deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-39186
Published: 2021-09-01
Description: GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, the username column of the GlobalNewFiles special page is vulnerable to a stored XSS. Commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d contains a patch. As a workaround, one may disallow <,> (or other characters required to insert html/js) from being used in account names so an XSS is not possible.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/miraheze/GlobalNewFiles/commit/cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d; https://github.com/miraheze/GlobalNewFiles/security/advisories/GHSA-57p5-hqjq-h7vg; https://phabricator.miraheze.org/T7935
CVE: CVE-2021-40385
Published: 2021-09-01
Description: An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is a privilege escalation from read-only user to admin.
CVSS Score: 8.8 (HIGH)
References: https://csirt.divd.nl/csirt-divd-nl/cases/DIVD-2021-00014/; https://csirt.divd.nl/csirt-divd-nl/cases/DIVD-2021-00014/
CVE: CVE-2021-40387
Published: 2021-09-01
Description: An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is authenticated remote code execution.
CVSS Score: 8.8 (HIGH)
References: https://csirt.divd.nl/csirt-divd-nl/cases/DIVD-2021-00014/; https://csirt.divd.nl/csirt-divd-nl/cases/DIVD-2021-00014/
CVE: CVE-2020-20343
Published: 2021-09-01
Description: WTCMS 1.0 contains a cross-site request forgery (CSRF) vulnerability in the index.php?g=admin&m=nav&a=add_post component that allows attackers to arbitrarily add articles in the administrator background.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/taosir/wtcms/issues/8; https://github.com/taosir/wtcms/issues/8
CVE: CVE-2020-20344
Published: 2021-09-01
Description: WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the keyword search function under the background articles module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/taosir/wtcms/issues/9; https://github.com/taosir/wtcms/issues/9
CVE: CVE-2020-20345
Published: 2021-09-01
Description: WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the page management background which allows attackers to obtain cookies via a crafted payload entered into the search box.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://wtcms.com; https://github.com/taosir/wtcms; https://github.com/taosir/wtcms/issues/10
CVE: CVE-2020-20347
Published: 2021-09-01
Description: WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the source field under the article management module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/taosir/wtcms/issues/11; https://github.com/taosir/wtcms/issues/11
CVE: CVE-2020-20348
Published: 2021-09-01
Description: WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link field under the background menu management module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/taosir/wtcms/issues/11; https://github.com/taosir/wtcms/issues/11
CVE: CVE-2020-20349
Published: 2021-09-01
Description: WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link address field under the background links module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/taosir/wtcms/issues/11; https://github.com/taosir/wtcms/issues/11
CVE: CVE-2021-39115
Published: 2021-09-01
Description: Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0.
CVSS Score: 7.2 (HIGH)
CWE: CWE-96, CWE-94
References: https://jira.atlassian.com/browse/JSDSERVER-8665; https://jira.atlassian.com/browse/JSDSERVER-8665
CVE: CVE-2021-39119
Published: 2021-09-01
Description: Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue even after their Jira account is revoked, via a Broken Access Control vulnerability in the issue notification feature. The affected versions are before version 8.19.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://jira.atlassian.com/browse/JRASERVER-72737; https://jira.atlassian.com/browse/JRASERVER-72737
CVE: CVE-2021-31797
Published: 2021-09-02
Description: The user identification mechanism used by CyberArk Credential Provider prior to 12.1 is susceptible to a local host race condition, leading to password disclosure.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-331, CWE-362
References: http://packetstormsecurity.com/files/164033/CyberArk-Credential-Provider-Race-Condition-Authorization-Bypass.html; http://seclists.org/fulldisclosure/2021/Sep/2; https://korelogic.com/Resources/Advisories/KL-001-2021-009.txt
CVE: CVE-2021-31796
Published: 2021-09-02
Description: An inadequate encryption vulnerability discovered in CyberArk Credential Provider before 12.1 may lead to Information Disclosure. An attacker may realistically have enough information that the number of possible keys (for a credential file) is only one, and the number is usually not higher than 2^36.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: http://packetstormsecurity.com/files/164023/CyberArk-Credential-File-Insufficient-Effective-Key-Space.html; http://seclists.org/fulldisclosure/2021/Sep/1; https://korelogic.com/Resources/Advisories/KL-001-2021-008.txt
CVE: CVE-2021-31798
