rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-26735 Untrusted Search Path While Executing REG DELETE by Uninstaller
The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to execute code with SYSTEM privileges.






Problem types: cwe_id: CWE-346
description: CWE-346 Origin Validation Error
Affected products: vendor: Zscaler
product: Client Connector
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: LMCO Red Team
Published: 2023-10-23T13:19:35.867Z
CVE-2021-26736 ZApp Installer Privilege Escalation Vulnerabilities
Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged path. A local adversary may be able to execute code with SYSTEM privileges.



Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Zscaler
product: Client Connector
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: LMCO Red Team
Published: 2023-10-23T13:21:12.518Z
CVE-2021-26737 Privilege Escalation Using PID Reuse in ZCC macOS
The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients. A local adversary without sufficient privileges may be able to shutdown the Zscaler tunnel by exploiting a race condition.



Problem types: cwe_id: CWE-346
description: CWE-346 Origin Validation Error
Affected products: vendor: Zscaler
product: Client Connector
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Thomas Chauchefoin (SonarSource), Dave Satchell (Avast Red Team)
Published: 2023-10-23T13:22:51.537Z
CVE-2021-26738 Privilege Escalation for ZCC macOS via PATH Variable
Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be able to execute code with root privileges.



Problem types: cwe_id: CWE-426
description: CWE-426 Untrusted Search Path
Affected products: vendor: Zscaler
product: Client Connector
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Deutsche Bank Red Team
Published: 2023-10-23T13:24:49.584Z
CVE-2021-26739 
SQL Injection vulnerability in pay.php in millken doyocms 2.3, allows attackers to execute arbitrary code, via the attribute parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-01T15:31:58.000Z
CVE-2021-26740 
Arbitrary file upload vulnerability sysupload.php in millken doyocms 2.3 allows attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-01T15:32:01.000Z
CVE-2021-26746 
Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-19T04:38:27.000Z
CVE-2021-26747 
Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-18T20:55:01.000Z
CVE-2021-26750 
DLL hijacking in Panda Agent <=1.16.11 in Panda Security, S.L.U. Panda Adaptive Defense 360 <= 8.0.17 allows attacker to escalate privileges via maliciously crafted DLL file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-23T14:11:59.000Z
CVE-2021-26751 
NeDi 1.9C allows an authenticated user to perform a SQL Injection in the Monitoring History function on the endpoint /Monitoring-History.php via the det HTTP GET parameter. This allows an attacker to access all the data in the database and obtain access to the NeDi application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-12T20:35:48.000Z
CVE-2021-26752 
NeDi 1.9C allows an authenticated user to execute operating system commands in the Nodes Traffic function on the endpoint /Nodes-Traffic.php via the md or ag HTTP GET parameter. This allows an attacker to obtain access to the operating system where NeDi is installed and to all application data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-12T20:35:40.000Z
CVE-2021-26753 
NeDi 1.9C allows an authenticated user to inject PHP code in the System Files function on the endpoint /System-Files.php via the txt HTTP POST parameter. This allows an attacker to obtain access to the operating system where NeDi is installed and to all application data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-12T20:35:20.000Z
CVE-2021-26754 
wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=get_wdtable order[0][dir] SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-07T23:31:38.000Z
CVE-2021-26758 
Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-07T20:50:20.000Z
CVE-2021-26762 
SQL injection vulnerability in PHPGurukul Student Record System 4.0 allows remote attackers to execute arbitrary SQL statements, via the cid parameter to edit-course.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T15:43:51.000Z
CVE-2021-26764 
SQL injection vulnerability in PHPGurukul Student Record System v 4.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edit-std.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T15:56:33.000Z
CVE-2021-26765 
SQL injection vulnerability in PHPGurukul Student Record System 4.0 allows remote attackers to execute arbitrary SQL statements, via the sid parameter to edit-sub.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T15:33:26.000Z
CVE-2021-26776 
CSZ CMS 1.2.9 is affected by a cross-site scripting (XSS) vulnerability in multiple pages through the field name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-11T16:22:51.000Z
CVE-2021-26777 
Buffer overflow vulnerability in function SetFirewall in index.cgi in CIRCUTOR COMPACT DC-S BASIC smart metering concentrator Firwmare version CIR_CDC_v1.2.17, allows attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-02T03:26:41.000Z
CVE-2021-26786 
An issue was discoverered in in customercentric-selling-poland PlayTube, allows authenticated attackers to execute arbitrary code via the purchace code to the config.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-03T16:07:12.000Z
