deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-36307
Published: 2021-11-20
Description: Networking OS10, versions prior to October 2021 with RESTCONF API enabled, contains a privilege escalation vulnerability. A malicious low privileged user with specific access to the API could potentially exploit this vulnerability to gain admin privileges on the affected system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000193076; https://www.dell.com/support/kbdoc/en-us/000193076
CVE: CVE-2021-36308
Published: 2021-11-20
Description: Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an authentication bypass vulnerability. A remote unauthenticated attacker could exploit this vulnerability to gain access and perform actions on the affected system.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-288, CWE-287
References: https://www.dell.com/support/kbdoc/en-us/000193076; https://www.dell.com/support/kbdoc/en-us/000193076
CVE: CVE-2021-36310
Published: 2021-11-20
Description: Dell Networking OS10, versions 10.4.3.x, 10.5.0.x, 10.5.1.x & 10.5.2.x, contain an uncontrolled resource consumption flaw in its API service. A high-privileged API user may potentially exploit this vulnerability, leading to a denial of service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-693, CWE-400
References: https://www.dell.com/support/kbdoc/en-us/000193076; https://www.dell.com/support/kbdoc/en-us/000193076
CVE: CVE-2021-36319
Published: 2021-11-20
Description: Dell Networking OS10 versions 10.4.3.x, 10.5.0.x and 10.5.1.x contain an information exposure vulnerability. A low privileged authenticated malicious user can gain access to SNMP authentication failure messages.
CVSS Score: 3.3 (LOW)
CWE: CWE-665, CWE-668
References: https://www.dell.com/support/kbdoc/en-us/000193076; https://www.dell.com/support/kbdoc/en-us/000193076
CVE: CVE-2021-36320
Published: 2021-11-20
Description: Dell Networking X-Series firmware versions prior to 3.0.1.8 contain an authentication bypass vulnerability. A remote unauthenticated attacker may potentially hijack a session and access the webserver by forging the session ID.
CVSS Score: 7.5 (HIGH)
CWE: CWE-331
References: https://www.dell.com/support/kbdoc/en-us/000193230/dsa-2021-191-dell-networking-x-series-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000193230/dsa-2021-191-dell-networking-x-series-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2021-36321
Published: 2021-11-20
Description: Dell Networking X-Series firmware versions prior to 3.0.1.8 contain an improper input validation vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by sending specially crafted data to trigger a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000193230/dsa-2021-191-dell-networking-x-series-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000193230/dsa-2021-191-dell-networking-x-series-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2021-36322
Published: 2021-11-20
Description: Dell Networking X-Series firmware versions prior to 3.0.1.8 contain a host header injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by injecting arbitrary host header values to poison the web-cache or trigger redirections.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20, CWE-74
References: https://www.dell.com/support/kbdoc/en-us/000193230/dsa-2021-191-dell-networking-x-series-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000193230/dsa-2021-191-dell-networking-x-series-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2021-36340
Published: 2021-11-20
Description: Dell EMC SCG 5.00.00.10 and earlier, contain a sensitive information disclosure vulnerability. A local malicious user may exploit this vulnerability to read sensitive information and use it.
CVSS Score: 7.8 (HIGH)
CWE: CWE-532
References: https://www.dell.com/support/kbdoc/en-us/000193601/dsa-2021-245-dell-emc-secure-connect-gateway-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000193601/dsa-2021-245-dell-emc-secure-connect-gateway-security-update-for-multiple-vulnerabilities
CVE: CVE-2021-1088
Published: 2021-11-20
Description: NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to utilize debug mechanisms with insufficient access control, which may lead to information disclosure.
CVSS Score: 4.1 (MEDIUM)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5263; https://nvidia.custhelp.com/app/answers/detail/a_id/5263
CVE: CVE-2021-1105
Published: 2021-11-20
Description: NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to access debug registers during runtime, which may lead to information disclosure.
CVSS Score: 4.1 (MEDIUM)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5263; https://nvidia.custhelp.com/app/answers/detail/a_id/5263
CVE: CVE-2021-1125
Published: 2021-11-20
Description: NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to corrupt program data.
CVSS Score: 4.1 (MEDIUM)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5263; https://nvidia.custhelp.com/app/answers/detail/a_id/5263
CVE: CVE-2021-23201
Published: 2021-11-20
Description: NVIDIA GPU and Tegra hardware contain a vulnerability in an internal microcontroller, which may allow a user with elevated privileges to generate valid microcode by identifying, exploiting, and loading vulnerable microcode. Such an attack could lead to information disclosure, data corruption, or denial of service of the device. The scope may extend to other components.
CVSS Score: 7.5 (HIGH)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5263; https://nvidia.custhelp.com/app/answers/detail/a_id/5263
CVE: CVE-2021-23217
Published: 2021-11-20
Description: NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to instantiate a DMA write operation only within a specific time window timed to corrupt code execution, which may impact confidentiality, integrity, or availability. The scope impact may extend to other components.
