deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-4044
Published: 2021-12-14
Description: Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent call to SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY. This return value is only supposed to be returned by OpenSSL if the application has previously called SSL_CTX_set_cert_verify_callback(). Since most applications do not do this the SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be totally unexpected and applications may not behave correctly as a result. The exact behaviour will depend on the application but it could result in crashes, infinite loops or other similar incorrect responses. This issue is made more serious in combination with a separate bug in OpenSSL 3.0 that will cause X509_verify_cert() to indicate an internal error when processing a certificate chain. This will occur where a certificate does not include the Subject Alternative Name extension but where a Certificate Authority has enforced name constraints. This issue can occur even with valid chains. By combining the two issues an attacker could induce incorrect, application dependent behaviour. Fixed in OpenSSL 3.0.1 (Affected 3.0.0).
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=[PII_REDACTED]91c537ea[PII_REDACTED]4aa86f91f256; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.openssl.org/news/secadv/20211214.txt
CVE: CVE-2021-34425
Published: 2021-12-14
Description: The Zoom Client for Meetings before version 5.7.3 (for Android, iOS, Linux, macOS, and Windows) contain a server side request forgery vulnerability in the chat\'s "link preview" functionality. In versions prior to 5.7.3, if a user were to enable the chat\'s "link preview" feature, a malicious actor could trick the user into potentially sending arbitrary HTTP GET requests to URLs that the actor cannot reach directly.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-918
References: https://explore.zoom.us/en/trust/security/security-bulletin; https://explore.zoom.us/en/trust/security/security-bulletin
CVE: CVE-2021-34426
Published: 2021-12-14
Description: A vulnerability was discovered in the Keybase Client for Windows before version 5.6.0 when a user executed the "keybase git lfs-config" command on the command-line. In versions prior to 5.6.0, a malicious actor with write access to a user\'s Git repository could leverage this vulnerability to potentially execute arbitrary Windows commands on a user\'s local system.
CVSS Score: 5.3 (MEDIUM)
References: https://explore.zoom.us/en/trust/security/security-bulletin; https://explore.zoom.us/en/trust/security/security-bulletin
CVE: CVE-2021-39183
Published: 2021-12-14
Description: Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-src is required to be set to blob for the video player.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://github.com/owncast/owncast/security/advisories/GHSA-2hfj-cxw7-g45p; https://github.com/owncast/owncast/security/advisories/GHSA-2hfj-cxw7-g45p
CVE: CVE-2021-43051
Published: 2021-12-14
Description: The Spotfire Server component of TIBCO Software Inc.'s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of those granted to it. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Server: versions 10.10.6 and below, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0, and 11.4.1, and TIBCO Spotfire Server: versions 11.5.0 and 11.6.0.