CVE-2021-26787 
A cross site scripting (XSS) vulnerability in Genesys Workforce Management 8.5.214.20 can occur (during record deletion) via the Time-off parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-15T06:59:31.000Z
CVE-2021-26788 
Oryx Embedded CycloneTCP 1.7.6 to 2.0.0, fixed in 2.0.2, is affected by incorrect input validation, which may cause a denial of service (DoS). To exploit the vulnerability, an attacker needs to have TCP connectivity to the target system. Receiving a maliciously crafted TCP packet from an unauthenticated endpoint is sufficient to trigger the bug.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-08T12:53:12.000Z
CVE-2021-26794 
Privilege escalation in 'upload.php' in FrogCMS SentCMS v0.9.5 allows attacker to execute arbitrary code via crafted php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-23T15:15:40.000Z
CVE-2021-26795 
A SQL Injection vulnerability in /appliance/shiftmgn.php in TalariaX sendQuick Alert Plus Server Admin 4.3 before 8HF11 allows attackers to obtain sensitive information via a Roster Time to Roster Management.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-14T20:16:04.000Z
CVE-2021-26797 
An access control vulnerability in Hame SD1 Wi-Fi firmware <=V.20140224154640 allows an attacker to get system administrator through an open Telnet service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-26T11:20:53.000Z
CVE-2021-26799 
Cross Site Scripting (XSS) vulnerability in admin/files/edit in Omeka Classic <=2.7 allows remote attackers to inject arbitrary web script or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-23T10:39:50.000Z
CVE-2021-26800 
Cross Site Request Forgery (CSRF) vulnerability in Change-password.php in phpgurukul user management system in php using stored procedure V1.0, allows attackers to change the password to an arbitrary account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-16T19:06:51.000Z
CVE-2021-26804 
Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validation by changing any file extension to ".gif", then uploading it in the "Administration/ Parameters/ Images" section of the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-04T16:49:02.000Z
CVE-2021-26805 
Buffer Overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a malicious WAV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T13:51:01.000Z
CVE-2021-26807 
GalaxyClient version 2.0.28.9 loads unsigned DLLs such as zlib1.dll, libgcc_s_dw2-1.dll and libwinpthread-1.dll from PATH, which allows an attacker to potentially run code locally through unsigned DLL loading.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-30T10:53:04.000Z
CVE-2021-26809 
PHPGurukul Car Rental Project version 2.0 suffers from a remote shell upload vulnerability in changeimage1.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-17T14:32:47.000Z
CVE-2021-26810 
D-link DIR-816 A2 v1.10 is affected by a remote code injection vulnerability. An HTTP request parameter can be used in command string construction in the handler function of the /goform/dir_setWanWifi, which can lead to command injection via shell metacharacters in the statuscheckpppoeuser parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-30T13:27:57.000Z
CVE-2021-26812 
Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject javascript code to be run by the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T13:55:47.000Z
CVE-2021-26813 
markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-03T15:17:41.000Z
CVE-2021-26814 
Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. An authenticated user to the service may exploit incomplete input validation on the /manager/files API to inject arbitrary code within the API service script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-06T01:24:12.000Z
CVE-2021-26822 
Teachers Record Management System 1.0 is affected by a SQL injection vulnerability in 'searchteacher' POST parameter in search-teacher.php. This vulnerability can be exploited by a remote unauthenticated attacker to leak sensitive information and perform code execution attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-15T20:54:51.000Z
CVE-2021-26824 
DM FingerTool v1.19 in the DM PD065 Secure USB is susceptible to improper authentication by a replay attack, allowing local attackers to bypass user authentication and access all features and data on the USB.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-26T12:16:15.000Z
CVE-2021-26825 
An integer overflow issue exists in Godot Engine up to v3.2 that can be triggered when loading specially crafted.TGA image files. The vulnerability exists in ImageLoaderTGA::load_image() function at line: const size_t buffer_size = (tga_header.image_width * tga_header.image_height) * pixel_size; The bug leads to Dynamic stack buffer overflow. Depending on the context of the application, attack vector can be local or remote, and can lead to code execution and/or system crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-08T14:58:40.000Z
CVE-2021-26826 
A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary checks when loading .TGA image files. Depending on the context of the application, attack vector can be local or remote, and can lead to code execution and/or system crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-08T14:55:24.000Z
