rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-25914 
Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code execution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: object-collider
Published: 2021-03-01T17:20:50.000Z
CVE-2021-25915 
Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead to remote code execution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: changeset
Published: 2021-03-09T14:20:22.000Z
CVE-2021-25916 
Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: patchmerge
Published: 2021-03-16T15:07:42.000Z
CVE-2021-25917 
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the U2F USB Device authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user.
Problem types: description: Cross-Site-Scripting
Affected products: vendor: n/a
product: openemr
Published: 2021-03-22T19:36:10.000Z
CVE-2021-25918 
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the TOTP Authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user.
Problem types: description: Cross-Site-Scripting
Affected products: vendor: n/a
product: openemr
Published: 2021-03-22T19:33:12.000Z
CVE-2021-25919 
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly. A highly privileged attacker could inject arbitrary code into input fields when creating a new user.
Problem types: description: Cross-Site-Scripting
Affected products: vendor: n/a
product: openemr
Published: 2021-03-22T19:22:49.000Z
CVE-2021-25920 
In OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating a new user, which leads to a malicious user able to read and send sensitive messages on behalf of the victim user.
Problem types: description: Improper Access Control
Affected products: vendor: n/a
product: openemr
Published: 2021-03-22T19:29:54.000Z
CVE-2021-25921 
In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the `Allergies` section. An attacker could lure an admin to enter a malicious payload and by that initiate the exploit.
Problem types: description: Cross-Site-Scripting
Affected products: vendor: n/a
product: openemr
Published: 2021-03-22T19:26:23.000Z
CVE-2021-25922 
In OpenEMR, versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly. An attacker could trick a user to click on a malicious url and execute malicious code.
Problem types: description: Cross-Site-Scripting
Affected products: vendor: n/a
product: openemr
Published: 2021-03-22T19:39:21.000Z
CVE-2021-25923 
In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. If a malicious user is aware of the first 72 characters of the victim user’s password, he can leverage it to an account takeover.
Problem types: description: Weak Password Requirements
Affected products: vendor: n/a
product: openemr
Published: 2021-06-24T10:52:31.000Z
CVE-2021-25924 
In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup` endpoint. An attacker can trick a victim to click on a malicious link which could change backup configurations or execute system commands in the post_backup_script field.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: n/a
product: gocd
Published: 2021-04-01T17:58:47.000Z
CVE-2021-25925 
in SiCKRAGE, versions 4.2.0 to 10.0.11.dev1 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly when processed by the server. Therefore, an attacker can inject arbitrary JavaScript code inside the application, and possibly steal a user’s sensitive information.
Problem types: description: Cross-Site Scripting
Affected products: vendor: n/a
product: sickrage
Published: 2021-04-12T13:48:51.000Z
CVE-2021-25926 
In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `quicksearch` feature. Therefore, an attacker can steal a user's sessionID to masquerade as a victim user, to carry out any actions in the context of the user.
Problem types: description: Cross-Site Scripting
Affected products: vendor: n/a
product: sickrage
Published: 2021-04-12T13:45:57.000Z
CVE-2021-25927 
Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: safe-flat
Published: 2021-04-26T10:54:42.000Z
CVE-2021-25928 
Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: safe-obj
Published: 2021-04-26T10:54:47.000Z
CVE-2021-25929 
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the `name` parameter in `noticeWizard` endpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files.
Problem types: description: Cross-Site Scripting
Affected products: vendor: n/a
product: OpenNMS
Published: 2021-05-20T14:09:45.000Z
CVE-2021-25930 
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and since there is no validation of an existing user name while renaming a user. As a result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the user list.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: n/a
product: OpenNMS
Published: 2021-05-20T13:57:58.000Z
CVE-2021-25931 
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection at `/opennms/admin/userGroupView/users/updateUser`. This flaw allows assigning `ROLE_ADMIN` security role to a normal user. Using this flaw, an attacker can trick the admin user to assign administrator privileges to a normal user by enticing him to click upon an attacker-controlled website.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: n/a
product: OpenNMS
Published: 2021-05-20T14:54:36.000Z
CVE-2021-25932 
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `userID` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database.
Problem types: description: Cross-Site Scripting
Affected products: vendor: n/a
product: OpenNMS
Published: 2021-06-01T11:15:51.000Z
CVE-2021-25933 
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `groupName` and `groupComment` parameters. Due to this flaw, an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms.
Problem types: description: Cross-Site Scripting
Affected products: vendor: n/a
product: OpenNMS
Published: 2021-05-20T14:59:24.000Z
CVE-2021-25934 
In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `createRequisitionedNode()` does not perform any validation checks on the input sent to the `node-label` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database.
Problem types: description: Cross-Site Scripting
Affected products: vendor: n/a
product: OpenNMS
Published: 2021-05-25T18:42:29.000Z
CVE-2021-25935 
In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `add()` performs improper validation checks on the input sent to the `foreign-source` parameter. Due to this flaw an attacker could bypass the existing regex validation and inject an arbitrary script which will be stored in the database.