CVSS Score: 7.1 (HIGH)
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2021/12/tibco-security-advisory-december-14-2021-tibco-spotfire-server-2021-43051; https://www.tibco.com/services/support/advisories
CVE: CVE-2021-43821
Published: 2021-12-14
Description: Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and making them available via the web interface. Before Opencast 9.10 and 10.6, Opencast would open and include local files during ingests. Attackers could exploit this to include most local files the process has read access to, extracting secrets from the host machine. An attacker would need to have the privileges required to add new media to exploit this. But these are often widely given. The issue has been fixed in Opencast 10.6 and 11.0. You can mitigate this issue by narrowing down the read access Opencast has to files on the file system using UNIX permissions or mandatory access control systems like SELinux. This cannot prevent access to files Opencast needs to read though and we highly recommend updating.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-552, CWE-552
References: https://github.com/opencast/opencast/blob/[PII_REDACTED]1cf578363e3b97d8edaf334ff51253/modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java#L1587; https://github.com/opencast/opencast/commit/65c46b9d3e8f045c[PII_REDACTED][PII_REDACTED]7764; https://github.com/opencast/opencast/security/advisories/GHSA-59g4-hpg3-3gcp
CVE: CVE-2021-43828
Published: 2021-12-14
Description: PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.77 an improper privilege management (IDOR) has been found in PatrowlManager. All imports findings file is placed under /media/imports/<owner_id>/<tmp_file> In that, owner_id is predictable and tmp_file is in format of import_<ownder_id>_<time_created>, for example: import_1_[PII_REDACTED]82.json This filename is predictable and allows anyone without logging in to download all finding import files This vulnerability is capable of allowing unlogged in users to download all finding imports file. Users are advised to update to 1.7.7 as soon as possible. There are no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269, CWE-639
References: https://github.com/Patrowl/PatrowlManager/security/advisories/GHSA-x4wp-xvq7-w5vr; https://huntr.dev/bounties/fe6248f1-603d-43df-816c-c75534a56f72; https://github.com/Patrowl/PatrowlManager/security/advisories/GHSA-x4wp-xvq7-w5vr
CVE: CVE-2021-43829
Published: 2021-12-14
Description: PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.7.7 PatrowlManager unrestrictly handle upload files in the findings import feature. This vulnerability is capable of uploading dangerous type of file to server leading to XSS attacks and potentially other forms of code injection. Users are advised to update to 1.7.7 as soon as possible. There are no known workarounds for this issue.
CVSS Score: 7.4 (HIGH)
CWE: CWE-434
References: https://github.com/Patrowl/PatrowlManager/commit/2287c9715d2e7ef11b44bb0ad4a57727654f2203; https://github.com/Patrowl/PatrowlManager/security/advisories/GHSA-5hc9-6hq4-2xfx; https://huntr.dev/bounties/17324785-f83a-4058-ac40-03f2bfa16399/
CVE: CVE-2021-43830
Published: 2021-12-14
Description: OpenProject is a web-based project management software. OpenProject versions >= 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the "Edit budgets" permission, the request to reassign work packages to another budget unsufficiently sanitizes user input in the `reassign_to_id` parameter. The vulnerability has been fixed in version 12.0.4. Versions prior to 12.0.0 are not affected. If you're upgrading from an older version, ensure you are upgrading to at least version 12.0.4. If you are unable to upgrade in a timely fashion, the following patch can be applied: https://github.com/opf/openproject/pull/9983.patch
CVSS Score: 7.4 (HIGH)
CWE: CWE-89
References: https://github.com/opf/openproject/pull/9983; https://github.com/opf/openproject/pull/9983.patch; https://github.com/opf/openproject/releases/tag/v12.0.4
CVE: CVE-2021-44948
Published: 2021-12-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-44942. Reason: This candidate is a duplicate of CVE-2021-44942. Notes: All CVE users should reference CVE-2021-44942 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-4108
Published: 2021-12-14
Description: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/snipe/snipe-it/commit/9d5d1a9f9aae2c8baee48551185da5de0cdb62c2; https://huntr.dev/bounties/5069a037-040e-4d77-8526-846e65edfaf4; https://github.com/snipe/snipe-it/commit/9d5d1a9f9aae2c8baee48551185da5de0cdb62c2
CVE: CVE-2021-44942
Published: 2021-12-14
Description: glFusion CMS 1.7.9 is affected by a Cross Site Request Forgery (CSRF) vulnerability in /public_html/admin/plugins/bad_behavior2/blacklist.php. Using the CSRF vulnerability to trick the administrator to click, an attacker can add a blacklist.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/glFusion/glfusion/issues/486; https://github.com/glFusion/glfusion/issues/486
