deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-45227
Published: 2022-04-14
Description: An issue was discovered in COINS Construction Cloud 11.12. Due to an inappropriate use of HTML IFRAME elements, the file upload functionality is vulnerable to a persistent Cross-Site Scripting (XSS) attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://appsource.microsoft.com/en-us/product/web-apps/constructionindustrysolutionslimited-5057232.coinsconstructioncloud?tab=overview; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-030.txt; https://appsource.microsoft.com/en-us/product/web-apps/constructionindustrysolutionslimited-5057232.coinsconstructioncloud?tab=overview
CVE: CVE-2021-45228
Published: 2022-04-14
Description: An XSS issue was discovered in COINS Construction Cloud 11.12. Due to insufficient neutralization of user input in the description of a task, it is possible to store malicious JavaScript code in the task description. This is later executed when it is reflected back to the user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://appsource.microsoft.com/en-us/product/web-apps/constructionindustrysolutionslimited-5057232.coinsconstructioncloud?tab=overview; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-031.txt; https://appsource.microsoft.com/en-us/product/web-apps/constructionindustrysolutionslimited-5057232.coinsconstructioncloud?tab=overview
CVE: CVE-2022-1256
Published: 2022-04-14
Description: A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user to gain system privileges through running the repair functionality. Temporary file actions were performed on the local user's %TEMP% directory with System privileges through manipulation of symbolic links.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-59
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10382; https://kc.mcafee.com/corporate/index?page=content&id=SB10382
CVE: CVE-2022-1257
Published: 2022-04-14
Description: Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive information through storage in ma.db. The sensitive information has been moved to encrypted database files.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10382; https://kc.mcafee.com/corporate/index?page=content&id=SB10382
CVE: CVE-2022-1258
Published: 2022-04-14
Description: A blind SQL injection vulnerability in the ePolicy Orchestrator (ePO) extension of MA prior to 5.7.6 can be exploited by an authenticated administrator on ePO to perform arbitrary SQL queries in the back-end database, potentially leading to command execution on the server.
CVSS Score: 8.4 (HIGH)
CWE: CWE-89, CWE-89
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10382; https://kc.mcafee.com/corporate/index?page=content&id=SB10382
CVE: CVE-2022-27007
Published: 2022-04-14
Description: nginx njs 0.7.2 is affected suffers from Use-after-free in njs_function_frame_alloc() when it try to invoke from a restored frame saved with njs_function_frame_save().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/nginx/njs/commit/ad48705bf1f04b4221a5f5b07715ac48b3160d53; https://github.com/nginx/njs/issues/469; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-27008
Published: 2022-04-14
Description: nginx njs 0.7.2 is vulnerable to Buffer Overflow. Type confused in Array.prototype.concat() when a slow array appended element is fast array.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/nginx/njs/commit/e673ae41a998d1391bd562edb2ed6d49db7cc716; https://github.com/nginx/njs/issues/471; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-22181
Published: 2022-04-14
Description: A reflected Cross-site Scripting (XSS) vulnerability in J-Web of Juniper Networks Junos OS allows a network-based authenticated attacker to run malicious scripts reflected off J-Web to the victim's browser in the context of their session within J-Web. This may allow the attacker to gain control of the device or attack other authenticated user sessions. This issue affects: Juniper Networks Junos OS All versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R3-S9; 19.1 versions prior to 19.1R3-S6; 19.2 versions prior to 19.2R3-S3; 19.3 versions prior to 19.3R2-S6, 19.3R3-S3; 19.4 versions prior to 19.4R3-S5; 20.1 versions prior to 20.1R3-S4; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R1-S1, 21.1R2.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://kb.juniper.net/JSA69517; https://kb.juniper.net/JSA69517
