deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-37196
Published: 2022-01-11
Description: A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.3 (All versions >= V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS unpacks specially crafted archive files to relative paths. This vulnerability could allow an attacker to store files in any folder accessible by the COMOS Web webservice.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf
CVE: CVE-2021-37197
Published: 2022-01-11
Description: A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS is vulnerable to SQL injections. This could allow an attacker to execute arbitrary SQL statements.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf
CVE: CVE-2021-37198
Published: 2022-01-11
Description: A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS uses a flawed implementation of CSRF prevention. An attacker could exploit this vulnerability to perform cross-site request forgery attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352, CWE-352
References: https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf
CVE: CVE-2021-41769
Published: 2022-01-11
Description: A vulnerability has been identified in SIPROTEC 5 6MD85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MD86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MD89 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MU85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7KE85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SA82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SA86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SA87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SD82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SD86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SD87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SJ81 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SJ82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SJ85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SJ86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SK82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SK85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SL82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SL86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SL87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SS85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7ST85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SX85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UM85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UT82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7UT85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UT86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UT87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7VE85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7VK87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 Compact 7SX800 devices (CPU variant CP050) (All versions < V8.83). An improper input validation vulnerability in the web server could allow an unauthenticated user to access device information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://cert-portal.siemens.com/productcert/pdf/ssa-439673.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-439673.pdf
CVE: CVE-2021-45033
Published: 2022-01-11
Description: A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < V16.20), CP-8021 MASTER MODULE (All versions < V16.20), CP-8022 MASTER MODULE WITH GPRS (All versions < V16.20). An undocumented debug port uses hard-coded default credentials. If this port is enabled by a privileged user, an attacker aware of the credentials could access an administrative debug shell on the affected device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798, CWE-798
References: https://cert-portal.siemens.com/productcert/pdf/ssa-324998.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-324998.pdf
CVE: CVE-2021-45034
Published: 2022-01-11
Description: A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < V16.20), CP-8021 MASTER MODULE (All versions < V16.20), CP-8022 MASTER MODULE WITH GPRS (All versions < V16.20). The web server of the affected system allows access to logfiles and diagnostic data generated by a privileged user. An unauthenticated attacker could access the files by knowing the corresponding download links.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284, CWE-532
References: http://packetstormsecurity.com/files/166743/Siemens-A8000-CP-8050-CP-8031-SICAM-WEB-Missing-File-Download-Missing-Authentication.html; http://seclists.org/fulldisclosure/2022/Apr/20; https://cert-portal.siemens.com/productcert/pdf/ssa-324998.pdf
CVE: CVE-2021-45460
Published: 2022-01-11
Description: A vulnerability has been identified in SICAM PQ Analyzer (All versions < V3.18). A service is started by an unquoted registry entry. As there are spaces in this path, attackers with write privilege to those directories might be able to plant executables that will run in place of the legitimate process. Attackers might achieve persistence on the system ("backdoors") or cause a denial of service.
CVSS Score: 8.1 (HIGH)
CWE: CWE-428, CWE-428
References: https://cert-portal.siemens.com/productcert/pdf/ssa-173318.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-173318.pdf
CVE: CVE-2021-44647
Published: 2022-01-11
Description: Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-843
References: http://lua-users.org/lists/lua-l/2021-11/msg00195.html; http://lua-users.org/lists/lua-l/2021-11/msg00204.html; https://access.redhat.com/security/cve/cve-2021-44647
CVE: CVE-2022-21669
Published: 2022-01-11
Description: PuddingBot is a group management bot. In version 0.0.6-b933652 and prior, the bot token is publicly exposed in main.py, making it accessible to malicious actors. The bot token has been revoked and new version is already running on the server. As of time of publication, the maintainers are planning to update code to reflect this change at a later date.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://github.com/PuddingBot/pudding-bot/commit/a5b15fb0a5be5fdbacba8ff7b2c8759d5e3ba20f; https://github.com/PuddingBot/pudding-bot/security/advisories/GHSA-cxgr-xpmj-9qjm; https://github.com/PuddingBot/pudding-bot/commit/a5b15fb0a5be5fdbacba8ff7b2c8759d5e3ba20f
CVE: CVE-2022-21671
