shortDescription: Kibana contain an arbitrary code execution flaw in the Timelion visualizer.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2019-7609
cwes: CWE-94
cveID: CVE-2021-27860
vendorProject: FatPipe
product: WARP, IPVPN, and MPVPN software
vulnerabilityName: FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit
dateAdded: 2022-01-10
shortDescription: A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-01-24
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-27860
cwes: CWE-434
cveID: CVE-2021-43890
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows AppX Installer Spoofing Vulnerability
dateAdded: 2021-12-15
shortDescription: Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-12-29
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-43890
cveID: CVE-2021-4102
vendorProject: Google
product: Chromium V8
vulnerabilityName: Google Chromium V8 Use-After-Free Vulnerability
dateAdded: 2021-12-15
shortDescription: Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-12-29
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-4102
cwes: CWE-416
cveID: CVE-2021-44515
vendorProject: Zoho
product: Desktop Central
vulnerabilityName: Zoho Desktop Central Authentication Bypass Vulnerability
dateAdded: 2021-12-10
shortDescription: Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-12-24
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-44515
cveID: CVE-2019-13272
vendorProject: Linux
product: Kernel
vulnerabilityName: Linux Kernel Improper Privilege Management Vulnerability
dateAdded: 2021-12-10
shortDescription: Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-06-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2019-13272
cwes: CWE-269
cveID: CVE-2021-35394
vendorProject: Realtek
product: Jungle Software Development Kit (SDK)
vulnerabilityName: Realtek Jungle SDK Remote Code Execution Vulnerability
dateAdded: 2021-12-10
shortDescription: RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-12-24
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-35394
cwes: CWE-78
CWE-138
cveID: CVE-2019-7238
vendorProject: Sonatype
product: Nexus Repository Manager
vulnerabilityName: Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability
dateAdded: 2021-12-10
shortDescription: Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-06-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2019-7238
cveID: CVE-2019-0193
vendorProject: Apache
product: Solr
vulnerabilityName: Apache Solr DataImportHandler Code Injection Vulnerability
dateAdded: 2021-12-10
shortDescription: The optional Apache Solr module DataImportHandler contains a code injection vulnerability.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-06-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2019-0193
cwes: CWE-94
cveID: CVE-2021-44168
vendorProject: Fortinet
product: FortiOS
vulnerabilityName: Fortinet FortiOS Arbitrary File Download
dateAdded: 2021-12-10
shortDescription: Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-12-24
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-44168
cwes: CWE-494
cveID: CVE-2017-17562
vendorProject: Embedthis
product: GoAhead
vulnerabilityName: Embedthis GoAhead Remote Code Execution Vulnerability
dateAdded: 2021-12-10
shortDescription: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-06-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2017-17562
cwes: CWE-20
cveID: CVE-2017-12149
vendorProject: Red Hat
product: JBoss Application Server
vulnerabilityName: Red Hat JBoss Application Server Remote Code Execution Vulnerability
dateAdded: 2021-12-10
shortDescription: The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-06-10
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2017-12149
cwes: CWE-502
cveID: CVE-2010-1871
vendorProject: Red Hat
product: JBoss Seam 2
vulnerabilityName: Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
dateAdded: 2021-12-10
shortDescription: JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-06-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2010-1871
cwes: CWE-20
cveID: CVE-2020-17463
vendorProject: Fuel CMS
product: Fuel CMS
vulnerabilityName: Fuel CMS SQL Injection Vulnerability
dateAdded: 2021-12-10
shortDescription: FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-06-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-17463
cwes: CWE-89
cveID: CVE-2020-8816
vendorProject: Pi-hole
product: AdminLTE
vulnerabilityName: Pi-Hole AdminLTE Remote Code Execution Vulnerability
dateAdded: 2021-12-10
shortDescription: Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-06-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-8816
cwes: CWE-78
cveID: CVE-2019-10758
vendorProject: MongoDB
product: mongo-express
vulnerabilityName: MongoDB mongo-express Remote Code Execution Vulnerability
dateAdded: 2021-12-10
shortDescription: mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-06-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2019-10758
cveID: CVE-2021-44228
vendorProject: Apache
product: Log4j2
vulnerabilityName: Apache Log4j2 Remote Code Execution Vulnerability
dateAdded: 2021-12-10
shortDescription: Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
requiredAction: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
dueDate: 2021-12-24
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-44228
cwes: CWE-20
CWE-400
CWE-502
cveID: CVE-2020-11261
vendorProject: Qualcomm
product: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
vulnerabilityName: Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
dateAdded: 2021-12-01
shortDescription: Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-06-01
