rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-44189 Adobe After Effects JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability
Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an Use-After-Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: Adobe
product: After Effects
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
availabilityRequirement: NOT_DEFINED
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
confidentialityRequirement: NOT_DEFINED
environmentalScore: 3.3
environmentalSeverity: LOW
exploitCodeMaturity: NOT_DEFINED
integrityImpact: NONE
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: LOCAL
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: NONE
modifiedPrivilegesRequired: NONE
modifiedScope: NOT_DEFINED
modifiedUserInteraction: REQUIRED
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 3.3
temporalSeverity: LOW
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-09-07T13:05:44.137Z
CVE-2021-44190 Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read (CWE-125)
Affected products: vendor: Adobe
product: After Effects
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
availabilityRequirement: NOT_DEFINED
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
confidentialityRequirement: NOT_DEFINED
environmentalScore: 3.3
environmentalSeverity: LOW
exploitCodeMaturity: NOT_DEFINED
integrityImpact: NONE
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: LOCAL
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: NONE
modifiedPrivilegesRequired: NONE
modifiedScope: NOT_DEFINED
modifiedUserInteraction: REQUIRED
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 3.3
temporalSeverity: LOW
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-09-07T13:05:40.140Z
CVE-2021-44191 Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read (CWE-125)
Affected products: vendor: Adobe
product: After Effects
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
availabilityRequirement: NOT_DEFINED
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
confidentialityRequirement: NOT_DEFINED
environmentalScore: 3.3
environmentalSeverity: LOW
exploitCodeMaturity: NOT_DEFINED
integrityImpact: NONE
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: LOCAL
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: NONE
modifiedPrivilegesRequired: NONE
modifiedScope: NOT_DEFINED
modifiedUserInteraction: REQUIRED
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 3.3
temporalSeverity: LOW
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-09-07T13:05:38.103Z
CVE-2021-44192 Adobe After Effects MOV File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read (CWE-125)
Affected products: vendor: Adobe
product: After Effects
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
availabilityRequirement: NOT_DEFINED
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
confidentialityRequirement: NOT_DEFINED
environmentalScore: 3.3
environmentalSeverity: LOW
exploitCodeMaturity: NOT_DEFINED
integrityImpact: NONE
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: LOCAL
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: NONE
modifiedPrivilegesRequired: NONE
modifiedScope: NOT_DEFINED
modifiedUserInteraction: REQUIRED
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 3.3
temporalSeverity: LOW
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-09-07T13:05:40.904Z
CVE-2021-44193 Adobe After Effects MOV File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read (CWE-125)
Affected products: vendor: Adobe
product: After Effects
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
availabilityRequirement: NOT_DEFINED
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
confidentialityRequirement: NOT_DEFINED
environmentalScore: 3.3
environmentalSeverity: LOW
exploitCodeMaturity: NOT_DEFINED
integrityImpact: NONE
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: LOCAL
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: NONE
modifiedPrivilegesRequired: NONE
modifiedScope: NOT_DEFINED
modifiedUserInteraction: REQUIRED
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 3.3
temporalSeverity: LOW
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-09-07T13:05:44.912Z
CVE-2021-44194 Adobe After Effects 3GP File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read (CWE-125)
Affected products: vendor: Adobe
product: After Effects
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
availabilityRequirement: NOT_DEFINED
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
confidentialityRequirement: NOT_DEFINED
environmentalScore: 3.3
environmentalSeverity: LOW
exploitCodeMaturity: NOT_DEFINED
integrityImpact: NONE
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: LOCAL
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: NONE
modifiedPrivilegesRequired: NONE
modifiedScope: NOT_DEFINED
modifiedUserInteraction: REQUIRED
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 3.3
temporalSeverity: LOW
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-09-07T13:05:42.580Z
CVE-2021-44195 Adobe After Effects JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read (CWE-125)
Affected products: vendor: Adobe
product: After Effects
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
availabilityRequirement: NOT_DEFINED
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
confidentialityRequirement: NOT_DEFINED
environmentalScore: 3.3
environmentalSeverity: LOW
exploitCodeMaturity: NOT_DEFINED
integrityImpact: NONE
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: LOCAL
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: NONE
modifiedPrivilegesRequired: NONE
modifiedScope: NOT_DEFINED
modifiedUserInteraction: REQUIRED
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 3.3
temporalSeverity: LOW
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-09-07T13:05:43.343Z
CVE-2021-44196 XSS in UBIT Information Technologies Student Information Management System
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in UBIT Information Technologies Student Information Management System.

This issue affects Student Information Management System: before 20211126.
Problem types: cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: UBIT Information Technologies
product: Student Information Management System
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Credits: lang: en
value: Oğuzhan KARA
Published: 2023-03-07T13:07:00.764Z
CVE-2021-44197 XSS in UBIT Information Technologies Student Information Management System
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in UBIT Information Technologies Student Information Management System.

This issue affects Student Information Management System: before 20211126.