Problem types: description: Cross-Site Scripting
Affected products: vendor: n/a
product: OpenNMS
Published: 2021-05-25T18:32:59.000Z
CVE-2021-25938 
In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting (XSS), since there is no validation of the .zip file name and filtering of potential abusive characters which zip files can be named to. There is no X-Frame-Options Header set, which makes it more susceptible for leveraging self XSS by attackers.
Problem types: description: Cross-Site Scripting
Affected products: vendor: n/a
product: ArangoDB
Published: 2021-05-24T10:54:10.000Z
CVE-2021-25939 ArangoDB - Blind SSRF when Downloading Foxx Service from URL
In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and send internal requests to localhost.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: arangodb
product: arangodb
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: WhiteSource Vulnerability Research Team (WVR)
Published: 2022-02-09T12:15:14.213Z
CVE-2021-25940 ArangoDB - Insufficient Session Expiration after Password Change
In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated, allowing a malicious user to still be logged in and perform arbitrary actions within the system.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: arangodb
product: arangodb
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: WhiteSource Vulnerability Research Team (WVR)
Published: 2021-11-16T09:25:09.000Z
CVE-2021-25941 
Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: deep-override
Published: 2021-05-14T13:43:16.000Z
CVE-2021-25943 
Prototype pollution vulnerability in '101' versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remote code execution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: 101
Published: 2021-05-14T13:32:19.000Z
CVE-2021-25944 
Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: deep-defaults
Published: 2021-05-25T18:26:38.000Z
CVE-2021-25945 
Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: js-extend
Published: 2021-05-26T14:22:31.000Z
CVE-2021-25946 
Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: nconf-toml
Published: 2021-05-25T18:48:25.000Z
CVE-2021-25947 
Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code execution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: nestie
Published: 2021-06-03T19:51:14.000Z
CVE-2021-25948 
Prototype pollution vulnerability in 'expand-hash' versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: expand-hash
Published: 2021-06-10T11:55:36.000Z
CVE-2021-25949 
Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: set-getter
Published: 2021-06-10T12:00:13.000Z
CVE-2021-25951 
XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service.
Problem types: description: XXE
Affected products: vendor: n/a
product: XML2Dict
Published: 2021-06-30T11:42:24.000Z
CVE-2021-25952 
Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: just-safe-set
Published: 2021-07-07T11:47:13.000Z
CVE-2021-25953 
Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: putil-merge
Published: 2021-07-14T10:34:46.000Z
CVE-2021-25954 Improper Access Control in “Dolibarr”
In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, the affected field is at “/adherents/note.php?id=1” endpoint.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Dolibarr
product: dolibarr
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Hagai Wechsler
Published: 2021-08-09T16:58:31.962Z
CVE-2021-25955 Stored XSS in “Dolibarr” leads to privilege escalation
In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the “Private Note” field at “/adherents/note.php?id=1” endpoint. These scripts are executed in a victim’s browser when they open the page containing the vulnerable field. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account takeover of the admin and due to other vulnerability (Improper Access Control on Private notes) a low privileged user can update the private notes which could lead to privilege escalation.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Dolibarr
product: dolibarr
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Hagai Wechsler
Published: 2021-08-15T20:35:25.743Z
CVE-2021-25956 Improper User Access Control in "Dolibarr" Leads to Account Takeover
In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user “Login”. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Dolibarr
product: dolibarr
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Daniel Elkabes
Published: 2021-08-17T14:15:54.142Z
CVE-2021-25957 Account Takeover in "Dolibarr" via Password Reset Functionality
In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password.
Problem types: cwe_id: CWE-640
description: CWE-640 Weak Password Recovery Mechanism for Forgotten Password
Affected products: vendor: Dolibarr
product: dolibarr
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Hagai Wechsler
Published: 2021-08-17T14:13:30.226Z
CVE-2021-25958 Generation of Error Message Containing Sensitive Information in Apache OFBiz
In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception occurs.
Problem types: cwe_id: CWE-209
description: CWE-209 Information Exposure Through an Error Message
Affected products: vendor: apache
product: ofbiz-framework
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Published: 2021-08-30T14:07:00.257Z
CVE-2021-25959 OpenCRX - Reflected Cross-Site Scripting in Password Reset Functionality
In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: org.opencrx
product: opencrx-core-config
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2021-09-29T13:50:15.394Z
CVE-2021-25960 SuiteCRM - CSV Injection in Accounts Module
In “SuiteCRM” application, v7.11.18 through v7.11.19 and v7.10.29 through v7.10.31 are affected by “CSV Injection” vulnerability (Formula Injection). A low privileged attacker can use accounts module to inject payloads in the input fields. When an administrator access accounts module to export the data as a CSV file and opens it, the payload gets executed. This was not fixed properly as part of CVE-2020-15301, allowing the attacker to bypass the security measure.
Problem types: cwe_id: CWE-1236
description: CWE-1236
Affected products: vendor: salesagility
product: SuiteCRM
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-09-29T13:55:15.155Z
CVE-2021-25961 SuiteCRM - Account Takeover in Password Reset Functionality
In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is associated with a deleted user id, which makes it possible for account takeover of any newly created user with the same user id.
Problem types: cwe_id: CWE-640
description: CWE-640 Weak Password Recovery Mechanism for Forgotten Password
Affected products: vendor: salesagility
product: SuiteCRM
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-09-29T13:50:10.158Z