rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-41296 ECOA BAS controller - Weak Password Requirements
ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.
Problem types: cwe_id: CWE-521
description: CWE-521 Weak Password Requirements
Affected products: vendor: ECOA
product: ECS Router Controller ECS (FLASH)
vendor: ECOA
product: RiskBuster Terminator E6L45
vendor: ECOA
product: RiskBuster System RB 3.0.0
vendor: ECOA
product: RiskBuster System TRANE 1.0
vendor: ECOA
product: Graphic Control Software
vendor: ECOA
product: SmartHome II E9246
vendor: ECOA
product: RiskTerminator
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-09-30T10:40:58.921Z
CVE-2021-41297 ECOA BAS controller - Insufficiently Protected Credentials-1
ECOA BAS controller is vulnerable to weak access control mechanism allowing authenticated user to remotely escalate privileges by disclosing credentials of administrative accounts in plain-text.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: ECOA
product: ECS Router Controller ECS (FLASH)
vendor: ECOA
product: RiskBuster Terminator E6L45
vendor: ECOA
product: RiskBuster System RB 3.0.0
vendor: ECOA
product: RiskBuster System TRANE 1.0
vendor: ECOA
product: Graphic Control Software
vendor: ECOA
product: SmartHome II E9246
vendor: ECOA
product: RiskTerminator
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-09-30T10:41:00.486Z
CVE-2021-41298 ECOA BAS controller - Improper Access Control
ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers with general user's privilege can remotely bypass authorization and access the hidden resources in the system and execute privileged functionalities.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: ECOA
product: ECS Router Controller ECS (FLASH)
vendor: ECOA
product: RiskBuster Terminator E6L45
vendor: ECOA
product: RiskBuster System RB 3.0.0
vendor: ECOA
product: RiskBuster System TRANE 1.0
vendor: ECOA
product: Graphic Control Software
vendor: ECOA
product: SmartHome II E9246
vendor: ECOA
product: RiskTerminator
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-09-30T10:41:02.047Z
CVE-2021-41299 ECOA BAS controller - Use of Hard-coded Credentials
ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers can obtain administrator’s privilege without logging in.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: ECOA
product: ECS Router Controller ECS (FLASH)
vendor: ECOA
product: RiskBuster Terminator E6L45
vendor: ECOA
product: RiskBuster System RB 3.0.0
vendor: ECOA
product: RiskBuster System TRANE 1.0
vendor: ECOA
product: Graphic Control Software
vendor: ECOA
product: SmartHome II E9246
vendor: ECOA
product: RiskTerminator
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-09-30T10:41:03.577Z
CVE-2021-41300 ECOA BAS controller - Insufficiently Protected Credentials-2
ECOA BAS controller’s special page displays user account and passwords in plain text, thus unauthenticated attackers can access the page and obtain privilege with full functionality.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: ECOA
product: ECS Router Controller ECS (FLASH)
vendor: ECOA
product: RiskBuster Terminator E6L45
vendor: ECOA
product: RiskBuster System RB 3.0.0
vendor: ECOA
product: RiskBuster System TRANE 1.0
vendor: ECOA
product: Graphic Control Software
vendor: ECOA
product: SmartHome II E9246
vendor: ECOA
product: RiskTerminator
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-09-30T10:41:05.097Z
CVE-2021-41301 ECOA BAS controller - Exposure of Sensitive Information to an Unauthorized Actor
ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: ECOA
product: ECS Router Controller ECS (FLASH)
vendor: ECOA
product: RiskBuster Terminator E6L45
vendor: ECOA
product: RiskBuster System RB 3.0.0
vendor: ECOA
product: RiskBuster System TRANE 1.0
vendor: ECOA
product: Graphic Control Software
vendor: ECOA
product: SmartHome II E9246
vendor: ECOA
product: RiskTerminator
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-09-30T10:41:06.633Z
CVE-2021-41302 ECOA BAS controller - Missing Encryption of Sensitive Data
ECOA BAS controller stores sensitive data (backup exports) in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s privilege.
