deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-20645
Published: 2021-08-19
Description: Cross Site Scripting (XSS) vulnerability exists in EyouCMS1.3.6 in the basic_information area.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/eyoucms/eyoucms/issues/6; https://github.com/eyoucms/eyoucms/issues/6
CVE: CVE-2021-28490
Published: 2021-08-19
Description: In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/reidmefirst/vuln-disclosure/blob/main/2021-01.txt; https://owasp.org/www-project-csrfguard/; https://github.com/reidmefirst/vuln-disclosure/blob/main/2021-01.txt
CVE: CVE-2021-37597
Published: 2021-08-19
Description: WP Cerber before 8.9.3 allows MFA bypass via wordpress_logged_in_[hash] manipulation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/fireeye/Vulnerability-Disclosures; https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0023/FEYE-2021-0023.md; https://github.com/fireeye/Vulnerability-Disclosures
CVE: CVE-2021-37598
Published: 2021-08-19
Description: WP Cerber before 8.9.3 allows bypass of /wp-json access control via a trailing ? character.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/fireeye/Vulnerability-Disclosures; https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0024/FEYE-2021-0024.md; https://github.com/fireeye/Vulnerability-Disclosures
CVE: CVE-2020-18897
Published: 2021-08-19
Description: An use-after-free vulnerability in the libpff_item_tree_create_node function of libyal Libpff before 20180623 allows attackers to cause a denial of service (DOS) or execute arbitrary code via a crafted pff file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://github.com/libyal/libpff/issues/61; https://github.com/libyal/libpff/issues/62; https://github.com/libyal/libpff/issues/61
CVE: CVE-2020-18898
Published: 2021-08-19
Description: A stack exhaustion issue in the printIFDStructure function of Exiv2 0.27 allows remote attackers to cause a denial of service (DOS) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-674
References: https://cwe.mitre.org/data/definitions/674.html; https://github.com/Exiv2/exiv2/issues/741; https://cwe.mitre.org/data/definitions/674.html
CVE: CVE-2020-18899
Published: 2021-08-19
Description: An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of service (DOS) via a crafted input.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://cwe.mitre.org/data/definitions/789.html; https://github.com/Exiv2/exiv2/issues/742; https://security.gentoo.org/glsa/202312-06
CVE: CVE-2020-18900
Published: 2021-08-19
Description: A heap-based buffer overflow in the libexe_io_handle_read_coff_optional_header function of libyal libexe before 20181128. NOTE: the vendor has disputed this as described in libyal/libexe issue 1 on GitHub
CVSS Score: 3.3 (LOW)
CWE: CWE-787, CWE-787
References: https://github.com/libyal/libexe/issues/1; https://github.com/libyal/libexe/issues/1
CVE: CVE-2020-18877
Published: 2021-08-20
Description: SQL Injection in Wuzhi CMS v4.1.0 allows remote attackers to obtain sensitive information via the 'flag' parameter in the component '/coreframe/app/order/admin/index.php'.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/wuzhicms/wuzhicms/issues/175; https://github.com/wuzhicms/wuzhicms/issues/175
CVE: CVE-2020-18878
Published: 2021-08-20
Description: Directory Traversal in Skycaiji v1.3 allows remote attackers to obtain sensitive information via the component 'index.php?m=admin&c=Tool&a=log&file=D%3A%5CphpStudy%5CWWW%5Cindex.php'.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/zorlan/skycaiji/issues/13; https://github.com/zorlan/skycaiji/issues/13
CVE: CVE-2020-18879
Published: 2021-08-20
Description: Unrestricted File Upload in Bludit v3.8.1 allows remote attackers to execute arbitrary code by uploading malicious files via the component 'bl-kereln/ajax/upload-logo.php'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/bludit/bludit/issues/1011; https://github.com/bludit/bludit/issues/1011
CVE: CVE-2020-18885
Published: 2021-08-20
Description: Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/web_config.php'.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://cwe.mitre.org/data/definitions/77.html; https://github.com/gaozhifeng/PHPMyWind/issues/4; https://cwe.mitre.org/data/definitions/77.html
CVE: CVE-2020-18886
Published: 2021-08-20
Description: Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the component 'admin/upload_file_do.php'.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/gaozhifeng/PHPMyWind/issues/5; https://github.com/gaozhifeng/PHPMyWind/issues/5
CVE: CVE-2020-36474
Published: 2021-08-20
Description: SafeCurl before 0.9.2 has a DNS rebinding vulnerability.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/vanilla/safecurl/pull/2; https://github.com/vanilla/safecurl/releases/tag/v0.9.2; https://github.com/vanilla/safecurl/pull/2
CVE: CVE-2021-34207
Published: 2021-08-20
Description: Cross-site scripting in ddns.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Domain Name" field, "Server Address" field, "User Name/Email", or "Password/Key" field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R; https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R
CVE: CVE-2021-34215
Published: 2021-08-20
Description: Cross-site scripting in tcpipwan.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Service Name" field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R; https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R
CVE: CVE-2021-34218
Published: 2021-08-20
Description: Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20[PII_REDACTED] allows attacker to access /add/ , /img/, /js/, and /mobile directories via GET Parameter.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R%20Directory%20Indexing; https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R%20Directory%20Indexing
CVE: CVE-2021-34220
Published: 2021-08-20
Description: Cross-site scripting in tr069config.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "User Name" field or "Password" field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R; https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R
CVE: CVE-2021-34223
Published: 2021-08-20
Description: Cross-site scripting in urlfilter.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "URL Address" field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R; https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R
CVE: CVE-2021-34228
Published: 2021-08-20
Description: Cross-site scripting in parent_control.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Description" field and "Service Name" field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R; https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R
CVE: CVE-2021-34433
Published: 2021-08-20
Description: In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side's signature on the client side, if that signature is not included in the server's ServerKeyExchange.
