deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-41365
Published: 2021-12-15
Description: Microsoft Defender for IoT Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41365; https://www.zerodayinitiative.com/advisories/ZDI-21-1595/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41365
CVE: CVE-2021-42293
Published: 2021-12-15
Description: Microsoft Jet Red Database Engine and Access Connectivity Engine Elevation of Privilege Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42293; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42293
CVE: CVE-2021-42294
Published: 2021-12-15
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42294; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42294
CVE: CVE-2021-42295
Published: 2021-12-15
Description: Visual Basic for Applications Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42295; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42295
CVE: CVE-2021-42309
Published: 2021-12-15
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-732
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42309; https://www.zerodayinitiative.com/advisories/ZDI-22-074/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42309
CVE: CVE-2021-42310
Published: 2021-12-15
Description: Microsoft Defender for IoT Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42310; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42310
CVE: CVE-2021-42311
Published: 2021-12-15
Description: Microsoft Defender for IoT Remote Code Execution Vulnerability
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42311; https://www.zerodayinitiative.com/advisories/ZDI-21-1556/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42311
CVE: CVE-2021-42312
Published: 2021-12-15
Description: Microsoft Defender for IoT Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42312; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42312
CVE: CVE-2021-42313
Published: 2021-12-15
Description: Microsoft Defender for IoT Remote Code Execution Vulnerability
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42313; https://www.zerodayinitiative.com/advisories/ZDI-21-1555/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42313
CVE: CVE-2021-42314
Published: 2021-12-15
Description: Microsoft Defender for IoT Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42314; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42314
CVE: CVE-2021-42315
Published: 2021-12-15
Description: Microsoft Defender for IoT Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42315; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42315
CVE: CVE-2021-42320
Published: 2021-12-15
Description: Microsoft SharePoint Server Spoofing Vulnerability
CVSS Score: 8.0 (HIGH)
CWE: CWE-290
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42320; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42320
CVE: CVE-2021-43207
Published: 2021-12-15
Description: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43207; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43207
CVE: CVE-2021-43214
Published: 2021-12-15
Description: Web Media Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43214; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43214
CVE: CVE-2021-43215
Published: 2021-12-15
Description: iSNS Server Memory Corruption Vulnerability Can Lead to Remote Code Execution
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43215; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43215
CVE: CVE-2021-43216
Published: 2021-12-15
Description: Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43216; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43216
CVE: CVE-2021-43217
Published: 2021-12-15
Description: Windows Encrypting File System (EFS) Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43217; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43217
CVE: CVE-2021-43219
Published: 2021-12-15
Description: DirectX Graphics Kernel File Denial of Service Vulnerability
CVSS Score: 7.4 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43219; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43219
CVE: CVE-2021-43222
Published: 2021-12-15
Description: Microsoft Message Queuing Information Disclosure Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43222; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43222
CVE: CVE-2021-43223
Published: 2021-12-15
Description: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43223; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43223
CVE: CVE-2021-43224
Published: 2021-12-15
Description: Windows Common Log File System Driver Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43224; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43224
CVE: CVE-2021-43225
Published: 2021-12-15
Description: Bot Framework SDK Remote Code Execution Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43225; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43225
CVE: CVE-2021-43226
Published: 2021-12-15
Description: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43226; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43226; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-43226
CVE: CVE-2021-43227
Published: 2021-12-15
Description: Storage Spaces Controller Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43227; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43227
CVE: CVE-2021-43228
Published: 2021-12-15
Description: SymCrypt Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43228; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43228
CVE: CVE-2021-43229
Published: 2021-12-15
Description: Windows NTFS Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43229; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43229
CVE: CVE-2021-43230
Published: 2021-12-15
Description: Windows NTFS Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43230; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43230
CVE: CVE-2021-43231
Published: 2021-12-15
Description: Windows NTFS Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43231; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43231
CVE: CVE-2021-43232
Published: 2021-12-15
Description: Windows Event Tracing Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43232; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43232
CVE: CVE-2021-43233
Published: 2021-12-15
Description: Remote Desktop Client Remote Code Execution Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43233; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43233
CVE: CVE-2021-43234
Published: 2021-12-15
Description: Windows Fax Service Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43234; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43234
CVE: CVE-2021-43235
Published: 2021-12-15
Description: Storage Spaces Controller Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43235; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43235
CVE: CVE-2021-43236
Published: 2021-12-15
Description: Microsoft Message Queuing Information Disclosure Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43236; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43236
CVE: CVE-2021-43237
Published: 2021-12-15
Description: Windows Setup Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43237; https://www.zerodayinitiative.com/advisories/ZDI-22-018/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43237
CVE: CVE-2021-43238
Published: 2021-12-15
Description: Windows Remote Access Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43238; https://www.zerodayinitiative.com/advisories/ZDI-22-019/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43238
CVE: CVE-2021-43239
Published: 2021-12-15
Description: Windows Recovery Environment Agent Elevation of Privilege Vulnerability
CVSS Score: 7.1 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43239; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43239
CVE: CVE-2021-43240
Published: 2021-12-15
Description: NTFS Set Short Name Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43240; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43240
CVE: CVE-2021-43242
Published: 2021-12-15
Description: Microsoft SharePoint Server Spoofing Vulnerability
CVSS Score: 7.6 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43242; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43242