Problem types: cwe_id: CWE-311
description: CWE-311 Missing Encryption of Sensitive Data
Affected products: vendor: ECOA
product: ECS Router Controller ECS (FLASH)
vendor: ECOA
product: RiskBuster Terminator E6L45
vendor: ECOA
product: RiskBuster System RB 3.0.0
vendor: ECOA
product: RiskBuster System TRANE 1.0
vendor: ECOA
product: Graphic Control Software
vendor: ECOA
product: SmartHome II E9246
vendor: ECOA
product: RiskTerminator
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2021-09-30T10:41:08.156Z
CVE-2021-41303 Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass
Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Apache Software Foundation
product: Apache Shiro
Credits: lang: en
value: Apache Shiro would like to thank tsug0d for reporting this issue.
Published: 2021-09-17T08:20:12.000Z
CVE-2021-41304 
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the /secure/admin/ImporterFinishedPage.jspa error message. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.2.
Problem types: description: Cross-Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-10-26T04:15:16.660Z
CVE-2021-41305 
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filters via an Insecure Direct Object References (IDOR) vulnerability in the Average Number of Times in Status Gadget. The affected versions are before version 8.13.12..
Problem types: description: Insecure Direct Object References (IDOR)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-10-26T04:15:18.259Z
CVE-2021-41306 
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an Insecure Direct Object References (IDOR) vulnerability in the Average Time in Status Gadget. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.0.
Problem types: description: Insecure Direct Object References (IDOR)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-10-26T04:15:19.782Z
CVE-2021-41307 
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and private filters via an Insecure Direct Object References (IDOR) vulnerability in the Workload Pie Chart Gadget. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.0.
Problem types: description: Insecure Direct Object References (IDOR)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-10-26T04:15:21.297Z
CVE-2021-41308 
Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings via a Broken Access Control vulnerability in the `ReplicationSettings!default.jspa` endpoint. The affected versions are before version 8.6.0, from version 8.7.0 before 8.13.12, and from version 8.14.0 before 8.20.1.
Problem types: cwe_id: CWE-285
description: Improper Authorization (CWE-285)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-10-26T04:15:22.911Z
CVE-2021-41309 
Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of another user's Jira Service Management project via a Broken Authentication vulnerability in the /plugins/servlet/audit/resource endpoint. The affected versions of Jira Server and Data Center are before version 8.19.1.
Problem types: cwe_id: CWE-287
description: Broken Authentication (CWE-287)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-12-08T03:35:10.422Z
CVE-2021-41310 
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the Associated Projects feature (/secure/admin/AssociatedProjectsForCustomField.jspa). The affected versions are before version 8.5.19, from version 8.6.0 before 8.13.11, and from version 8.14.0 before 8.19.1.
Problem types: description: Stored Cross-Site Scripting (SXSS)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-11-01T22:55:09.292Z
CVE-2021-41311 
Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify projects' Users & Roles settings, via a Broken Authentication vulnerability in the /plugins/servlet/project-config/PROJECT/roles endpoint. The affected versions are before version 8.19.1.
Problem types: cwe_id: CWE-287
description: Broken Authentication (CWE-287)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-12-08T03:35:11.838Z
CVE-2021-41312 
Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Management to enable and disable Issue Collectors on Jira Service Management projects via an Improper Authentication vulnerability in the /secure/ViewCollectors endpoint. The affected versions are before version 8.19.1.
Problem types: cwe_id: CWE-287
description: Improper Authentication (CWE-287)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-11-03T03:50:33.432Z
CVE-2021-41313 
Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurations via an Improper Authorization vulnerability in the /secure/admin/ConfigureBatching!default.jspa endpoint. The affected versions are before version 8.20.7.