CVSS Score: 7.5 (HIGH)
CWE: CWE-322, CWE-347
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=575281; https://bugs.eclipse.org/bugs/show_bug.cgi?id=575281
CVE: CVE-2021-21823
Published: 2021-08-20
Description: An information disclosure vulnerability exists in the Friend finder functionality of GmbH Komoot version 10.26.9 up to 11.1.11. A specially crafted series of network requests can lead to the disclosure of sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-359, CWE-200
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1288; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1288
CVE: CVE-2021-22238
Published: 2021-08-20
Description: An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS by using the design feature in issues.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22238.json; https://gitlab.com/gitlab-org/gitlab/-/issues/332420; https://hackerone.com/reports/1212067
CVE: CVE-2021-22246
Published: 2021-08-20
Description: A vulnerability was discovered in GitLab versions before 14.0.2, 13.12.6, 13.11.6. GitLab Webhook feature could be abused to perform denial of service attacks.
CVSS Score: 7.7 (HIGH)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22246.json; https://gitlab.com/gitlab-org/gitlab/-/issues/280633; https://hackerone.com/reports/1029269
CVE: CVE-2021-22254
Published: 2021-08-20
Description: Under very specific conditions a user could be impersonated using Gitlab shell. This vulnerability affects GitLab CE/EE 13.1 and later through 14.1.2, 14.0.7 and 13.12.9.
CVSS Score: 3.1 (LOW)
CWE: CWE-116
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22254.json; https://gitlab.com/gitlab-org/gitlab/-/issues/300265; https://hackerone.com/reports/1087806
CVE: CVE-2021-22255
Published: 2021-08-20
Description: SSRF in URL file upload in Baserow <1.1.0 allows remote authenticated users to retrieve files from the internal server network exposed over HTTP by inserting an internal address.
CVSS Score: 7.7 (HIGH)
CWE: CWE-918
References: https://baserow.io/blog/march-2021-release-of-baserow; https://gitlab.com/bramw/baserow/-/issues/370; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22255.json
CVE: CVE-2021-35529
Published: 2021-08-20
Description: Insufficiently Protected Credentials vulnerability in client environment of Hitachi ABB Power Grids Retail Operations and Counterparty Settlement Billing (CSB) allows an attacker or unauthorized user to access database credentials, shut down the product and access or alter. This issue affects: Hitachi ABB Power Grids Retail Operations version 5.7.2 and prior versions. Hitachi ABB Power Grids Counterparty Settlement Billing (CSB) version 5.7.2 and prior versions.