CVE: CVE-2022-22182
Published: 2022-04-14
Description: A Cross-site Scripting (XSS) vulnerability in Juniper Networks Junos OS J-Web allows an attacker to construct a URL that when visited by another user enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S19; 15.1 versions prior to 15.1R7-S10; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R2-S10, 18.4R3-S9; 19.1 versions prior to 19.1R2-S3, 19.1R3-S6; 19.2 versions prior to 19.2R1-S8, 19.2R3-S3; 19.3 versions prior to 19.3R2-S6, 19.3R3-S3; 19.4 versions prior to 19.4R3-S5; 20.1 versions prior to 20.1R3-S2; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3; 20.4 versions prior to 20.4R2-S2, 20.4R3; 21.1 versions prior to 21.1R1-S1, 21.1R2; 21.2 versions prior to 21.2R1-S1, 21.2R2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://kb.juniper.net/JSA69519; https://kb.juniper.net/JSA69519
CVE: CVE-2022-22183
Published: 2022-04-14
Description: An Improper Access Control vulnerability in Juniper Networks Junos OS Evolved allows a network-based unauthenticated attacker who is able to connect to a specific open IPv4 port, which in affected releases should otherwise be unreachable, to cause the CPU to consume all resources as more traffic is sent to the port to create a Denial of Service (DoS) condition. Continued receipt and processing of these packets will create a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS Evolved 20.4 versions prior to 20.4R3-S2-EVO; 21.1 versions prior to 21.1R3-S1-EVO; 21.2 versions prior to 21.2R3-EVO; 21.3 versions prior to 21.3R2-EVO; 21.4 versions prior to 21.4R2-EVO. This issue does not affect Junos OS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16, CWE-200, CWE-284
References: https://kb.juniper.net/JSA69516; https://kb.juniper.net/JSA69516
CVE: CVE-2022-22185
Published: 2022-04-14
Description: A vulnerability in Juniper Networks Junos OS on SRX Series, allows a network-based unauthenticated attacker to cause a Denial of Service (DoS) by sending a specific fragmented packet to the device, resulting in a flowd process crash, which is responsible for packet forwarding. Continued receipt and processing of this specific packet will create a sustained DoS condition. This issue only affects SRX Series when 'preserve-incoming-fragment-size' feature is enabled. This issue affects Juniper Networks Junos OS on SRX Series: 18.3 versions prior to 18.3R3-S6; 18.4 versions prior to 18.4R3-S10; 19.1 versions prior to 19.1R3-S7; 19.2 versions prior to 19.2R3-S4; 19.3 versions prior to 19.3R3-S4; 19.4 versions prior to 19.4R3-S6; 20.1 versions prior to 20.1R3-S2; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2-S1, 21.1R3; 21.2 versions prior to 21.2R2. This issue does not affect Juniper Networks Junos OS prior to 17.3R1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://kb.juniper.net/JSA69493; https://kb.juniper.net/JSA69493
CVE: CVE-2022-22186
Published: 2022-04-14
Description: Due to an Improper Initialization vulnerability in Juniper Networks Junos OS on EX4650 devices, packets received on the management interface (em0) but not destined to the device, may be improperly forwarded to an egress interface, instead of being discarded. Such traffic being sent by a client may appear genuine, but is non-standard in nature and should be considered as potentially malicious. This issue affects: Juniper Networks Junos OS on EX4650 Series: All versions prior to 19.1R3-S8; 19.2 versions prior to 19.2R3-S5; 19.3 versions prior to 19.3R3-S5; 19.4 versions prior to 19.4R3-S7; 20.1 versions prior to 20.1R3-S3; 20.2 versions prior to 20.2R3-S4; 20.3 versions prior to 20.3R3-S3; 20.4 versions prior to 20.4R3-S2; 21.1 versions prior to 21.1R3-S1; 21.2 versions prior to 21.2R3; 21.3 versions prior to 21.3R2; 21.4 versions prior to 21.4R2; 22.1 versions prior to 22.1R1.