CVE: CVE-2021-43827
Published: 2021-12-14
Description: discourse-footnote is a library providing footnotes for posts in Discourse. ### Impact When posting an inline footnote wrapped in `<a>` tags (e.g. `<a>^[footnote]</a>`, the resulting rendered HTML would include a nested `<a>`, which is stripped by Nokogiri because it is not valid. This then caused a javascript error on topic pages because we were looking for an `<a>` element inside the footnote reference span and getting its ID, and because it did not exist we got a null reference error in javascript. Users are advised to update to version 0.2. As a workaround editing offending posts from the rails console or the database console for self-hosters, or disabling the plugin in the admin panel can mitigate this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-755
References: https://github.com/discourse/discourse-footnote/commit/796617e[PII_REDACTED][PII_REDACTED]22cd1946661ab; https://github.com/discourse/discourse-footnote/security/advisories/GHSA-58vr-c56v-qr57; https://github.com/discourse/discourse-footnote/commit/796617e[PII_REDACTED][PII_REDACTED]22cd1946661ab
CVE: CVE-2021-4110
Published: 2021-12-15
Description: mruby is vulnerable to NULL Pointer Dereference
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/mruby/mruby/commit/f5e10c5a79a17939af763b1dcf5232ce47e24a34; https://huntr.dev/bounties/4ce5dc47-2512-4c87-8609-453adc8cad20; https://github.com/mruby/mruby/commit/f5e10c5a79a17939af763b1dcf5232ce47e24a34
CVE: CVE-2021-41844
Published: 2021-12-15
Description: Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://crocoblock.com/changelog/?plugin=jet-engine; https://crocoblock.com/changelog/?plugin=jet-engine
CVE: CVE-2021-41870
Published: 2021-12-15
Description: An issue was discovered in the firmware update form in Socomec REMOTE VIEW PRO 2.0.41.4. An authenticated attacker can bypass a client-side file-type check and upload arbitrary .php files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://f20.be/cves/socomec; https://www.socomec.com/remote-view-software_en.html; https://f20.be/cves/socomec
CVE: CVE-2021-41871
Published: 2021-12-15
Description: An issue was discovered in Socomec REMOTE VIEW PRO 2.0.41.4. Improper validation of input into the username field makes it possible to place a stored XSS payload. This is executed if an administrator views the System Event Log.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://f20.be/cves/socomec; https://www.socomec.com/remote-view-software_en.html; https://f20.be/cves/socomec
CVE: CVE-2021-26787
Published: 2021-12-15
Description: A cross site scripting (XSS) vulnerability in Genesys Workforce Management 8.5.214.20 can occur (during record deletion) via the Time-off parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://genesys.com; https://medium.com/%40reliable_lait_mouse_975/cross-site-scripting-vulnerability-within-genesys-workforce-management-version-8-5-214-20-a68500cf5e18; http://genesys.com
CVE: CVE-2021-36450
Published: 2021-12-15
Description: Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://verint.com; https://medium.com/%401nf0sk/cve-2021-36450-cross-site-scripting-xss-6f5d8d7db740; https://sushantvkamble.blogspot.com/2021/11/cross-site-scripting-xss.html
CVE: CVE-2021-38701
Published: 2021-12-15
Description: Certain Motorola Solutions Avigilon devices allow XSS in the administrative UI. This affects T200/201 before 4.10.0.68; T290 before 4.4.0.80; T008 before 2.2.0.86; T205 before 4.12.0.62; T204 before 3.28.0.166; and T100, T101, T102, and T103 before 2.6.0.180.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://support.avigilon.com/s/feed/0D54y00006l9eCMCAY; https://www.motorolasolutions.com/en_us/about/trust-center/security.html; https://support.avigilon.com/s/feed/0D54y00006l9eCMCAY
CVE: CVE-2021-40170
Published: 2021-12-15
Description: An RF replay attack vulnerability in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-ITR-F1-BD_BL.A30.20181117, allows an attacker to trigger arbitrary system functionality by replaying previously recorded signals. This lets an adversary, among other things, disarm an armed system.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-294
References: https://www.diva-portal.org/smash/get/diva2:1600180/FULLTEXT04.pdf; https://www.securitashome.se/product.html/securitashome; https://www.diva-portal.org/smash/get/diva2:1600180/FULLTEXT04.pdf
CVE: CVE-2021-40171
Published: 2021-12-15
Description: The absence of notifications regarding an ongoing RF jamming attack in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-ITR-F1-BD_BL.A30.20181117, allows an attacker to block legitimate traffic while not alerting the owner of the system.
