deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-21299
Published: 2021-02-11
Description: hyper is an open-source HTTP library for Rust (crates.io). In hyper from version 0.12.0 and before versions 0.13.10 and 0.14.3 there is a vulnerability that can enable a request smuggling attack. The HTTP server code had a flaw that incorrectly understands some requests with multiple transfer-encoding headers to have a chunked payload, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that understands the request payload boundary differently can result in "request smuggling" or "desync attacks". To determine if vulnerable, all these things must be true: 1) Using hyper as an HTTP server (the client is not affected), 2) Using HTTP/1.1 (HTTP/2 does not use transfer-encoding), 3) Using a vulnerable HTTP proxy upstream to hyper. If an upstream proxy correctly rejects the illegal transfer-encoding headers, the desync attack cannot succeed. If there is no proxy upstream of hyper, hyper cannot start the desync attack, as the client will repair the headers before forwarding. This is fixed in versions 0.14.3 and 0.13.10. As a workaround one can take the following options: 1) Reject requests that contain a `transfer-encoding` header, 2) Ensure any upstream proxy handles `transfer-encoding` correctly.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-444
References: https://crates.io/crates/hyper; https://github.com/hyperium/hyper/commit/8f93123efef5c[PII_REDACTED]fe4f34c83c89cec02; https://github.com/hyperium/hyper/security/advisories/GHSA-6hfq-h8hq-87mf
CVE: CVE-2021-21301
Published: 2021-02-11
Description: Wire is an open-source collaboration platform. In Wire for iOS (iPhone and iPad) before version 3.75 there is a vulnerability where the video capture isn't stopped in a scenario where a user first has their camera enabled and then disables it. It's a privacy issue because video is streamed to the call when the user believes it is disabled. It impacts all users in video calls. This is fixed in version 3.75.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: https://github.com/wireapp/wire-ios/commit/7e3c30120066c9b10e50cc0d20012d0849c33a40; https://github.com/wireapp/wire-ios/pull/4879; https://github.com/wireapp/wire-ios/security/advisories/GHSA-7fg4-x8vj-qvxf
CVE: CVE-2021-22652
Published: 2021-02-11
Description: Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: http://packetstormsecurity.com/files/161937/Advantech-iView-Unauthenticated-Remote-Code-Execution.html; https://us-cert.cisa.gov/ics/advisories/icsa-21-040-02; http://packetstormsecurity.com/files/161937/Advantech-iView-Unauthenticated-Remote-Code-Execution.html
CVE: CVE-2021-22654
Published: 2021-02-11
Description: Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-040-02; https://www.zerodayinitiative.com/advisories/ZDI-21-188/; https://www.zerodayinitiative.com/advisories/ZDI-21-190/
CVE: CVE-2021-22656
Published: 2021-02-11
Description: Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to read sensitive files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-040-02; https://www.zerodayinitiative.com/advisories/ZDI-21-189/; https://us-cert.cisa.gov/ics/advisories/icsa-21-040-02
CVE: CVE-2021-22658
Published: 2021-02-11
Description: Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalate privileges to 'Administrator'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-040-02; https://www.zerodayinitiative.com/advisories/ZDI-21-191/; https://us-cert.cisa.gov/ics/advisories/icsa-21-040-02
CVE: CVE-2021-22880
Published: 2021-02-11
Description: The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://discuss.rubyonrails.org/t/cve-2021-22880-possible-dos-vulnerability-in-active-record-postgresql-adapter/77129; https://hackerone.com/reports/1023899; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO5OJ3F4ZL3UXVLJO6ECANRVZBNRS2IH/
CVE: CVE-2021-22881
Published: 2021-02-11
Description: The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: http://www.openwall.com/lists/oss-security/2021/05/05/2; http://www.openwall.com/lists/oss-security/2021/08/20/1; http://www.openwall.com/lists/oss-security/2021/12/14/5
CVE: CVE-2021-25688
Published: 2021-02-11
Description: Under certain conditions, Teradici PCoIP Agents for Windows prior to version 20.10.0 and Teradici PCoIP Agents for Linux prior to version 21.01.0 may log parts of a user's password in the application logs.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://advisory.teradici.com/security-advisories/73/; https://advisory.teradici.com/security-advisories/73/
CVE: CVE-2021-25689
Published: 2021-02-11
Description: An out of bounds write in Teradici PCoIP soft client versions prior to version 20.10.1 could allow an attacker to remotely execute code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://advisory.teradici.com/security-advisories/75/; https://advisory.teradici.com/security-advisories/75/
CVE: CVE-2021-25690
Published: 2021-02-11
Description: A null pointer dereference in Teradici PCoIP Soft Client versions prior to 20.07.3 could allow an attacker to crash the software.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://advisory.teradici.com/security-advisories/74/; https://advisory.teradici.com/security-advisories/74/
CVE: CVE-2021-27184
Published: 2021-02-11
Description: Pelco Digital Sentry Server 7.18.72.11464 has an XML External Entity vulnerability (exploitable via the DTD parameter entities technique), resulting in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the ControlPointCacheShare.xml file (in a %APPDATA%\Pelco directory) when DSControlPoint.exe is executed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://github.com/vitorespf/Advisories/blob/master/Pelco_Digital_Sentry_Server.txt; https://support.pelco.com/s/article/What-is-the-Digital-Sentry-software-release-revision-history; https://github.com/vitorespf/Advisories/blob/master/Pelco_Digital_Sentry_Server.txt
CVE: CVE-2021-27191
Published: 2021-02-11
Description: The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service (DoS) if the range is untrusted input. An attacker could send a large range (such as 128.0.0.0/1) that causes resource exhaustion.