Published: 2022-01-11
Description: @replit/crosis is a JavaScript client that speaks Replit's container protocol. A vulnerability that involves exposure of sensitive information exists in versions prior to 7.3.1. When using this library as a way to programmatically communicate with Replit in a standalone fashion, if there are multiple failed attempts to contact Replit through a WebSocket, the library will attempt to communicate using a fallback poll-based proxy. The URL of the proxy has changed, so any communication done to the previous URL could potentially reach a server that is outside of Replit's control and the token used to connect to the Repl could be obtained by an attacker, leading to full compromise of that Repl (not of the account). This was patched in version 7.3.1 by updating the address of the fallback WebSocket polling proxy to the new one. As a workaround, a user may specify the new address for the polling host (`gp-v2.replit.com`) in the `ConnectArgs`. More information about this workaround is available in the GitHub Security Advisory.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: https://github.com/replit/crosis/commit/e44b6a8f5fa28cb2872e3c19bb8a205bb5bfc281; https://github.com/replit/crosis/security/advisories/GHSA-7w54-gp8x-f33m; https://github.com/replit/crosis/commit/e44b6a8f5fa28cb2872e3c19bb8a205bb5bfc281
CVE: CVE-2020-28102
Published: 2022-01-11
Description: cscms v4.1 allows for SQL injection via the "js_del" function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/9; https://github.com/chshcms/cscms/issues/9
CVE: CVE-2020-28103
Published: 2022-01-11
Description: cscms v4.1 allows for SQL injection via the "page_del" function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/8; https://github.com/chshcms/cscms/issues/8
CVE: CVE-2021-43566
Published: 2022-01-11
Description: All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack to succeed.
CVSS Score: 2.5 (LOW)
CWE: CWE-362
References: https://bugzilla.samba.org/show_bug.cgi?id=13979; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.samba.org/samba/security/CVE-2021-43566.html
CVE: CVE-2022-0170
Published: 2022-01-11
Description: peertube is vulnerable to Improper Access Control
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/chocobozzz/peertube/commit/84c8d9866890f479faf0168c29be5eb7816ccc8e; https://huntr.dev/bounties/f2a003fc-b911-43b6-81ec-f856cdfeaefc; https://github.com/chocobozzz/peertube/commit/84c8d9866890f479faf0168c29be5eb7816ccc8e
CVE: CVE-2021-29701
Published: 2022-01-11
Description: IBM Engineering Workflow Management 7.0, 7.0.1, and 7.0.2 as well as IBM Rational Team Concert 6.0.6 and 6.0.6.1 could allow an authneticated attacker to obtain sensitive information from build definitions that could aid in further attacks against the system. IBM X-Force ID: 200657.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/200657; https://www.ibm.com/support/pages/node/6539546; https://exchange.xforce.ibmcloud.com/vulnerabilities/200657
CVE: CVE-2021-38991
Published: 2022-01-11
Description: IBM AIX 7.0, 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the lscore command which could lead to code execution. IBM X-Force ID: 212953.
CVSS Score: 7.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/212953; https://www.ibm.com/support/pages/node/6538952; https://exchange.xforce.ibmcloud.com/vulnerabilities/212953
CVE: CVE-2022-0129
Published: 2022-01-11
Description: Uncontrolled search path element vulnerability in McAfee TechCheck prior to 4.0.0.2 allows a local administrator to load their own Dynamic Link Library (DLL) gaining elevation of privileges to system user. This was achieved through placing the malicious DLL in the same directory that the process was run from.
CVSS Score: 7.4 (HIGH)
CWE: CWE-427
References: https://service.mcafee.com/?articleId=TS103243; https://service.mcafee.com/?articleId=TS103243
CVE: CVE-2022-0173
Published: 2022-01-11
Description: radare2 is vulnerable to Out-of-bounds Read
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/radareorg/radare2/commit/37897226a1a31f982bfefdc4aeefc2e50355c73c; https://huntr.dev/bounties/727d8600-88bc-4dde-8dea-ee3d192600e5; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IQIRJ72UALGMSWH6MYPVJQQLXFGZ23RS/
CVE: CVE-2021-1573
Published: 2022-01-11
Description: A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper input validation when parsing HTTPS requests. An attacker could exploit this vulnerability by sending a malicious HTTPS request to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-121, CWE-787, CWE-787
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asafdt-webvpn-dos-KSqJAKPA; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asafdt-webvpn-dos-KSqJAKPA
CVE: CVE-2021-34704
Published: 2022-01-11
Description: A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper input validation when parsing HTTPS requests. An attacker could exploit this vulnerability by sending a malicious HTTPS request to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-121, CWE-787, CWE-787
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asafdt-webvpn-dos-KSqJAKPA; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asafdt-webvpn-dos-KSqJAKPA
CVE: CVE-2021-43052
Published: 2022-01-11
Description: The Realm Server component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains an easily exploitable vulnerability that allows authentication bypass due to a hard coded secret used in the default realm server of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.7.2 and below, TIBCO FTL - Developer Edition: versions 6.7.2 and below, and TIBCO FTL - Enterprise Edition: versions 6.7.2 and below.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-798
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-ftl-2021-43052; https://www.tibco.com/services/support/advisories
CVE: CVE-2021-43053
Published: 2022-01-11
Description: The Realm Server component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a difficult to exploit vulnerability that allows an unauthenticated attacker with network access to obtain the cluster secret of another application connected to the realm server. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.7.2 and below, TIBCO FTL - Developer Edition: versions 6.7.2 and below, and TIBCO FTL - Enterprise Edition: versions 6.7.2 and below.