CVSS Score: 5.3 (MEDIUM)
References: https://www.diva-portal.org/smash/get/diva2:1600180/FULLTEXT04.pdf; https://www.securitashome.se/product.html/securitashome; https://www.diva-portal.org/smash/get/diva2:1600180/FULLTEXT04.pdf
CVE: CVE-2021-40826
Published: 2021-12-15
Description: Clementine Music Player through 1.3.1 is vulnerable to a User Mode Write Access Violation, affecting the MP3 file parsing functionality at clementine+0x3aa207. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine. Attackers could exploit this issue to cause a crash (DoS) of the clementine.exe process or achieve arbitrary code execution in the context of the current logged-in Windows user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://voidsec.com/advisories/cve-2021-40826/; https://voidsec.com/advisories/cve-2021-40826/
CVE: CVE-2021-40827
Published: 2021-12-15
Description: Clementine Music Player through 1.3.1 (when a GLib 2.0.0 DLL is used) is vulnerable to a Read Access Violation on Block Data Move, affecting the MP3 file parsing functionality at memcpy+0x265. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine. Attackers could exploit this issue to cause a crash (DoS) of the clementine.exe process or achieve arbitrary code execution in the context of the current logged-in Windows user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://voidsec.com/advisories/cve-2021-40827/; https://voidsec.com/advisories/cve-2021-40827/
CVE: CVE-2021-41557
Published: 2021-12-15
Description: Sofico Miles RIA 2020.2 Build 127964T is affected by Stored Cross Site Scripting (XSS). An attacker with access to a user account of the RIA IT or the Fleet role can create a crafted work order in the damage reports section (or change existing work orders). The XSS payload is in the work order number.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/165278/Sofico-Miles-RIA-2020.2-Build-127964T-Cross-Site-Scripting.html; https://www.sofico.global; http://packetstormsecurity.com/files/165278/Sofico-Miles-RIA-2020.2-Build-127964T-Cross-Site-Scripting.html
CVE: CVE-2021-41560
Published: 2021-12-15
Description: OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/Nickguitar/RevCAT; https://github.com/opencats/OpenCATS/commit/b1af3bde1f68bec1c703ad66a3e390f15ed8ebe1; https://youtu.be/isiDISag7CM
CVE: CVE-2021-42220
Published: 2021-12-15
Description: A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/164544/Dolibarr-ERP-CRM-14.0.2-Cross-Site-Scripting-Privilege-Escalation.html; https://truedigitalsecurity.com/advisory-summary-2021; https://packetstormsecurity.com/files/164544/Dolibarr-ERP-CRM-14.0.2-Cross-Site-Scripting-Privilege-Escalation.html
CVE: CVE-2021-42945
Published: 2021-12-15
Description: A SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.zzcms.net/; https://github.com/Boomingjacob/ZZCMS/blob/main/4.jpg; http://www.zzcms.net/
CVE: CVE-2021-43113
Published: 2021-12-15
Description: iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/itext/itext7/releases/tag/7.1.17; https://github.com/itext/itextpdf/releases/tag/5.5.13.3; https://lists.debian.org/debian-lts-announce/2023/01/msg00013.html
CVE: CVE-2021-43325
Published: 2021-12-15
Description: Automox Agent 33 on Windows incorrectly sets permissions on a temporary directory. NOTE: this issue exists because of a CVE-2021-43326 regression.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://community.automox.com/product-updates-4/cve-2021-43326-and-cve-2021-43325-local-privilege-escalation-in-automox-agent-windows-only-1636; https://support.automox.com/help/release-notes; https://community.automox.com/product-updates-4/cve-2021-43326-and-cve-2021-43325-local-privilege-escalation-in-automox-agent-windows-only-1636
CVE: CVE-2021-43326
Published: 2021-12-15
Description: Automox Agent before 32 on Windows incorrectly sets permissions on a temporary directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: http://packetstormsecurity.com/files/165449/Automox-Agent-32-Local-Privilege-Escalation.html; https://community.automox.com/product-updates-4/cve-2021-43326-and-cve-2021-43325-local-privilege-escalation-in-automox-agent-windows-only-1636; https://support.automox.com/help/release-notes
CVE: CVE-2019-19138
Published: 2021-12-15
Description: Ivanti Workspace Control before 10.4.50.0 allows attackers to degrade integrity.