CVSS Score: 7.5 (HIGH)
References: https://advisory.checkmarx.net/advisory/CX-2021-4304; https://github.com/JoeScho/get-ip-range/commit/98ca22b815c77273cbab259811ab0976118e13b6; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-21307
Published: 2021-02-11
Description: Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, one can block access to the Lucee Administrator.
CVSS Score: 8.6 (HIGH)
CWE: CWE-862
References: http://ciacfug.org/blog/updating-lucee-as-part-of-a-vulnerability-alert-response; http://packetstormsecurity.com/files/163864/Lucee-Administrator-imgProcess.cfm-Arbitrary-File-Write.html; https://dev.lucee.org/t/lucee-vulnerability-alert-november-2020/7643
CVE: CVE-2021-21015
Published: 2021-02-11
Description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an OS command injection via the customer attribute save controller. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://helpx.adobe.com/security/products/magento/apsb21-08.html; https://helpx.adobe.com/security/products/magento/apsb21-08.html
CVE: CVE-2021-21016
Published: 2021-02-11
Description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the WebAPI. Successful exploitation could lead to remote code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://helpx.adobe.com/security/products/magento/apsb21-08.html; https://helpx.adobe.com/security/products/magento/apsb21-08.html
CVE: CVE-2021-21017
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21017
CVE: CVE-2021-21018
Published: 2021-02-11
Description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://helpx.adobe.com/security/products/magento/apsb21-08.html; https://helpx.adobe.com/security/products/magento/apsb21-08.html
CVE: CVE-2021-21019
Published: 2021-02-11
Description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-91
References: https://helpx.adobe.com/security/products/magento/apsb21-08.html; https://helpx.adobe.com/security/products/magento/apsb21-08.html
CVE: CVE-2021-21020
Published: 2021-02-11
Description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as Customer module. Successful exploitation could lead to unauthorized access to restricted resources.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/magento/apsb21-08.html; https://helpx.adobe.com/security/products/magento/apsb21-08.html
CVE: CVE-2021-21021
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21022
Published: 2021-02-11
Description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object reference (IDOR) in the product module. Successful exploitation could lead to unauthorized access to restricted resources.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://helpx.adobe.com/security/products/magento/apsb21-08.html; https://helpx.adobe.com/security/products/magento/apsb21-08.html
CVE: CVE-2021-21023
Published: 2021-02-11
Description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting vulnerability in the admin console. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/magento/apsb21-08.html; https://helpx.adobe.com/security/products/magento/apsb21-08.html
CVE: CVE-2021-21024
Published: 2021-02-11
Description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://helpx.adobe.com/security/products/magento/apsb21-08.html; https://helpx.adobe.com/security/products/magento/apsb21-08.html
CVE: CVE-2021-21025
Published: 2021-02-11
Description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-91
References: https://helpx.adobe.com/security/products/magento/apsb21-08.html; https://helpx.adobe.com/security/products/magento/apsb21-08.html
CVE: CVE-2021-21026
Published: 2021-02-11
Description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the integrations module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285
References: https://helpx.adobe.com/security/products/magento/apsb21-08.html; https://helpx.adobe.com/security/products/magento/apsb21-08.html
CVE: CVE-2021-21027
Published: 2021-02-11
Description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the GraphQL API. Successful exploitation could lead to unauthorized modification of customer metadata by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://helpx.adobe.com/security/products/magento/apsb21-08.html; https://helpx.adobe.com/security/products/magento/apsb21-08.html
CVE: CVE-2021-21028
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21029
Published: 2021-02-11
Description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/magento/apsb21-08.html; https://helpx.adobe.com/security/products/magento/apsb21-08.html
CVE: CVE-2021-21030
Published: 2021-02-11
Description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting (XSS) in the customer address upload feature. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Exploitation of this issue requires user interaction.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/magento/apsb21-08.html; https://helpx.adobe.com/security/products/magento/apsb21-08.html
CVE: CVE-2021-21031
Published: 2021-02-11
Description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-613
References: https://helpx.adobe.com/security/products/magento/apsb21-08.html; https://helpx.adobe.com/security/products/magento/apsb21-08.html
CVE: CVE-2021-21032
Published: 2021-02-11
Description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-613
References: https://helpx.adobe.com/security/products/magento/apsb21-08.html; https://helpx.adobe.com/security/products/magento/apsb21-08.html
CVE: CVE-2021-21033
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21034
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to locally elevate privileges in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21035
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21036
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by an Integer Overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21037
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by a Path Traversal vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21038
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by an Out-of-bounds Write vulnerability when parsing a crafted jpeg file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21039
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html