deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-39627
Published: 2022-01-14
Description: In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-185126549
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://source.android.com/security/bulletin/2022-01-01; https://source.android.com/security/bulletin/2022-01-01
CVE: CVE-2021-39628
Published: 2022-01-14
Description: In StatusBar.java, there is a possible disclosure of notification content on the lockscreen due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-189575031
CVSS Score: 3.3 (LOW)
CWE: CWE-668
References: https://source.android.com/security/bulletin/2022-01-01; https://source.android.com/security/bulletin/2022-01-01
CVE: CVE-2021-39629
Published: 2022-01-14
Description: In phTmlNfc_Init and phTmlNfc_CleanUp of phTmlNfc.cc, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-197353344
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://source.android.com/security/bulletin/2022-01-01; https://source.android.com/security/bulletin/2022-01-01
CVE: CVE-2021-39630
Published: 2022-01-14
Description: In executeRequest of OverlayManagerService.java, there is a possible way to control fabricated overlays from adb shell due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-202768292
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://source.android.com/security/bulletin/2022-01-01; https://source.android.com/security/bulletin/2022-01-01
CVE: CVE-2021-39632
Published: 2022-01-14
Description: In inotify_cb of events.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-202159709
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2022-01-01; https://source.android.com/security/bulletin/2022-01-01
CVE: CVE-2021-39633
Published: 2022-01-14
Description: In gre_handle_offloads of ip_gre.c, there is a possible page fault due to an invalid memory access. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-150694665References: Upstream kernel
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://source.android.com/security/bulletin/2022-01-01; https://source.android.com/security/bulletin/2022-01-01
CVE: CVE-2021-39634
Published: 2022-01-14
Description: In fs/eventpoll.c, there is a possible use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-204450605References: Upstream kernel
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2022-01-01; https://source.android.com/security/bulletin/2022-01-01
CVE: CVE-2021-39659
Published: 2022-01-14
Description: In sortSimPhoneAccountsForEmergency of CreateConnectionProcessor.java, there is a possible prevention of access to emergency calling due to an unhandled exception. In rare instances, this could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-208267659
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755
References: https://source.android.com/security/bulletin/2022-01-01; https://source.android.com/security/bulletin/2022-01-01
CVE: CVE-2021-39678
Published: 2022-01-14
Description: In <TBD> of <TBD>, there is a possible bypass of Factory Reset Protection due to <TBD>. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-171742549References: N/A
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2022-01-01; https://source.android.com/security/bulletin/pixel/2022-01-01
CVE: CVE-2021-39679
Published: 2022-01-14
Description: In init of vendor_graphicbuffer_meta.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188745089References: N/A
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://source.android.com/security/bulletin/pixel/2022-01-01; https://source.android.com/security/bulletin/pixel/2022-01-01
CVE: CVE-2021-39680
Published: 2022-01-14
Description: In sec_SHA256_Transform of sha256_core.c, there is a possible way to read heap data due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-197965864References: N/A
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-908
References: https://source.android.com/security/bulletin/pixel/2022-01-01; https://source.android.com/security/bulletin/pixel/2022-01-01
CVE: CVE-2021-39681
Published: 2022-01-14
Description: In delete_protocol of main.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-200251074References: N/A
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/pixel/2022-01-01; https://source.android.com/security/bulletin/pixel/2022-01-01
CVE: CVE-2021-39682
Published: 2022-01-14
Description: In mgm_alloc_page of memory_group_manager.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-201677538References: N/A
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2022-01-01; https://source.android.com/security/bulletin/pixel/2022-01-01
CVE: CVE-2021-39683
Published: 2022-01-14
Description: In copy_from_mbox of sss_ice_util.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-202003354References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2022-01-01; https://source.android.com/security/bulletin/pixel/2022-01-01
CVE: CVE-2021-39684
Published: 2022-01-14
Description: In target_init of gs101/abl/target/slider/target.c, there is a possible allocation of RWX memory due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-203250788References: N/A
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2022-01-01; https://source.android.com/security/bulletin/pixel/2022-01-01
CVE: CVE-2021-3965
Published: 2022-01-14
Description: Certain HP DesignJet products may be vulnerable to unauthenticated HTTP requests which allow viewing and downloading of print job previews.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]230-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]230-16
CVE: CVE-2021-42067
Published: 2022-01-14
Description: In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a regular user can use the S/4 Hana dashboard to reveal systems and services which they would not normally be allowed to see. No information alteration or denial of service is possible.
CVSS Score: 4.3 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/3112710; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035; https://launchpad.support.sap.com/#/notes/3112710
CVE: CVE-2021-43752
Published: 2022-01-14
Description: Adobe Illustrator versions 25.4.2 (and earlier) and 26.0.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/illustrator/apsb22-02.html; https://helpx.adobe.com/security/products/illustrator/apsb22-02.html
CVE: CVE-2021-44234
Published: 2022-01-14
Description: SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://launchpad.support.sap.com/#/notes/3106528; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035; https://launchpad.support.sap.com/#/notes/3106528
CVE: CVE-2021-44530
Published: 2022-01-14
Description: An injection vulnerability exists in a third-party library used in UniFi Network Version 6.5.53 and earlier (Log4J CVE-2021-44228) allows a malicious actor to control the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-74
References: https://community.ui.com/releases/Security-Advisory-Bulletin-023-023/808a1db0-5f8e-4b91-9097-9822f3f90207; https://community.ui.com/releases/Security-Advisory-Bulletin-023-023/808a1db0-5f8e-4b91-9097-9822f3f90207
CVE: CVE-2021-44700
Published: 2022-01-14
Description: Adobe Illustrator versions 25.4.2 (and earlier) and 26.0.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/illustrator/apsb22-02.html; https://helpx.adobe.com/security/products/illustrator/apsb22-02.html
CVE: CVE-2021-44701
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-44702
Published: 2022-01-14
Description: Acrobat Reader DC ActiveX Control versions 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated attacker could leverage this vulnerability to obtain NTLMv2 credentials. Exploitation of this issue requires user interaction in that a victim must visit an attacker controlled web page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-44703
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a stack buffer overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-44704
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-44705
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://www.zerodayinitiative.com/advisories/ZDI-22-540/; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-44706
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-44707
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://www.zerodayinitiative.com/advisories/ZDI-22-539/; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-44708
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a heap overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-44709
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a heap overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-44710
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-44711
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-44712
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to application denial-of-service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-44713
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in application denial of service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-44714
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a Violation of Secure Design Principles that could lead to a Security feature bypass. Acrobat Reader DC displays a warning message when a user clicks on a PDF file, which could be used by an attacker to mislead the user. In affected versions, this warning message does not include custom protocols when used by the sender. User interaction is required to abuse this vulnerability as they would need to click 'allow' on the warning message of a malicious file.
CVSS Score: 2.5 (LOW)
CWE: CWE-657
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-44715
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-44739
Published: 2022-01-14
Description: Acrobat Reader DC ActiveX Control versions 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated attacker could leverage this vulnerability to obtain NTLMv2 credentials. Exploitation of this issue requires user interaction in that a victim must open a maliciously crafted Microsoft Office file, or visit an attacker controlled web page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-44740
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-476, CWE-476
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-44741
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-476, CWE-476
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-44742
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html