rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-36195 
Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, and 6.1.0 through 6.1.2 may allow an authenticated attacker to execute arbitrary commands on the underlying system shell via specially crafted command arguments.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiWeb
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: HIGH
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 4
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C
version: 3.1
Published: 2021-12-08T18:14:55.000Z
CVE-2021-36198 Entrapass
Successful exploitation of this vulnerability could allow an unauthorized user to access sensitive data.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Johnson Controls
product: Entrapass
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2021-12-06T16:54:42.792Z
CVE-2021-36199 VideoEdge
Running a vulnerability scanner against VideoEdge NVRs can cause some functionality to stop.
Problem types: cwe_id: CWE-228
description: CWE-228: Improper Handling of Syntactically Invalid Structure
Affected products: vendor: Johnson Controls
product: VideoEdge
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2022-01-14T19:10:42.869Z
CVE-2021-36200 Metasys ADS/ADX/OAS with MUI
Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Johnson Controls
product: Metasys ADS/ADX/OAS server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Alessandro Bosco, Luca Di Giuseppe, Stefano Scipioni, and Massimiliano Brolli of TIM Security Red Team Research
Published: 2022-07-22T14:55:52.577Z
CVE-2021-36201 CCURE Observable Response Discrepancy
Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions.
Problem types: cwe_id: CWE-204
description: CWE-204: Observable Response Discrepancy
Affected products: vendor: Johnson Controls
product: C•CURE 9000
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Kim Syversen and Mathias Kjølleberg Førland reported this vulnerability to Johnson Controls
Published: 2022-10-11T20:17:42.951Z
CVE-2021-36202 Metasys UI
Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature. This issue affects: Johnson Controls Metasys All 10 versions versions prior to 10.1.5; All 11 versions versions prior to 11.0.2.
Problem types: cwe_id: CWE-918
description: CWE-918: Server-Side Request Forgery (SSRF)
Affected products: vendor: Johnson Controls
product: Metasys
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Tony West
Published: 2022-04-07T19:12:48.421Z
CVE-2021-36203 Johnson Controls Metasys SCT Pro
The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Johnnson Controls
product: Metasys System Configuration Tool (SCT)
vendor: Johnnson Controls
product: Metasys System Configuration Tool Pro (SCT Pro)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Tony West and Scott Ponte reported this vulnerability to Johnson Controls. Johnson Controls reported this vulnerability to CISA.
Published: 2022-04-22T14:44:10.638Z
CVE-2021-36204 Insufficiently Protected Credentials in Metasys 
Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.3 allows API calls to expose credentials in plain text.
Problem types: cwe_id: CWE-522
description: CWE-522: Insufficiently Protected Credentials
Affected products: vendor: Johnson Controls
product: Metasys ADS/ADX/OAS
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Published: 2023-01-13T00:00:00.000Z
CVE-2021-36205 Metasys session token
Under certain circumstances the session token is not cleared on logout.
Problem types: cwe_id: CWE-459
description: CWE-459: Incomplete Cleanup
Affected products: vendor: Johnson Controls
product: Metasys
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-04-15T16:24:48.570Z
CVE-2021-36206 CEVAS
All versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication and retrieve data with specially crafted SQL queries.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Johnson Controls
product: CEVAS
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 10
baseSeverity: CRITICAL
Credits: lang: en
value: Christian Vierschilling and Caroline Moesler reported this vulnerability to Johnson Controls, Inc.
Published: 2022-10-28T01:17:27.885Z
CVE-2021-36207 Metasys privilege management
Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated user to elevate their privileges to administrator.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: Johnson Controls
product: Metasys ADS/ADX/OAS server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-04-29T16:39:14.893Z
CVE-2021-36209 
In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-06T13:19:25.000Z
CVE-2021-36212 
app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-07T12:34:24.000Z
CVE-2021-36213 
HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-17T17:32:36.000Z
CVE-2021-36214 
LINE client for iOS before 10.16.3 allows cross site script with specific header in WebView.
Problem types: description: Improper Neutralization of Input During Web Page Generation (CWE-79)
Affected products: vendor: LINE Corporation
product: LINE client for iOS
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
exploitCodeMaturity: NOT_DEFINED
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
temporalScore: 6.1
temporalSeverity: MEDIUM
confidentialityRequirement: NOT_DEFINED
integrityRequirement: NOT_DEFINED
availabilityRequirement: NOT_DEFINED
modifiedAttackVector: NETWORK
modifiedAttackComplexity: LOW
modifiedPrivilegesRequired: NONE
modifiedUserInteraction: REQUIRED
modifiedScope: CHANGED
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: LOW
modifiedAvailabilityImpact: NONE
environmentalScore: 6.1
environmentalSeverity: MEDIUM
Published: 2021-07-13T17:47:37.000Z
CVE-2021-36215 
LINE client for iOS 10.21.3 and before allows address bar spoofing due to inappropriate address handling.
Problem types: description: n/a
Affected products: vendor: LINE Corporation
product: LINE client for iOS
Published: 2021-09-08T17:50:43.000Z
CVE-2021-36216 
LINE for Windows 6.2.1.2289 and before allows arbitrary code execution via malicious DLL injection.