CVSS Score: 7.5 (HIGH)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5263; https://nvidia.custhelp.com/app/answers/detail/a_id/5263
CVE: CVE-2021-23219
Published: 2021-11-20
Description: NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to access protected information by identifying, exploiting, and loading vulnerable microcode. Such an attack may lead to information disclosure.
CVSS Score: 4.1 (MEDIUM)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5263; https://nvidia.custhelp.com/app/answers/detail/a_id/5263
CVE: CVE-2021-34399
Published: 2021-11-20
Description: NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to gain access to information from unscrubbed registers, which may lead to information disclosure.
CVSS Score: 4.1 (MEDIUM)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5263; https://nvidia.custhelp.com/app/answers/detail/a_id/5263
CVE: CVE-2021-34400
Published: 2021-11-20
Description: NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to gain access to information from unscrubbed memory, which may lead to information disclosure.
CVSS Score: 4.1 (MEDIUM)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5263; https://nvidia.custhelp.com/app/answers/detail/a_id/5263
CVE: CVE-2021-28710
Published: 2021-11-21
Description: certain VT-d IOMMUs may not work in shared page table mode For efficiency reasons, address translation control structures (page tables) may (and, on suitable hardware, by default will) be shared between CPUs, for second-level translation (EPT), and IOMMUs. These page tables are presently set up to always be 4 levels deep. However, an IOMMU may require the use of just 3 page table levels. In such a configuration the lop level table needs to be stripped before inserting the root table's address into the hardware pagetable base register. When sharing page tables, Xen erroneously skipped this stripping. Consequently, the guest is able to write to leaf page table entries.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7ZGWVVRI4XY2XSTBI3XEMWBXPDVX6OT/; https://security.gentoo.org/glsa/202208-23; https://xenbits.xenproject.org/xsa/advisory-390.txt
CVE: CVE-2021-44079
Published: 2021-11-22
Description: In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially resulting in remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/wazuh/wazuh/issues/10858; https://github.com/wazuh/wazuh/issues/10858#issuecomment-991118254; https://github.com/wazuh/wazuh/pull/10809
CVE: CVE-2021-33488
Published: 2021-11-22
Description: chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/165028/OX-App-Suite-Ox-Documents-7.10.x-XSS-Code-Injection-Traversal.html; http://seclists.org/fulldisclosure/2021/Nov/42; https://open-xchange.com
CVE: CVE-2021-33489
Published: 2021-11-22
Description: OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/165028/OX-App-Suite-Ox-Documents-7.10.x-XSS-Code-Injection-Traversal.html; http://seclists.org/fulldisclosure/2021/Nov/42; https://open-xchange.com
CVE: CVE-2021-33490
Published: 2021-11-22
Description: OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/165028/OX-App-Suite-Ox-Documents-7.10.x-XSS-Code-Injection-Traversal.html; https://open-xchange.com; https://seclists.org/fulldisclosure/2021/Nov/42
CVE: CVE-2021-33491
Published: 2021-11-22
Description: OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses in conjunction with auto-configuration DNS records.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/165028/OX-App-Suite-Ox-Documents-7.10.x-XSS-Code-Injection-Traversal.html; https://open-xchange.com; https://seclists.org/fulldisclosure/2021/Nov/42
CVE: CVE-2021-33492
Published: 2021-11-22
Description: OX App Suite 7.10.5 allows XSS via an OX Chat room name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/165028/OX-App-Suite-Ox-Documents-7.10.x-XSS-Code-Injection-Traversal.html; https://open-xchange.com; https://seclists.org/fulldisclosure/2021/Nov/42
CVE: CVE-2021-33493
Published: 2021-11-22
Description: The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.com/files/165028/OX-App-Suite-Ox-Documents-7.10.x-XSS-Code-Injection-Traversal.html; https://open-xchange.com; https://seclists.org/fulldisclosure/2021/Nov/42
CVE: CVE-2021-33494
Published: 2021-11-22
Description: OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/165028/OX-App-Suite-Ox-Documents-7.10.x-XSS-Code-Injection-Traversal.html; https://open-xchange.com; https://seclists.org/fulldisclosure/2021/Nov/42
CVE: CVE-2021-33495
Published: 2021-11-22
Description: OX App Suite 7.10.5 allows XSS via an OX Chat system message.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/165028/OX-App-Suite-Ox-Documents-7.10.x-XSS-Code-Injection-Traversal.html; https://open-xchange.com; https://seclists.org/fulldisclosure/2021/Nov/42
CVE: CVE-2021-38146
Published: 2021-11-22
Description: The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/164970/Wipro-Holmes-Orchestrator-20.4.1-Arbitrary-File-Download.html; https://www.wipro.com/holmes/; http://packetstormsecurity.com/files/164970/Wipro-Holmes-Orchestrator-20.4.1-Arbitrary-File-Download.html
CVE: CVE-2021-38374
Published: 2021-11-22
Description: OX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader reference within an app loader URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/165038/OX-App-Suite-7.10.5-Cross-Site-Scripting-Information-Disclosure.html; http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html; http://seclists.org/fulldisclosure/2021/Nov/43
CVE: CVE-2021-38375
Published: 2021-11-22
Description: OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/165038/OX-App-Suite-7.10.5-Cross-Site-Scripting-Information-Disclosure.html; https://seclists.org/fulldisclosure/2021/Nov/43; https://www.open-xchange.com
CVE: CVE-2021-38376
Published: 2021-11-22
Description: OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: http://packetstormsecurity.com/files/165038/OX-App-Suite-7.10.5-Cross-Site-Scripting-Information-Disclosure.html; https://seclists.org/fulldisclosure/2021/Nov/43; https://www.open-xchange.com
CVE: CVE-2021-38377
Published: 2021-11-22
Description: OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-330
References: http://packetstormsecurity.com/files/165038/OX-App-Suite-7.10.5-Cross-Site-Scripting-Information-Disclosure.html; https://seclists.org/fulldisclosure/2021/Nov/43; https://www.open-xchange.com
CVE: CVE-2021-38378
Published: 2021-11-22
Description: OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name.