Problem types: cwe_id: CWE-285
description: Improper Authorization (CWE-285)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-11-01T03:05:09.100Z
CVE-2021-41314 
Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of the authentication scheme - allows the attacker to create (or overwrite) a file with specific content (e.g., the "2" string). This leads to admin session crafting and therefore gaining full web UI admin privileges by an unauthenticated attacker. This affects GC108P before 1.0.8.2, GC108PP before 1.0.8.2, GS108Tv3 before 7.0.7.2, GS110TPP before 7.0.7.2, GS110TPv3 before 7.0.7.2, GS110TUP before 1.0.5.3, GS308T before 1.0.3.2, GS310TP before 1.0.3.2, GS710TUP before 1.0.5.3, GS716TP before 1.0.4.2, GS716TPP before 1.0.4.2, GS724TPP before 2.0.6.3, GS724TPv2 before 2.0.6.3, GS728TPPv2 before 6.0.8.2, GS728TPv2 before 6.0.8.2, GS750E before 1.0.1.10, GS752TPP before 6.0.8.2, GS752TPv2 before 6.0.8.2, MS510TXM before 1.0.4.2, and MS510TXUP before 1.0.4.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-16T22:00:37.000Z
CVE-2021-41315 
The Device42 Remote Collector before 17.05.01 does not sanitize user input in its SNMP Connectivity utility. This allows an authenticated attacker (with access to the console application) to execute arbitrary OS commands and escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-17T14:46:17.000Z
CVE-2021-41316 
The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility. An attacker (with permissions to add or edit jobs run by this utility) can inject an extra argument to overwrite arbitrary files as the root user on the Remote Collector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-17T14:45:53.000Z
CVE-2021-41317 
XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-17T15:11:54.000Z
CVE-2021-41318 
In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input. which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-28T17:40:25.000Z
CVE-2021-41320 
A technical user has hardcoded credentials in Wallstreet Suite TRM 7.4.83 (64-bit edition) with higher privilege than the average authenticated user. NOTE: the vendor disputes this because the password is not hardcoded (it can be changed during installation or at any later time).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:L/A:N/C:H/I:N/PR:L/S:U/UI:N
version: 3.1
Published: 2021-10-15T15:39:00.000Z
CVE-2021-41322 
Poly VVX 400/410 5.3.1 allows low-privileged users to change the Admin password by modifying a POST parameter to 120 during the password reset process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-04T05:52:06.000Z
CVE-2021-41323 
Directory traversal in the Compress feature in Pydio Cells 2.2.9 allows remote authenticated users to overwrite personal files, or Cells files belonging to any user, via the format parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-30T18:48:46.000Z
CVE-2021-41324 
Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal files (or Cells files belonging to any user) via the nodes parameter (for Copy and Move) or via the Path parameter (for Delete).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-30T20:39:57.000Z
CVE-2021-41325 
Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter. (In addition, such users can be granted several admin permissions via the Roles parameter.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-30T18:52:32.000Z
CVE-2021-41326 
In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-17T00:00:00.000Z
CVE-2021-41329 
Datalust Seq before 2021.2.6259 allows users (with view filters applied to their accounts) to see query results not constrained by their view filter. This information exposure, caused by an internal cache key collision, occurs when the user's view filter includes an array or IN clause, and when another user has recently executed an identical query differing only by the array elements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-27T05:45:31.000Z
CVE-2021-41330 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Windows 10 Version 1809
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2237:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2237:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2237:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server 2019
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2237:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2237:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 1909
cpes: cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1854:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1854:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.18363.1854:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows 10 Version 21H1
cpes: cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1288:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1288:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1288:*:*:*:*:*:x86:*
vendor: Microsoft
product: Windows 10 Version 2004
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.19041.1288:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:10.0.19041.1288:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 20H2
cpes: cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1288:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1288:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:10.0.19042.1288:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-10-13T00:27:43.000Z
CVE-2021-41334 Windows Desktop Bridge Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Windows 10 Version 21H1
cpes: cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1288:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1288:*:*:*:*:*:x86:*
vendor: Microsoft
product: Windows Server 2022
cpes: cpe:2.3:o:microsoft:windows_server_2022:10.0.20348.288:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 2004
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.19041.1288:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:10.0.19041.1288:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 20H2
cpes: cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1288:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1288:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:10.0.19042.1288:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 11 version 21H2
cpes: cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.258:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.258:*:*:*:*:*:arm64:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-10-13T00:27:48.000Z
CVE-2021-41336 Windows Kernel Information Disclosure Vulnerability
Problem types: description: Information Disclosure
Affected products: vendor: Microsoft
product: Windows Server 2022
cpes: cpe:2.3:o:microsoft:windows_server_2022:10.0.20348.288:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 11 version 21H2
cpes: cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.258:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.258:*:*:*:*:*:arm64:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Published: 2021-10-13T00:27:51.000Z
CVE-2021-41337 Active Directory Security Feature Bypass Vulnerability
Problem types: description: Security Feature Bypass
Affected products: vendor: Microsoft
product: Windows Server 2019
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2237:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2237:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2022
cpes: cpe:2.3:o:microsoft:windows_server_2022:10.0.20348.288:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:10.0.19041.1288:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:10.0.19042.1288:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2016
cpes: cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4704:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4704:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.9
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
Published: 2021-10-13T00:27:54.000Z