CVSS Score: 7.2 (HIGH)
CWE: CWE-665
References: https://kb.juniper.net/JSA69494; https://kb.juniper.net/JSA69494
CVE: CVE-2022-22187
Published: 2022-04-14
Description: An Improper Privilege Management vulnerability in the Windows Installer framework used in the Juniper Networks Juniper Identity Management Service (JIMS) allows an unprivileged user to trigger a repair operation. Running a repair operation, in turn, will trigger a number of file operations in the %TEMP% folder of the user triggering the repair. Some of these operations will be performed from a SYSTEM context (started via the Windows Installer service), including the execution of temporary files. An attacker may be able to provide malicious binaries to the Windows Installer, which will be executed with high privilege, leading to a local privilege escalation. This issue affects Juniper Networks Juniper Identity Management Service (JIMS) versions prior to 1.4.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0029/MNDT-2022-0029.md; https://kb.juniper.net/JSA69495; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0029/MNDT-2022-0029.md
CVE: CVE-2022-22188
Published: 2022-04-14
Description: An Uncontrolled Memory Allocation vulnerability leading to a Heap-based Buffer Overflow in the packet forwarding engine (PFE) of Juniper Networks Junos OS allows a network-based unauthenticated attacker to flood the device with traffic leading to a Denial of Service (DoS). The device must be configured with storm control profiling limiting the number of unknown broadcast, multicast, or unicast traffic to be vulnerable to this issue. This issue affects: Juniper Networks Junos OS on QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series; 20.2 version 20.2R1 and later versions prior to 20.2R2. This issue does not affect: Juniper Networks Junos OS versions prior to 20.2R1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-789
References: https://kb.juniper.net/JSA69497; https://kb.juniper.net/JSA69497
CVE: CVE-2022-22189
Published: 2022-04-14
Description: An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allows a locally authenticated user to have their permissions elevated without authentication thereby taking control of the local system they are currently authenticated to. This issue affects: Juniper Networks Contrail Service Orchestration 6.0.0 versions prior to 6.0.0 Patch v3 on On-premises installations. This issue does not affect Juniper Networks Contrail Service Orchestration On-premises versions prior to 6.0.0.
CVSS Score: 7.3 (HIGH)
CWE: CWE-288, CWE-708
References: https://kb.juniper.net/JSA69498; https://kb.juniper.net/JSA69498
CVE: CVE-2022-22190
Published: 2022-04-14
Description: An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a crafted URL to generate PDF reports, potentially containing sensitive configuration information. A feature was introduced in version 3.1 of the Paragon Active Assurance Control Center which allows users to selective share account data using a unique identifier. Knowing the proper format of the URL and the identifier of an existing object in an application it is possible to get access to that object without being logged in, even if the object is not shared, resulting in the opportunity for malicious exfiltration of user data. Note that the Paragon Active Assurance Control Center SaaS offering is not affected by this issue. This issue affects Juniper Networks Paragon Active Assurance version 3.1.0.
CVSS Score: 7.4 (HIGH)
CWE: CWE-284, CWE-639
References: https://kb.juniper.net/JSA69500; https://kb.juniper.net/JSA69500
CVE: CVE-2022-22191
Published: 2022-04-14
Description: A Denial of Service (DoS) vulnerability in the processing of a flood of specific ARP traffic in Juniper Networks Junos OS on the EX4300 switch, sent from the local broadcast domain, may allow an unauthenticated network-adjacent attacker to trigger a PFEMAN watchdog timeout, causing the Packet Forwarding Engine (PFE) to crash and restart. After the restart, transit traffic will be temporarily interrupted until the PFE is reprogrammed. In a virtual chassis (VC), the impacted Flexible PIC Concentrator (FPC) may split from the VC temporarily, and join back into the VC once the PFE restarts. Continued receipt and processing of these packets will create a sustained Denial of Service (DoS) condition. This issue affects Juniper Networks Junos OS on the EX4300: All versions prior to 15.1R7-S12; 18.4 versions prior to 18.4R2-S10, 18.4R3-S11; 19.1 versions prior to 19.1R3-S8; 19.2 versions prior to 19.2R1-S9, 19.2R3-S4; 19.3 versions prior to 19.3R3-S5; 19.4 versions prior to 19.4R2-S6, 19.4R3-S7; 20.1 versions prior to 20.1R3-S3; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S2; 20.4 versions prior to 20.4R3-S1; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R2-S1, 21.2R3; 21.3 versions prior to 21.3R1-S2, 21.3R2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-410, CWE-400