CVE-2021-26827 
Buffer Overflow in TP-Link WR2041 v1 firmware for the TL-WR2041+ router allows remote attackers to cause a Denial-of-Service (DoS) by sending an HTTP request with a very long "ssid" parameter to the "/userRpm/popupSiteSurveyRpm.html" webpage, which crashes the router.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T13:53:21.000Z
CVE-2021-26828 
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-11T11:10:58.000Z
CVE-2021-26829 
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-11T11:05:23.000Z
CVE-2021-26830 
SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` input field of ajax.php in the `Pugin library - delete` module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-16T17:24:16.000Z
CVE-2021-26832 
Cross Site Scripting (XSS) in the "Reset Password" page form of Priority Enterprise Management System v8.00 allows attackers to execute javascript on behalf of the victim by sending a malicious URL or directing the victim to a malicious site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T13:45:38.000Z
CVE-2021-26833 
Cleartext Storage in a File or on Disk in TimelyBills <= 1.7.0 for iOS and versions <= 1.21.115 for Android allows attacker who can locally read user's files obtain JWT tokens for user's account due to insufficient cache clearing mechanisms. A threat actor can obtain sensitive user data by decoding the tokens as JWT is signed and encoded, not encrypted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T15:46:01.000Z
CVE-2021-26834 
A cross-site scripting (XSS) vulnerability exists in Znote 0.5.2. An attacker can insert payloads, and the code execution will happen immediately on markdown view mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-18T11:46:49.000Z
CVE-2021-26835 
No filtering of cross-site scripting (XSS) payloads in the markdown-editor in Zettlr 1.8.7 allows attackers to perform remote code execution via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-18T11:46:56.000Z
CVE-2021-26837 
SQL Injection vulnerability in SearchTextBox parameter in Fortra (Formerly HelpSystems) DeliverNow before version 1.2.18, allows attackers to execute arbitrary code, escalate privileges, and gain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-18T00:00:00.000Z
CVE-2021-26843 
An issue was discovered in sthttpd through 2.27.1. On systems where the strcpy function is implemented with memcpy, the de_dotdot function may cause a Denial-of-Service (daemon crash) due to overlapping memory ranges being passed to memcpy. This can triggered with an HTTP GET request for a crafted filename. NOTE: this is similar to CVE-2017-10671, but occurs in a different part of the de_dotdot function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-07T20:14:34.000Z
CVE-2021-26844 
A cross-site scripting (XSS) vulnerability in Power Admin PA Server Monitor 8.2.1.1 allows remote attackers to inject arbitrary web script or HTML via Console.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-05T10:07:48.000Z
CVE-2021-26845 eSOMS Report Function Vulnerability
Information Exposure vulnerability in Hitachi ABB Power Grids eSOMS allows unauthorized user to gain access to report data if the URL used to access the report is discovered. This issue affects: Hitachi ABB Power Grids eSOMS 6.0 versions prior to 6.0.4.2.2; 6.1 versions prior to 6.1.4; 6.3 versions prior to 6.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2021-06-14T21:25:40.617Z
CVE-2021-26854 Microsoft Exchange Server Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Exchange Server 2016 Cumulative Update 19
cpes: cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft Exchange Server 2019 Cumulative Update 8
cpes: cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft Exchange Server 2013 Cumulative Update 23
cpes: cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft Exchange Server 2019 Cumulative Update 7
cpes: cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft Exchange Server 2016 Cumulative Update 18
cpes: cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.6
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-03-02T23:55:25.000Z
CVE-2021-26859 Microsoft Power BI Information Disclosure Vulnerability
Problem types: description: Information Disclosure
Affected products: vendor: Microsoft
product: Power BI Report Server version 15.0.1103.234
cpes: cpe:2.3:a:microsoft:power_bi_report_server:15.0.1103.234:*:*:*:*:*:*:*
vendor: Microsoft
product: Power BI Report Server version 15.0.1104.300
cpes: cpe:2.3:a:microsoft:power_bi_report_server:15.0.1104.300:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
Published: 2021-03-11T15:35:31.000Z
CVE-2021-26860 Windows App-V Overlay Filter Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Windows 10 Version 1809
cpes: cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server 2019
cpes: cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 1909
cpes: cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server, version 1909 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_1909:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 2004
cpes: cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 20H2
cpes: cpe:2.3:o:microsoft:windows_10_20H2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_20H2:*:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-03-11T15:36:50.000Z