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: LINE Corporation
product: LINE for Windows
Published: 2021-09-08T17:50:44.000Z
CVE-2021-36218 
An issue was discovered in SKALE sgxwallet 1.58.3. sgx_disp_ippsAES_GCMEncrypt allows an out-of-bounds write, resulting in a segfault and compromised enclave. This issue describes a buffer overflow, which was resolved prior to v1.77.0 and not reproducible in latest sgxwallet v1.77.0
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-27T13:26:27.000Z
CVE-2021-36219 
An issue was discovered in SKALE sgxwallet 1.58.3. The provided input for ECALL 14 triggers a branch in trustedEcdsaSign that frees a non-initialized pointer from the stack. An attacker can chain multiple enclave calls to prepare a stack that contains a valid address. This address is then freed, resulting in compromised integrity of the enclave. This was resolved after v1.58.3 and not reproducible in sgxwallet v1.77.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-27T13:22:28.000Z
CVE-2021-36221 
Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-08T00:00:00.000Z
CVE-2021-36222 
ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T17:28:47.000Z
CVE-2021-36224 
Western Digital My Cloud devices before OS5 have a nobody account with a blank password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-06T00:00:00.000Z
CVE-2021-36225 
Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-06T00:00:00.000Z
CVE-2021-36226 
Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-06T00:00:00.000Z
CVE-2021-36230 
HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API requests executed using the run token, allowing privilege escalation to organization owner. Fixed in v202107-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-20T20:53:26.000Z
CVE-2021-36231 
Deserialization of untrusted data in multiple functions in MIK.starlight 7.9.5.24363 allows authenticated remote attackers to execute operating system commands by crafting serialized objects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-31T17:41:20.000Z
CVE-2021-36232 
Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-31T17:37:53.000Z
CVE-2021-36233 
The function AdminGetFirstFileContentByFilePath in MIK.starlight 7.9.5.24363 allows (by design) an authenticated attacker to read arbitrary files from the filesystem by specifying the file path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-31T17:50:00.000Z
CVE-2021-36234 
Use of a hard-coded cryptographic key in MIK.starlight 7.9.5.24363 allows local users to decrypt credentials via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-31T17:45:38.000Z
CVE-2021-36235 
An issue was discovered in Ivanti Workspace Control before 10.6.30.0. A locally authenticated user with low privileges can bypass File and Folder Security by leveraging an unspecified attack vector. As a result, the attacker can start applications with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-01T00:19:28.000Z
CVE-2021-36260 
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-22T12:07:55.000Z
CVE-2021-36276 
Dell DBUtilDrv2.sys driver (versions 2.5 and 2.6) contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: Dell
product: dbutil
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-08-09T21:05:33.040Z
CVE-2021-36277 
Dell Command | Update, Dell Update, and Alienware Update versions before 4.3 contains an Improper Verification of Cryptographic Signature Vulnerability. A local authenticated malicious user may exploit this vulnerability by executing arbitrary code on the system.
Problem types: cwe_id: CWE-347
description: CWE-347: Improper Verification of Cryptographic Signature
Affected products: vendor: Dell
product: Alienware Command Center (AWCC)
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-08-09T21:05:34.537Z
CVE-2021-36278 
Dell EMC PowerScale OneFS versions 8.2.x, 9.1.0.x, and 9.1.1.1 contain a sensitive information exposure vulnerability in log files. A local malicious user with ISI_PRIV_LOGIN_SSH, ISI_PRIV_LOGIN_CONSOLE, or ISI_PRIV_SYS_SUPPORT privileges may exploit this vulnerability to access sensitive information. If any third-party consumes those logs, the same sensitive information is available to those systems as well.
Problem types: cwe_id: CWE-532
description: CWE-532: Information Exposure Through Log Files
Affected products: vendor: Dell
product: PowerScale OneFS
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-08-16T22:00:29.902Z
CVE-2021-36279 
Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. This could allow a user with ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOGIN_CONSOLE to access privileged information about the cluster.
Problem types: cwe_id: CWE-732
description: CWE-732: Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Dell
product: PowerScale OneFS
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-08-16T22:00:31.572Z
CVE-2021-36280 
Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. This could allow a user with ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOGIN_CONSOLE to access privileged information about the cluster.
Problem types: cwe_id: CWE-732
description: CWE-732: Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Dell
product: PowerScale OneFS
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-08-16T22:00:33.151Z
CVE-2021-36281 
Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment vulnerability. A low privileged authenticated user can potentially exploit this vulnerability to escalate privileges.
Problem types: description: Other
Affected products: vendor: Dell
product: PowerScale OneFS
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-08-16T22:00:34.701Z
CVE-2021-36282 
Dell EMC PowerScale OneFS versions 8.2.x - 9.1.0.x contain a use of uninitialized resource vulnerability. This can potentially allow an authenticated user with ISI_PRIV_LOGIN_CONSOLE or ISI_PRIV_LOGIN_SSH privileges to gain access up to 24 bytes of data within the /ifs kernel stack under certain conditions.
Problem types: description: Other
Affected products: vendor: Dell
product: PowerScale OneFS
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-08-16T22:00:36.320Z
CVE-2021-36283 
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Dell
product: CPG BIOS
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-09-28T19:20:22.857Z
CVE-2021-36284 
Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive admin password attempt mitigations in order to carry out a brute force attack.
Problem types: cwe_id: CWE-307
description: CWE-307: Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: Dell
product: CPG BIOS
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2021-09-28T19:20:24.352Z
CVE-2021-36285 
Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive NVMe password attempt mitigations in order to carry out a brute force attack.
Problem types: cwe_id: CWE-307
description: CWE-307: Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: Dell
product: CPG BIOS
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2021-09-28T19:20:25.870Z