CVSS Score: 7.7 (HIGH)
CWE: CWE-522, CWE-522
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK107992A5821&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK107992A5933&LanguageCode=en&DocumentPartId=&Action=Launch; https://us-cert.cisa.gov/ics/advisories/icsa-21-236-02
CVE: CVE-2021-36748
Published: 2021-08-20
Description: A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote attacker to extract data from the database via the sb_category parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://alysum5.promokit.eu/promokit/documentation/blog/; https://blog.sorcery.ie; https://blog.sorcery.ie/posts/ph_simpleblog_sqli/
CVE: CVE-2020-25351
Published: 2021-08-20
Description: An information disclosure vulnerability in rConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote authenticated attackers to read files on the system via a crafted request sent to to the /lib/crud/configcompare.crud.php script.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-552
References: https://stark0de.com/2020/08/27/pwning-rconfig-part-one.html; https://stark0de.com/2020/08/27/pwning-rconfig-part-one.html
CVE: CVE-2020-25352
Published: 2021-08-20
Description: A stored cross-site scripting (XSS) vulnerability in the /devices.php function inrConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote attackers to perform arbitrary Javascript execution through entering a crafted payload into the 'Model' field then saving.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://stark0de.com/2020/08/27/pwning-rconfig-part-one.html; https://stark0de.com/2020/08/27/pwning-rconfig-part-one.html
CVE: CVE-2020-25353
Published: 2021-08-20
Description: A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability allowed remote authenticated attackers to open a connection to the machine via the deviceIpAddr and connPort parameters.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://stark0de.com/2020/08/27/pwning-rconfig-part-one.html; https://stark0de.com/2020/08/27/pwning-rconfig-part-one.html
CVE: CVE-2020-25359
Published: 2021-08-20
Description: An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability gave attackers the ability to send a crafted request to /lib/ajaxHandlers/ajaxDeleteAllLoggingFiles.php by specifying a path in the path parameter and an extension in the ext parameter and delete all the files with that extension in that path.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: https://cwe.mitre.org/data/definitions/36.html; https://stark0de.com/2020/08/27/pwning-rconfig-part-one.html; https://cwe.mitre.org/data/definitions/36.html
CVE: CVE-2020-27461
Published: 2021-08-20
Description: A remote code execution vulnerability in SEOPanel 4.6.0 has been fixed for 4.7.0. This vulnerability allowed for remote code execution through an authenticated file upload via the Settings Panel>Import website function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://sourceforge.net/projects/seopanel/files/seopanel.v.4.6.0.zip/download; https://www.exploit-db.com/exploits/48862; https://www.seopanel.org/
CVE: CVE-2020-27464
Published: 2021-08-20
Description: An insecure update feature in the /updater.php component of rConfig 3.9.6 and below allows attackers to execute arbitrary code via a crafted ZIP file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://ssd-disclosure.com/ssd-advisory-rconfig-unauthenticated-rce/; https://ssd-disclosure.com/ssd-advisory-rconfig-unauthenticated-rce/
CVE: CVE-2020-27466
Published: 2021-08-20
Description: An arbitrary file write vulnerability in lib/AjaxHandlers/ajaxEditTemplate.php of rConfig 3.9.6 allows attackers to execute arbitrary code via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://ssd-disclosure.com/ssd-advisory-rconfig-unauthenticated-rce/; https://ssd-disclosure.com/ssd-advisory-rconfig-unauthenticated-rce/
CVE: CVE-2021-28589
Published: 2021-08-20
Description: Adobe Media Encoder version 15.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/media-encoder/apsb21-43.html; https://helpx.adobe.com/security/products/media-encoder/apsb21-43.html
CVE: CVE-2021-28590
Published: 2021-08-20
Description: Adobe Media Encoder version 15.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/media-encoder/apsb21-43.html; https://helpx.adobe.com/security/products/media-encoder/apsb21-43.html
CVE: CVE-2021-28591
Published: 2021-08-20
Description: Adobe Illustrator version 25.2.3 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb21-42.html; https://helpx.adobe.com/security/products/illustrator/apsb21-42.html
CVE: CVE-2021-28592
Published: 2021-08-20
Description: Adobe Illustrator version 25.2.3 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb21-42.html; https://helpx.adobe.com/security/products/illustrator/apsb21-42.html
CVE: CVE-2021-28593
Published: 2021-08-20
Description: Adobe Illustrator version 25.2.3 (and earlier) is affected by a Use After Free vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose potential sensitive information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/illustrator/apsb21-42.html; https://helpx.adobe.com/security/products/illustrator/apsb21-42.html
CVE: CVE-2021-28595
Published: 2021-08-20
Description: Adobe Dimension version 3.4 (and earlier) is affected by an Uncontrolled Search Path Element element. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://helpx.adobe.com/security/products/dimension/apsb21-40.html; https://helpx.adobe.com/security/products/dimension/apsb21-40.html
CVE: CVE-2021-28624
Published: 2021-08-20
Description: Adobe Bridge version 11.0.2 (and earlier) are affected by a Heap-based Buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/bridge/apsb21-53.html; https://helpx.adobe.com/security/products/bridge/apsb21-53.html
CVE: CVE-2021-28634
Published: 2021-08-20
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by an Improper Neutralization of Special Elements used in an OS Command. An authenticated attacker could leverage this vulnerability to achieve arbitrary code execution on the host machine in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 8.2 (HIGH)
CWE: CWE-78
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE: CVE-2021-28635
Published: 2021-08-20
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by a use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE: CVE-2021-28636
Published: 2021-08-20
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by an Uncontrolled Search Path Element vulnerability. An attacker with access to the victim's C:/ folder could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427, CWE-427
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE: CVE-2021-28637
Published: 2021-08-20
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by an out-of-bounds read vulnerability. An unauthenticated attacker could leverage this vulnerability achieve arbitrary read / write system information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE: CVE-2021-28638
Published: 2021-08-20
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by a Heap-based Buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE: CVE-2021-28639
Published: 2021-08-20
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by an Use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE: CVE-2021-28640
Published: 2021-08-20
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by an Use-after-free vulnerability. An authenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.3 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html