Published: 2021-09-02
Description: The effective key space used to encrypt the cache in CyberArk Credential Provider prior to 12.1 has low entropy, and under certain conditions a local malicious user can obtain the plaintext of cache files.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-331
References: http://packetstormsecurity.com/files/164035/CyberArk-Credential-Provider-Local-Cache-Decryption.html; http://seclists.org/fulldisclosure/2021/Sep/3; https://korelogic.com/Resources/Advisories/KL-001-2021-010.txt
CVE: CVE-2021-34732
Published: 2021-09-02
Description: A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-prime-collab-xss-fQMDE5GO; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-prime-collab-xss-fQMDE5GO
CVE: CVE-2021-34733
Published: 2021-09-02
Description: A vulnerability in the CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, local attacker to access sensitive information stored on the underlying file system of an affected system. This vulnerability exists because sensitive information is not sufficiently secured when it is stored. An attacker could exploit this vulnerability by gaining unauthorized access to sensitive information on an affected system. A successful exploit could allow the attacker to create forged authentication requests and gain unauthorized access to the affected system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-prime-info-disc-nTU9FJ2; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-prime-info-disc-nTU9FJ2
CVE: CVE-2021-34746
Published: 2021-09-02
Description: A vulnerability in the TACACS+ authentication, authorization and accounting (AAA) feature of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to bypass authentication and log in to an affected device as an administrator. This vulnerability is due to incomplete validation of user-supplied input that is passed to an authentication script. An attacker could exploit this vulnerability by injecting parameters into an authentication request. A successful exploit could allow the attacker to bypass authentication and log in as an administrator to the affected device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-289, CWE-287
References: https://github.com/orangecertcc/security-research/security/advisories/GHSA-gqx8-c4xr-c664; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nfvis-g2DMVVh; https://github.com/orangecertcc/security-research/security/advisories/GHSA-gqx8-c4xr-c664
CVE: CVE-2021-34759
Published: 2021-09-02
Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. To exploit this vulnerability, an attacker would need valid administrative credentials.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-4HnZFewr; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-4HnZFewr
CVE: CVE-2021-34765
Published: 2021-09-02
Description: A vulnerability in the web UI for Cisco Nexus Insights could allow an authenticated, remote attacker to view and download files related to the web application. The attacker requires valid device credentials. This vulnerability exists because proper role-based access control (RBAC) filters are not applied to file download actions. An attacker could exploit this vulnerability by logging in to the application and then navigating to the directory listing and download functions. A successful exploit could allow the attacker to download sensitive files that should be restricted, which could result in disclosure of sensitive information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-552, CWE-552
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-insight-infodis-2By2ZpBB; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-insight-infodis-2By2ZpBB
CVE: CVE-2021-3757
Published: 2021-09-02
Description: immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://github.com/immerjs/immer/commit/fa671e55ee9bd42ae08cc239102b665a23958237; https://huntr.dev/bounties/23d38099-71cd-42ed-a77a-71e68094adfa; https://github.com/immerjs/immer/commit/fa671e55ee9bd42ae08cc239102b665a23958237
CVE: CVE-2021-3758
Published: 2021-09-02
Description: bookstack is vulnerable to Server-Side Request Forgery (SSRF)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/bookstackapp/bookstack/commit/bee5e2c7ca637d034c6985c0328cef0ce068778e; https://huntr.dev/bounties/a8d7fb24-9a69-42f3-990a-2db93b53f76b; https://github.com/bookstackapp/bookstack/commit/bee5e2c7ca637d034c6985c0328cef0ce068778e
CVE: CVE-2021-33928
Published: 2021-09-02
Description: Buffer overflow vulnerability in function pool_installable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/openSUSE/libsolv/issues/417; https://github.com/openSUSE/libsolv/issues/417
CVE: CVE-2021-33929
Published: 2021-09-02
Description: Buffer overflow vulnerability in function pool_disabled_solvable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/openSUSE/libsolv/issues/417; https://github.com/openSUSE/libsolv/issues/417
CVE: CVE-2021-33930
Published: 2021-09-02
Description: Buffer overflow vulnerability in function pool_installable_whatprovides in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/openSUSE/libsolv/issues/417; https://github.com/openSUSE/libsolv/issues/417