CVSS Score: 4.3 (MEDIUM)
References: http://packetstormsecurity.com/files/165038/OX-App-Suite-7.10.5-Cross-Site-Scripting-Information-Disclosure.html; https://seclists.org/fulldisclosure/2021/Nov/43; https://www.open-xchange.com
CVE: CVE-2021-43557
Published: 2021-11-22
Description: The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: http://www.openwall.com/lists/oss-security/2021/11/22/1; http://www.openwall.com/lists/oss-security/2021/11/22/2; http://www.openwall.com/lists/oss-security/2021/11/23/1
CVE: CVE-2021-43581
Published: 2021-11-22
Description: An Out-of-Bounds Read vulnerability exists when reading a U3D file using Open Design Alliance PRC SDK before 2022.11. The specific issue exists within the parsing of U3D files. Incorrect use of the LibJpeg source manager inside the U3D library, and crafted data in a U3D file, can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://www.opendesign.com/security-advisories; https://www.opendesign.com/security-advisories
CVE: CVE-2021-43582
Published: 2021-11-22
Description: A Use-After-Free Remote Vulnerability exists when reading a DWG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DWG files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.opendesign.com/security-advisories; https://www.zerodayinitiative.com/advisories/ZDI-21-1353/; https://www.opendesign.com/security-advisories
CVE: CVE-2020-7882
Published: 2021-11-22
Description: Using the parameter of getPFXFolderList function, attackers can see the information of authorization certification and delete the files. It occurs because the parameter contains path traversal characters(ie. '../../../')
CVSS Score: 7.5 (HIGH)
CWE: CWE-24, CWE-22
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36344; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36344
CVE: CVE-2021-26614
Published: 2021-11-22
Description: ius_get.cgi in IpTime C200 camera allows remote code execution. A remote attacker may send a crafted parameters to the exposed vulnerable web service interface which invokes the arbitrary shell command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-749
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36346; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36346
CVE: CVE-2021-3935
Published: 2021-11-22
Description: When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89, CWE-295
References: http://www.pgbouncer.org/changelog.html#pgbouncer-116x; https://bugzilla.redhat.com/show_bug.cgi?id=2021251; https://lists.debian.org/debian-lts-announce/2022/02/msg00016.html
CVE: CVE-2021-3943
Published: 2021-11-22
Description: A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A remote code execution risk when restoring backup files was identified.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=2021963; https://moodle.org/mod/forum/discuss.php?d=429095; https://bugzilla.redhat.com/show_bug.cgi?id=2021963
CVE: CVE-2021-40770
Published: 2021-11-22
Description: Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/prelude/apsb21-96.html; https://helpx.adobe.com/security/products/prelude/apsb21-96.html
CVE: CVE-2021-40771
Published: 2021-11-22
Description: Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/prelude/apsb21-96.html; https://helpx.adobe.com/security/products/prelude/apsb21-96.html
CVE: CVE-2021-40772
Published: 2021-11-22
Description: Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/prelude/apsb21-96.html; https://helpx.adobe.com/security/products/prelude/apsb21-96.html
CVE: CVE-2021-40773
Published: 2021-11-22
Description: Adobe Prelude version 10.1 (and earlier) is affected by a null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/prelude/apsb21-96.html; https://helpx.adobe.com/security/products/prelude/apsb21-96.html
CVE: CVE-2021-40774
Published: 2021-11-22
Description: Adobe Prelude version 10.1 (and earlier) is affected by a null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/prelude/apsb21-96.html; https://helpx.adobe.com/security/products/prelude/apsb21-96.html
CVE: CVE-2021-40775
Published: 2021-11-22
Description: Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious SVG file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/prelude/apsb21-96.html; https://helpx.adobe.com/security/products/prelude/apsb21-96.html
CVE: CVE-2021-42727
Published: 2021-11-22
Description: Adobe Bridge 11.1.1 (and earlier) is affected by a stack overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file in Bridge.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/bridge/apsb21-94.html; https://helpx.adobe.com/security/products/bridge/apsb21-94.html
CVE: CVE-2021-42733
Published: 2021-11-22
Description: Adobe Bridge version 11.1.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/bridge/apsb21-94.html; https://helpx.adobe.com/security/products/bridge/apsb21-94.html