References: https://kb.juniper.net/JSA69502; https://kb.juniper.net/JSA69502
CVE: CVE-2022-22193
Published: 2022-04-14
Description: An Improper Handling of Unexpected Data Type vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a locally authenticated attacker with low privileges to cause a Denial of Service (DoS). Continued execution of this command might cause a sustained Denial of Service condition. If BGP rib sharding is configured and a certain CLI command is executed the rpd process can crash. During the rpd crash and restart, the routing protocols might be impacted and traffic disruption might be seen due to the loss of routing information. This issue affects: Juniper Networks Junos OS 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R2. Juniper Networks Junos OS Evolved 20.4 versions prior to 20.4R3-EVO; 21.1 versions prior to 21.1R3-EVO; 21.2 versions prior to 21.2R2-EVO. This issue does not affect: Juniper Networks Junos OS versions prior to 20.3R1. Juniper Networks Junos OS Evolved versions prior to 20.3R1-EVO.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-241
References: https://kb.juniper.net/JSA69503; https://kb.juniper.net/JSA69503
CVE: CVE-2022-22194
Published: 2022-04-14
Description: An Improper Check for Unusual or Exceptional Conditions vulnerability in the packetIO daemon of Juniper Networks Junos OS Evolved on PTX10003, PTX10004, and PTX10008 allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). Continued receipt of these crafted packets will cause a sustained Denial of Service condition. This issue affects Juniper Networks Junos OS Evolved all versions prior to 20.4R2-S3-EVO on PTX10003, PTX10004, and PTX10008. This issue does not affect: Juniper Networks Junos OS Evolved versions 21.1R1-EVO and above; Juniper Networks Junos OS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://kb.juniper.net/JSA69505; https://kb.juniper.net/JSA69505
CVE: CVE-2022-22195
Published: 2022-04-14
Description: An Improper Update of Reference Count vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to trigger a counter overflow, eventually causing a Denial of Service (DoS). This issue affects Juniper Networks Junos OS Evolved: All versions prior to 20.4R3-S1-EVO; 21.1 versions prior to 21.1R3-EVO; 21.2 versions prior to 21.2R3-EVO; 21.3 versions prior to 21.3R2-EVO. This issue does not affect Juniper Networks Junos OS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-911
References: https://kb.juniper.net/JSA69508; https://kb.juniper.net/JSA69508
CVE: CVE-2022-22196
Published: 2022-04-14
Description: An Improper Check for Unusual or Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker with an established ISIS adjacency to cause a Denial of Service (DoS). The rpd CPU spikes to 100% after a malformed ISIS TLV has been received which will lead to processing issues of routing updates and in turn traffic impact. This issue affects: Juniper Networks Junos OS 19.3 versions prior to 19.3R3-S4; 19.4 versions prior to 19.4R2-S6, 19.4R3-S6; 20.1 versions prior to 20.1R3-S2; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R2. Juniper Networks Junos OS Evolved All versions prior to 20.4R3-S3-EVO; 21.2 versions prior to 21.2R2-EVO. This issue does not affect Juniper Networks Junos OS versions prior to 19.3R1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-754
References: https://kb.juniper.net/JSA69509; https://kb.juniper.net/JSA69509
CVE: CVE-2022-22197
Published: 2022-04-14
Description: An Operation on a Resource after Expiration or Release vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker with an established BGP session to cause a Denial of Service (DoS). This issue occurs when proxy-generate route-target filtering is enabled, and certain proxy-route add and delete events are happening. This issue affects: Juniper Networks Junos OS All versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R2-S13, 17.4R3-S4; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8, 18.4R2-S8, 18.4R3-S6; 19.1 versions prior to 19.1R3-S4; 19.2 versions prior to 19.2R1-S6, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S1; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R2; 20.3 versions prior to 20.3R1-S2, 20.3R2. Juniper Networks Junos OS Evolved All versions prior to 20.1R3-EVO; 20.2 versions prior to 20.2R3-EVO; 20.3 versions prior to 20.3R2-EVO.