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-11261
cwes: CWE-20
cveID: CVE-2018-14847
vendorProject: MikroTik
product: RouterOS
vulnerabilityName: MikroTik Router OS Directory Traversal Vulnerability
dateAdded: 2021-12-01
shortDescription: MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-06-01
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2018-14847
cwes: CWE-22
cveID: CVE-2021-37415
vendorProject: Zoho
product: ManageEngine ServiceDesk Plus (SDP)
vulnerabilityName: Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability
dateAdded: 2021-12-01
shortDescription: Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-12-15
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-37415
cwes: CWE-306
cveID: CVE-2021-40438
vendorProject: Apache
product: Apache
vulnerabilityName: Apache HTTP Server-Side Request Forgery (SSRF)
dateAdded: 2021-12-01
shortDescription: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-12-15
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-40438
cwes: CWE-918
cveID: CVE-2021-44077
vendorProject: Zoho
product: ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
vulnerabilityName: Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
dateAdded: 2021-12-01
shortDescription: Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-12-15
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-44077
cwes: CWE-306
cveID: CVE-2021-22204
vendorProject: Perl
product: Exiftool
vulnerabilityName: ExifTool Remote Code Execution Vulnerability
dateAdded: 2021-11-17
shortDescription: Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-12-01
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-22204
cwes: CWE-95
cveID: CVE-2021-40449
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Win32k Privilege Escalation Vulnerability
dateAdded: 2021-11-17
shortDescription: Unspecified vulnerability allows for an authenticated user to escalate privileges.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-12-01
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-40449
cwes: CWE-416
cveID: CVE-2021-42321
vendorProject: Microsoft
product: Exchange
vulnerabilityName: Microsoft Exchange Server Remote Code Execution Vulnerability
dateAdded: 2021-11-17
shortDescription: An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-12-01
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-42321
cwes: CWE-184
CWE-502
cveID: CVE-2021-42292
vendorProject: Microsoft
product: Office
vulnerabilityName: Microsoft Excel Security Feature Bypass
dateAdded: 2021-11-17
shortDescription: A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-12-01
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-42292
cwes: CWE-357
cveID: CVE-2021-27104
vendorProject: Accellion
product: FTA
vulnerabilityName: Accellion FTA OS Command Injection Vulnerability
dateAdded: 2021-11-03
shortDescription: Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-11-17
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-27104
cwes: CWE-20
CWE-78
cveID: CVE-2021-27102
vendorProject: Accellion
product: FTA
vulnerabilityName: Accellion FTA OS Command Injection Vulnerability
dateAdded: 2021-11-03
shortDescription: Accellion FTA contains an OS command injection vulnerability exploited via a local web service call.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-11-17
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-27102
cwes: CWE-20
CWE-78
cveID: CVE-2021-27101
vendorProject: Accellion
product: FTA
vulnerabilityName: Accellion FTA SQL Injection Vulnerability
dateAdded: 2021-11-03
shortDescription: Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-11-17
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-27101
cwes: CWE-89
CWE-138
cveID: CVE-2021-27103
vendorProject: Accellion
product: FTA
vulnerabilityName: Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability
dateAdded: 2021-11-03
shortDescription: Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-11-17
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-27103
cwes: CWE-918
cveID: CVE-2021-21017
vendorProject: Adobe
product: Acrobat and Reader
vulnerabilityName: Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability
dateAdded: 2021-11-03
shortDescription: Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-11-17
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-21017
cwes: CWE-122
cveID: CVE-2021-28550
vendorProject: Adobe
product: Acrobat and Reader
vulnerabilityName: Adobe Acrobat and Reader Use-After-Free Vulnerability
dateAdded: 2021-11-03
shortDescription: Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.
requiredAction: Apply updates per vendor instructions.
dueDate: 2021-11-17
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-28550
cwes: CWE-416
cveID: CVE-2018-4939
vendorProject: Adobe
product: ColdFusion
vulnerabilityName: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
dateAdded: 2021-11-03
shortDescription: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2018-4939
cwes: CWE-502
cveID: CVE-2018-15961
vendorProject: Adobe
product: ColdFusion
vulnerabilityName: Adobe ColdFusion Unrestricted File Upload Vulnerability
dateAdded: 2021-11-03
shortDescription: Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2018-15961
cwes: CWE-434
cveID: CVE-2018-4878
vendorProject: Adobe
product: Flash Player
vulnerabilityName: Adobe Flash Player Use-After-Free Vulnerability
dateAdded: 2021-11-03
shortDescription: Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.
requiredAction: The impacted product is end-of-life and should be disconnected if still in use.
dueDate: 2022-05-03
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2018-4878
cwes: CWE-416