Problem types: cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: UBIT Information Technologies
product: Student Information Management System
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Credits: lang: en
value: Oğuzhan KARA
Published: 2023-03-07T13:07:38.175Z
CVE-2021-44198 DLL hijacking could lead to local privilege escalation
DLL hijacking could lead to local privilege escalation. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: Acronis
product: Acronis Cyber Protect 15
Credits: lang: en
value: @vanitas (https://hackerone.com/vanitas)
lang: en
value: @vasebur (https://hackerone.com/vasebur)
lang: en
value: @mmg (https://hackerone.com/mmg)
Published: 2021-11-29T18:18:56.612Z
CVE-2021-44199 DLL hijacking could lead to denial of service
DLL hijacking could lead to denial of service. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27305, Acronis Cyber Protect Home Office (Windows) before build 39612
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: Acronis
product: Acronis Cyber Protect 15
vendor: Acronis
product: Acronis Agent
vendor: Acronis
product: Acronis Cyber Protect Home Office
Published: 2021-11-29T18:19:12.590Z
CVE-2021-44200 Self cross-site scripting (XSS) was possible on devices page
Self cross-site scripting (XSS) was possible on devices page. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Acronis
product: Acronis Cyber Protect 15
vendor: Acronis
product: Acronis Cyber Protect 15
Credits: lang: en
value: @mr-medi (https://hackerone.com/mr-medi)
Published: 2021-11-29T18:19:18.256Z
CVE-2021-44201 Cross-site scripting (XSS) was possible in notification pop-ups
Cross-site scripting (XSS) was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Acronis
product: Acronis Cyber Protect 15
vendor: Acronis
product: Acronis Cyber Protect 15
Credits: lang: en
value: @quadrant (https://hackerone.com/quadrant)
Published: 2021-11-29T18:18:51.474Z
CVE-2021-44202 Stored cross-site scripting (XSS) was possible in activity details
Stored cross-site scripting (XSS) was possible in activity details. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Acronis
product: Acronis Cyber Protect 15
vendor: Acronis
product: Acronis Cyber Protect 15
Credits: lang: en
value: @emircuneyt_a (https://hackerone.com/emircuneyt_a)
Published: 2021-11-29T18:19:06.652Z
CVE-2021-44203 Stored cross-site scripting (XSS) was possible in protection plan details
Stored cross-site scripting (XSS) was possible in protection plan details. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Acronis
product: Acronis Cyber Protect 15
vendor: Acronis
product: Acronis Cyber Protect 15
Credits: lang: en
value: @frankiexote (https://hackerone.com/frankiexote)
Published: 2021-11-29T18:19:01.156Z
CVE-2021-44204 Local privilege escalation via named pipe due to improper access control checks
Local privilege escalation via named pipe due to improper access control checks. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27147, Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: Acronis
product: Acronis Cyber Protect 15
vendor: Acronis
product: Acronis Agent
vendor: Acronis
product: Acronis Cyber Protect Home Office
vendor: Acronis
product: Acronis True Image 2021
Credits: lang: en
value: @xnand (https://hackerone.com/xnand)
Published: 2022-02-04T22:29:33.071Z
CVE-2021-44205 Local privilege escalation due to DLL hijacking vulnerability
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: Acronis
product: Acronis Cyber Protect Home Office
vendor: Acronis
product: Acronis True Image 2021
Credits: lang: en
value: @xdanes09 (https://hackerone.com/xdanes09)
Published: 2022-02-04T22:29:31.627Z
CVE-2021-44206 Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service
Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: Acronis
product: Acronis Cyber Protect Home Office
vendor: Acronis
product: Acronis True Image 2021
Credits: lang: en
value: @xdanes09 (https://hackerone.com/xdanes09)
Published: 2022-02-04T22:29:33.897Z
CVE-2021-44207 
Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-21T17:45:33.000Z
CVE-2021-44208 
OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T00:55:19.000Z
CVE-2021-44209 
OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T00:57:11.000Z
CVE-2021-44210 
OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T00:59:16.000Z
CVE-2021-44211 
OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T01:01:07.000Z
CVE-2021-44212 
OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T01:03:46.000Z
CVE-2021-44213 
OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T01:06:11.000Z
CVE-2021-44215 
Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an unspecified impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-07T14:43:39.000Z
CVE-2021-44216 
Northern.tech CFEngine Enterprise before 3.15.5 and 3.18.x before 3.18.1 has Insecure Permissions that may allow unauthorized local users to access the Apache and Mission Portal log files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-07T14:43:32.000Z
CVE-2021-44217 
In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-18T15:00:55.000Z
CVE-2021-44219 
Gin-Vue-Admin before 2.4.6 mishandles a SQL database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-24T22:49:15.000Z
CVE-2021-44221 
A vulnerability has been identified in SIMATIC eaSie Core Package (All versions < V22.00). The affected systems do not properly validate input that is sent to the underlying message passing framework. This could allow an remote attacker to trigger a denial of service of the affected system.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Siemens
product: SIMATIC eaSie Core Package
Published: 2022-07-12T10:06:29.000Z
CVE-2021-44222 
A vulnerability has been identified in SIMATIC eaSie Core Package (All versions < V22.00). The underlying MQTT service of affected systems does not perform authentication in the default configuration. This could allow an unauthenticated remote attacker to send arbitrary messages to the service and thereby issue arbitrary requests in the affected system.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Siemens
product: SIMATIC eaSie Core Package
Published: 2022-07-12T10:06:30.000Z
CVE-2021-44223 
WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2021-11-25T14:51:19.000Z
CVE-2021-44224 Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
Credits: lang: en
value: 漂亮鼠
lang: en
value: TengMA(@Te3t123)
Published: 2021-12-20T11:20:13.000Z
CVE-2021-44225 
In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable (writable) property
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-26T00:00:00.000Z
CVE-2021-44226 
Razer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on %PROGRAMDATA%\Razer\Synapse3\Service\bin even if %PROGRAMDATA%\Razer has been created by any unprivileged user before Synapse is installed. The unprivileged user may have placed Trojan horse DLLs there.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T00:00:00.000Z
CVE-2021-44227 
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-02T02:52:31.000Z