CVSS Score: 7.5 (HIGH)
CWE: CWE-672
References: https://kb.juniper.net/JSA69511; https://kb.juniper.net/JSA69511
CVE: CVE-2022-22198
Published: 2022-04-14
Description: An Access of Uninitialized Pointer vulnerability in the SIP ALG of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause a Denial of Service (DoS). Continued receipt of these specific packets will cause a sustained Denial of Service condition. On all MX and SRX platforms, if the SIP ALG is enabled, an MS-MPC or MS-MIC, or SPC will crash if it receives a SIP message with a specific contact header format. This issue affects Juniper Networks Junos OS on MX Series and SRX Series: 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2-S1, 21.1R3; 21.2 versions prior to 21.2R2. This issue does not affect versions prior to 20.4R1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-824, CWE-824
References: https://kb.juniper.net/JSA69513; https://kb.juniper.net/JSA69513
CVE: CVE-2022-25165
Published: 2022-04-14
Description: An issue was discovered in Amazon AWS VPN Client 2.0.0. A TOCTOU race condition exists during the validation of VPN configuration files. This allows parameters outside of the AWS VPN Client allow list to be injected into the configuration file prior to the AWS VPN Client service (running as SYSTEM) processing the file. Dangerous arguments can be injected by a low-level user such as log, which allows an arbitrary destination to be specified for writing log files. This leads to an arbitrary file write as SYSTEM with partial control over the files content. This can be abused to cause an elevation of privilege or denial of service.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367
References: https://github.com/RhinoSecurityLabs/CVEs; https://rhinosecuritylabs.com/aws/cve-2022-25165-aws-vpn-client/; https://github.com/RhinoSecurityLabs/CVEs
CVE: CVE-2022-25166
Published: 2022-04-14
Description: An issue was discovered in Amazon AWS VPN Client 2.0.0. It is possible to include a UNC path in the OpenVPN configuration file when referencing file paths for parameters (such as auth-user-pass). When this file is imported and the client attempts to validate the file path, it performs an open operation on the path and leaks the user's Net-NTLMv2 hash to an external server. This could be exploited by having a user open a crafted malicious ovpn configuration file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://github.com/RhinoSecurityLabs/CVEs; https://rhinosecuritylabs.com/aws/cve-2022-25165-aws-vpn-client/; https://github.com/RhinoSecurityLabs/CVEs
CVE: CVE-2022-27814
Published: 2022-04-14
Description: SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option.
CVSS Score: 3.3 (LOW)
CWE: CWE-203
References: https://github.com/waycrate/swhkd/releases; https://www.openwall.com/lists/oss-security/2022/04/14/1; https://github.com/waycrate/swhkd/releases
CVE: CVE-2022-27817
Published: 2022-04-14
Description: SWHKD 1.1.5 consumes the keyboard events of unintended users. This could potentially cause an information leak, but is usually a denial of functionality.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-668
References: https://github.com/waycrate/swhkd/releases; https://www.openwall.com/lists/oss-security/2022/04/14/1; https://github.com/waycrate/swhkd/releases
CVE: CVE-2022-22391
Published: 2022-04-14
Description: IBM Aspera High-Speed Transfer 4.3.1 and earlier could allow an authenticated user to obtain information from non sensitive operating system files that they should not have access to. IBM X-Force ID: 222059.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/222059; https://www.ibm.com/support/pages/node/6571735; https://exchange.xforce.ibmcloud.com/vulnerabilities/222059
CVE: CVE-2021-21914
Published: 2022-04-14
Description: A heap-based buffer overflow vulnerability exists in the DecoderStream::Append functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-190
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1362; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1362
CVE: CVE-2021-21938
Published: 2022-04-14
Description: A heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-193, CWE-193
References: http://help.accusoft.com/ImageGear/v20.0/Windows/DLL/webframe.html; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1367; http://help.accusoft.com/ImageGear/v20.0/Windows/DLL/webframe.html
CVE: CVE-2021-21939
Published: 2022-04-14
Description: A heap-based buffer overflow vulnerability exists in the XWD parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1368; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1368