CVE: CVE-2021-33938
Published: 2021-09-02
Description: Buffer overflow vulnerability in function prune_to_recommended in src/policy.c in libsolv before 0.7.17 allows attackers to cause a Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/openSUSE/libsolv/issues/420; https://github.com/openSUSE/libsolv/issues/420
CVE: CVE-2021-21086
Published: 2021-09-02
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by an Out-of-bounds Write vulnerability in the CoolType library. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-39187
Published: 2021-09-02
Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the `explain` option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch. There is a patch for this issue in version 4.10.3. No workarounds aside from upgrading are known to exist.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74, CWE-755
References: https://github.com/parse-community/parse-server/commit/308668c89474223e2448be92d6823b52c1c313ec; https://github.com/parse-community/parse-server/releases/tag/4.10.3; https://github.com/parse-community/parse-server/security/advisories/GHSA-xqp8-w826-hh6x
CVE: CVE-2019-10095
Published: 2021-09-02
Description: bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://www.openwall.com/lists/oss-security/2021/09/02/1; https://lists.apache.org/thread.html/rd56389ba9cab30a6c976b9a4a6df0f85cbe8fba6a60a3cf6e3ba716b%40%3Cusers.zeppelin.apache.org%3E; https://lists.apache.org/thread.html/rdf06e8423833b3daadc30c56a2ff47c48920864d5199476daa897208%40%3Cannounce.apache.org%3E
CVE: CVE-2020-13929
Published: 2021-09-02
Description: Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act as another user. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2021/09/02/2; https://lists.apache.org/thread.html/r768800925d6407a6a87ccae0ec98776b7bda50c0e3ed3d0130dad028%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/r768800925d6407a6a87ccae0ec98776b7bda50c0e3ed3d0130dad028%40%3Cusers.zeppelin.apache.org%3E
CVE: CVE-2021-22525
Published: 2021-09-02
Description: This release addresses a potential information leakage vulnerability in NetIQ Access Manager versions prior to 5.0.1
CVSS Score: 5.5 (MEDIUM)
References: https://support.microfocus.com/kb/doc.php?id=7025254; https://support.microfocus.com/kb/doc.php?id=7025254
CVE: CVE-2021-22704
Published: 2021-09-02
Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01
CVE: CVE-2021-22775
Published: 2021-09-02
Description: A CWE-427: Uncontrolled Search Path Element vulnerability exists in GP-Pro EX,V4.09.250 and prior, that could cause local code execution with elevated privileges when installing the software.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-03; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-03
CVE: CVE-2021-22789
Published: 2021-09-02
Description: A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-04; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-04
CVE: CVE-2021-22790
Published: 2021-09-02
Description: A CWE-125: Out-of-bounds Read vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-05; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-04; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-05
CVE: CVE-2021-22791
Published: 2021-09-02
Description: A CWE-787: Out-of-bounds Write vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-06; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-04; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-06
CVE: CVE-2021-22792
Published: 2021-09-02
Description: A CWE-476: NULL Pointer Dereference vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-07; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-04; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-07
CVE: CVE-2021-22793
Published: 2021-09-02
Description: A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exist in AccuSine PCS+ / PFV+ (Versions prior to V1.6.7) and AccuSine PCSn (Versions prior to V2.2.4) that could allow an authenticated attacker to access the device via FTP protocol.
CVSS Score: 7.2 (HIGH)
CWE: CWE-200
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-05; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01
CVE: CVE-2021-27578
Published: 2021-09-02
Description: Cross Site Scripting vulnerability in markdown interpreter of Apache Zeppelin allows an attacker to inject malicious scripts. This issue affects Apache Zeppelin Apache Zeppelin versions prior to 0.9.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2021/09/02/3; https://lists.apache.org/thread.html/r31012f2c8e39a5e12e14c1de030012cb8b51c037d953d73b291b7b50%40%3Cusers.zeppelin.apache.org%3E; https://lists.apache.org/thread.html/r90590aa5ea788128ecc2e822e1e64d5200b4cb92b06707b38da4cb3d%40%3Cannounce.apache.org%3E
CVE: CVE-2021-28550
Published: 2021-09-02
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]0 (and earlier), 2[PII_REDACTED]0 (and earlier) and 2[PII_REDACTED]4 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-29.html; https://helpx.adobe.com/security/products/acrobat/apsb21-29.html; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28550