CVSS Score: 8.5 (HIGH)
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-ftl-2021-43053; https://www.tibco.com/services/support/advisories
CVE: CVE-2021-43054
Published: 2022-01-11
Description: The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to generate API tokens that can access any other channel with arbitrary permissions. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below.
CVSS Score: 7.1 (HIGH)
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43054; https://www.tibco.com/services/support/advisories
CVE: CVE-2021-43055
Published: 2022-01-11
Description: The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows clients to inherit the permissions of the client that initially connected on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below.
CVSS Score: 5.9 (MEDIUM)
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43055; https://www.tibco.com/services/support/advisories
CVE: CVE-2021-43971
Published: 2022-01-11
Description: A SQL injection vulnerability in /mobile/SelectUsers.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to execute arbitrary SQL commands via the filterText parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.md; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.md; https://www.sysaid.com/it-service-management-software/incident-management
CVE: CVE-2021-43972
Published: 2022-01-11
Description: An unrestricted file copy vulnerability in /UserSelfServiceSettings.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to copy arbitrary files on the server filesystem to the web root (with an arbitrary filename) via the tempFile and fileName parameters in the HTTP POST body.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.md; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.md; https://www.sysaid.com/it-service-management-software/incident-management
CVE: CVE-2021-43973
Published: 2022-01-11
Description: An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST body. A successful request returns the absolute, server-side filesystem path of the uploaded file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.md; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.md; https://www.sysaid.com/it-service-management-software/incident-management
CVE: CVE-2021-43974
Published: 2022-01-11
Description: An issue was discovered in SysAid ITIL 20.4.74 b10. The /enduserreg endpoint is used to register end users anonymously, but does not respect the server-side setting that determines if anonymous users are allowed to register new accounts. Configuring the server-side setting to disable anonymous user registration only hides the client-side registration form. An attacker can still post registration data to create new accounts without prior authentication.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.md; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.md; https://www.sysaid.com/it-service-management-software/incident-management
CVE: CVE-2022-21833
Published: 2022-01-11
Description: Virtual Machine IDE Drive Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21833; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21833
CVE: CVE-2022-21834
Published: 2022-01-11
Description: Windows User-mode Driver Framework Reflector Driver Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21834; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21834
CVE: CVE-2022-21835
Published: 2022-01-11
Description: Microsoft Cryptographic Services Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21835; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21835
CVE: CVE-2022-21836
Published: 2022-01-11
Description: Windows Certificate Spoofing Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-295
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21836; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21836
CVE: CVE-2022-21837
Published: 2022-01-11
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 8.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21837; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21837
CVE: CVE-2022-21838
Published: 2022-01-11
Description: Windows Cleanup Manager Elevation of Privilege Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21838; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21838; https://www.zerodayinitiative.com/advisories/ZDI-22-049/
CVE: CVE-2022-21839
Published: 2022-01-11
Description: Windows Event Tracing Discretionary Access Control List Denial of Service Vulnerability
CVSS Score: 6.1 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21839; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21839
CVE: CVE-2022-21840
Published: 2022-01-11
Description: Microsoft Office Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21840; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21840
CVE: CVE-2022-21841
Published: 2022-01-11
Description: Microsoft Excel Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21841; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21841
CVE: CVE-2022-21842
Published: 2022-01-11
Description: Microsoft Word Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21842; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21842
CVE: CVE-2022-21843
Published: 2022-01-11
Description: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21843; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21843
CVE: CVE-2022-21846
Published: 2022-01-11
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 9.0 (CRITICAL)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21846; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21846