CVSS Score: 7.5 (HIGH)
References: https://forums.ivanti.com/s/article/Enhanced-Security-Update-IWC-components; https://forums.ivanti.com/s/article/Security-Alert-Ivanti-RES-Workspace-Manager-November-2019; https://forums.ivanti.com/s/article/Enhanced-Security-Update-IWC-components
CVE: CVE-2020-23545
Published: 2021-12-15
Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ReadXPM_W+0x[PII_REDACTED]000531.
CVSS Score: 7.8 (HIGH)
References: https://github.com/nhiephon/Research/blob/master/Irfanview/0x[PII_REDACTED]000531.MD; https://github.com/nhiephon/Research/blob/master/README.md; https://www.irfanview.com/plugins.htm
CVE: CVE-2021-45043
Published: 2021-12-15
Description: HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://drive.google.com/file/d/1DlfZz0F8skWy3Mkahx_NMo-sYZh9-eun/view?usp=sharing; https://drive.google.com/file/d/1bx9yCN-IHYuRpd7g3jhMb0LcTC1ARzSX/view?usp=sharing; https://drive.google.com/file/d/1DlfZz0F8skWy3Mkahx_NMo-sYZh9-eun/view?usp=sharing
CVE: CVE-2021-4111
Published: 2021-12-15
Description: yetiforcecrm is vulnerable to Business Logic Errors
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-840, CWE-20
References: https://github.com/yetiforcecompany/yetiforcecrm/commit/c1ad7111a090adfcd5898af40724907adc987acf; https://huntr.dev/bounties/8afc8981-baff-4082-b640-be535b29eb9a; https://github.com/yetiforcecompany/yetiforcecrm/commit/c1ad7111a090adfcd5898af40724907adc987acf
CVE: CVE-2021-20330
Published: 2021-12-15
Description: An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.27; MongoDB Server v4.2 versions prior to 4.2.16; MongoDB Server v4.4 versions prior to 4.4.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://jira.mongodb.org/browse/SERVER-36263; https://jira.mongodb.org/browse/SERVER-36263
CVE: CVE-2021-4116
Published: 2021-12-15
Description: yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yetiforcecompany/yetiforcecrm/commit/9cdb012ca64ff1f719f8120d5fd162cd5ef1013f; https://huntr.dev/bounties/7561bae7-9053-4dc8-aa59-b71acfb1712c; https://github.com/yetiforcecompany/yetiforcecrm/commit/9cdb012ca64ff1f719f8120d5fd162cd5ef1013f
CVE: CVE-2021-40441
Published: 2021-12-15
Description: Windows Media Center Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40441; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40441
CVE: CVE-2021-40452
Published: 2021-12-15
Description: HEVC Video Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40452; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40452
CVE: CVE-2021-40453
Published: 2021-12-15
Description: HEVC Video Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40453; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40453
CVE: CVE-2021-41333
Published: 2021-12-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41333; https://www.zerodayinitiative.com/advisories/ZDI-21-1552/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41333
CVE: CVE-2021-41360
Published: 2021-12-15
Description: HEVC Video Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41360; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41360