CVE: CVE-2021-43243
Published: 2021-12-15
Description: VP9 Video Extensions Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43243; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43243
CVE: CVE-2021-43244
Published: 2021-12-15
Description: Windows Kernel Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43244; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43244
CVE: CVE-2021-43245
Published: 2021-12-15
Description: Windows Digital TV Tuner Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43245; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43245
CVE: CVE-2021-43246
Published: 2021-12-15
Description: Windows Hyper-V Denial of Service Vulnerability
CVSS Score: 5.6 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43246; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43246
CVE: CVE-2021-43247
Published: 2021-12-15
Description: Windows TCP/IP Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43247; https://www.zerodayinitiative.com/advisories/ZDI-21-1554/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43247
CVE: CVE-2021-43248
Published: 2021-12-15
Description: Windows Digital Media Receiver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43248; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43248
CVE: CVE-2021-43255
Published: 2021-12-15
Description: Microsoft Office Trust Center Spoofing Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43255; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43255
CVE: CVE-2021-43256
Published: 2021-12-15
Description: Microsoft Excel Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43256; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43256
CVE: CVE-2021-43518
Published: 2021-12-15
Description: Teeworlds up to and including 0.7.5 is vulnerable to Buffer Overflow. A map parser does not validate m_Channels value coming from a map file, leading to a buffer overflow. A malicious server may offer a specially crafted map that will overwrite client's stack causing denial of service or code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/teeworlds/teeworlds/issues/2981; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIYZ7EVY6NZBM7FQF6GVUARYO6MKSEAT/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OS2LI2RHQNUKUT3FKWYHRC27PLRWCHMZ/
CVE: CVE-2021-43875
Published: 2021-12-15
Description: Microsoft Office Graphics Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43875; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43875
CVE: CVE-2021-43877
Published: 2021-12-15
Description: ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43877; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43877
CVE: CVE-2021-43880
Published: 2021-12-15
Description: Windows Mobile Device Management Elevation of Privilege Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43880; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43880
CVE: CVE-2021-43882
Published: 2021-12-15
Description: Microsoft Defender for IoT Remote Code Execution Vulnerability
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-295
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43882; https://www.zerodayinitiative.com/advisories/ZDI-21-1553/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43882
CVE: CVE-2021-43883
Published: 2021-12-15
Description: Windows Installer Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43883; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43883
CVE: CVE-2021-43888
Published: 2021-12-15
Description: Microsoft Defender for IoT Information Disclosure Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43888; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43888
CVE: CVE-2021-43889
Published: 2021-12-15
Description: Microsoft Defender for IoT Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43889; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43889
CVE: CVE-2021-43890
Published: 2021-12-15
Description: We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader.
An attacker could craft a malicious attachment to be used in phishing campaigns. The attacker would then have to convince the user to open the specially crafted attachment. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Please see the Security Updates table for the link to the updated app. Alternatively you can download and install the Installer using the links provided in the FAQ section.
Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability.
December 27 2023 Update:
In recent months, Microsoft Threat Intelligence has seen an increase in activity from threat actors leveraging social engineering and phishing techniques to target Windows OS users and utilizing the ms-appinstaller URI scheme.
To address this increase in activity, we have updated the App Installer to disable the ms-appinstaller protocol by default and recommend other potential mitigations.
CVSS Score: 7.1 (HIGH)
References: https://github.com/ChrisTitusTech/winutil/pull/26; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43890; https://thehackernews.com/2023/12/microsoft-disables-msix-app-installer.html
CVE: CVE-2021-43891
Published: 2021-12-15
Description: Visual Studio Code Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43891; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43891
CVE: CVE-2021-43892
Published: 2021-12-15
Description: Microsoft BizTalk ESB Toolkit Spoofing Vulnerability
CVSS Score: 7.4 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43892; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43892
CVE: CVE-2021-43893
Published: 2021-12-15
Description: Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: http://packetstormsecurity.com/files/165560/Microsoft-Windows-EFSRPC-Arbitrary-File-Upload-Privilege-Escalation.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43893; http://packetstormsecurity.com/files/165560/Microsoft-Windows-EFSRPC-Arbitrary-File-Upload-Privilege-Escalation.html
CVE: CVE-2021-43896
Published: 2021-12-15
Description: Microsoft PowerShell Spoofing Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43896; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43896
CVE: CVE-2021-43899
Published: 2021-12-15
Description: Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43899; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43899
CVE: CVE-2021-43905
Published: 2021-12-15
Description: Microsoft Office app Remote Code Execution Vulnerability
CVSS Score: 9.6 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43905; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43905
CVE: CVE-2021-43907
Published: 2021-12-15
Description: Visual Studio Code WSL Extension Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43907; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43907
CVE: CVE-2021-43908
Published: 2021-12-15
Description: Visual Studio Code Spoofing Vulnerability
CVSS Score: 4.3 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43908; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43908
CVE: CVE-2021-44657
Published: 2021-12-15
Description: In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode by default due to backwards compatibility. Stackstorm now sets sandboxed mode for jinja by default.
CVSS Score: 8.8 (HIGH)
References: https://github.com/StackStorm/st2/pull/5359; https://github.com/pallets/jinja/issues/549; https://podalirius.net/en/articles/python-vulnerabilities-code-execution-in-jinja-templates/
CVE: CVE-2021-4117
Published: 2021-12-15
Description: yetiforcecrm is vulnerable to Business Logic Errors
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-840, CWE-20
References: https://github.com/yetiforcecompany/yetiforcecrm/commit/8dccd93442725f245b4b71986bbe6f4f48639239; https://huntr.dev/bounties/0b81e572-bdc9-4caf-aa02-81f3c7ad7c0a; https://github.com/yetiforcecompany/yetiforcecrm/commit/8dccd93442725f245b4b71986bbe6f4f48639239
CVE: CVE-2021-43675
Published: 2021-12-15
Description: Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php. The function exit will terminate the script and print the message to the user. The message will contain albumID which is controlled by the user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LycheeOrg/Lychee; https://github.com/LycheeOrg/Lychee-v3; https://github.com/LycheeOrg/LycheeOrg.github.io/blob/master/docs/releases.md#v3216