rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-43175 
The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly, allowing the caller to specify any values for these parameters and successfully authenticate. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
Problem types: cwe_id: CWE-305
description: CWE-305: Authentication Bypass by Primary Weakness
Affected products: vendor: GOautodial
product: GOautodial API
Published: 2021-12-07T17:25:11.000Z
CVE-2021-43176 
The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the action. This permits an attacker to execute any PHP source file with a .php extension that is present on the disk and readable by the GOautodial web server process. Combined with CVE-2021-43175, it is possible for the attacker to do this without valid credentials. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Problem types: cwe_id: CWE-23
description: CWE-23: Relative Path Traversal
Affected products: vendor: GOautodial
product: GOautodial API
Published: 2021-12-07T17:26:38.000Z
CVE-2021-43177 
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Problem types: cwe_id: CWE-254
description: CWE-254: 7PK - Security Features
Affected products: vendor: Tinfoil
product: devise-two-factor
Published: 2022-04-11T19:37:40.000Z
CVE-2021-43180 
In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T15:08:09.000Z
CVE-2021-43181 
In JetBrains Hub before 2021.1.13690, stored XSS is possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T15:06:12.000Z
CVE-2021-43182 
In JetBrains Hub before 2021.1.13415, a DoS via user information is possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T15:07:18.000Z
CVE-2021-43183 
In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:53:44.000Z
CVE-2021-43184 
In JetBrains YouTrack before 2021.3.21051, stored XSS is possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:33:39.000Z
CVE-2021-43185 
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:32:04.000Z
CVE-2021-43186 
JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:25:45.000Z
CVE-2021-43187 
In JetBrains YouTrack Mobile before 2021.2, the client-side cache on iOS could contain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:40:27.000Z
CVE-2021-43188 
In JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:39:26.000Z
CVE-2021-43189 
In JetBrains YouTrack Mobile before 2021.2, access token protection on Android is incomplete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:38:26.000Z
CVE-2021-43190 
In JetBrains YouTrack Mobile before 2021.2, task hijacking on Android is possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:37:35.000Z
CVE-2021-43191 
JetBrains YouTrack Mobile before 2021.2, is missing the security screen on Android and iOS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:35:23.000Z
CVE-2021-43192 
In JetBrains YouTrack Mobile before 2021.2, iOS URL scheme hijacking is possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:36:35.000Z
CVE-2021-43193 
In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:49:47.000Z
CVE-2021-43194 
In JetBrains TeamCity before 2021.1.2, user enumeration was possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:50:27.000Z
CVE-2021-43195 
In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:47:54.000Z
CVE-2021-43196 
In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:49:00.000Z
CVE-2021-43197 
In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:47:11.000Z
CVE-2021-43198 
In JetBrains TeamCity before 2021.1.2, stored XSS is possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:44:54.000Z
CVE-2021-43199 
In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:46:19.000Z
CVE-2021-43200 
In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:43:31.000Z
CVE-2021-43201 
In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:41:19.000Z
CVE-2021-43202 
In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-30T15:21:24.000Z
CVE-2021-43203 
In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T14:52:23.000Z
CVE-2021-43204 
A improper control of a resource through its lifetime in Fortinet FortiClientWindows version 6.4.1 and 6.4.0, version 6.2.9 and below, version 6.0.10 and below allows attacker to cause a complete denial of service of its components via changes of directory access permissions.
Problem types: description: Denial of service
Affected products: vendor: Fortinet
product: Fortinet FortiClientWindows
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
exploitCodeMaturity: FUNCTIONAL
integrityImpact: NONE
privilegesRequired: HIGH
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 4.1
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C
version: 3.1
Published: 2021-12-09T09:04:29.000Z
CVE-2021-43205 
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Linux version 7.0.2 and below, 6.4.7 and below and 6.2.9 and below may allow an unauthenticated attacker to access the confighandler webserver via external binaries.
Problem types: description: Improper access control
Affected products: vendor: Fortinet
product: Fortinet FortiClientLinux
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: NOT_DEFINED
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: WORKAROUND
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 4.2
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:W/RC:C
version: 3.1
Published: 2022-04-06T09:15:36.000Z
CVE-2021-43206 
A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x and FortiProxy 7.0.0 through 7.0.1, 2.0.x allows malicious webservers to retrieve a web proxy's client username and IP via same origin HTTP requests triggering proxy-generated HTTP status codes pages.
Problem types: description: Information disclosure
Affected products: vendor: Fortinet
product: Fortinet FortiOS, FortiProxy
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 4.1
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:U/RC:C
version: 3.1
Published: 2022-05-04T15:25:26.000Z
CVE-2021-43208 3D Viewer Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: 3D Viewer
cpes: cpe:2.3:a:microsoft:3d_viewer:-:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-11-10T00:47:48.000Z
CVE-2021-43209 3D Viewer Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: 3D Viewer
cpes: cpe:2.3:a:microsoft:3d_viewer:-:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-11-10T00:47:49.000Z
CVE-2021-43211 Windows 10 Update Assistant Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Windows Update Assistant
cpes: cpe:2.3:a:microsoft:windows_10_update_assistant:-:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Published: 2021-11-24T01:05:14.000Z
CVE-2021-43214 Web Media Extensions Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Raw Image Extension
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-12-15T14:15:04.000Z
CVE-2021-43219 DirectX Graphics Kernel File Denial of Service Vulnerability
Problem types: description: Denial of Service
Affected products: vendor: Microsoft
product: Windows 10 Version 1809
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2366:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2366:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2366:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server 2019
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2366:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2366:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 1909
cpes: cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1977:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1977:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.18363.1977:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows 10 Version 21H1
cpes: cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1415:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1415:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1415:*:*:*:*:*:x86:*
vendor: Microsoft
product: Windows Server 2022
cpes: cpe:2.3:o:microsoft:windows_server_2022:10.0.20348.405:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 2004
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.19041.1415:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:10.0.19041.1415:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 20H2
cpes: cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1415:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1415:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:10.0.19042.1415:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 11 version 21H2
cpes: cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.376:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.376:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows 10 Version 21H2
cpes: cpe:2.3:o:microsoft:windows_10_21H2:10.0.19044.1415:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21H2:10.0.19044.1415:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21H2:10.0.19044.1415:*:*:*:*:*:x64:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.4
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C
Published: 2021-12-15T14:15:08.000Z
CVE-2021-43220 Microsoft Edge for iOS Spoofing Vulnerability
Problem types: description: Spoofing
Affected products: vendor: Microsoft
product: Microsoft Edge for iOS
cpes: cpe:2.3:a:microsoft:edge:*:*:*:*:*:iphone_os:*:*
CVSS v3.1: version: 3.1
baseSeverity: LOW
baseScore: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
Published: 2021-11-24T01:05:15.000Z
CVE-2021-43221 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Edge (Chromium-based)
cpes: cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.2
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
Published: 2021-11-24T01:05:16.000Z
CVE-2021-43225 Bot Framework SDK Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Bot Framework SDK for .NET Framework
cpes: cpe:2.3:a:microsoft:bot_framework_software_development_kit:-:*:*:*:*:.net_framework:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Published: 2021-12-15T14:15:11.000Z
CVE-2021-43227 Storage Spaces Controller Information Disclosure Vulnerability
Problem types: description: Information Disclosure
Affected products: vendor: Microsoft
product: Windows 10 Version 1809
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2366:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2366:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2366:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server 2019
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2366:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2366:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 1909
cpes: cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1977:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1977:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.18363.1977:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows 10 Version 21H1
cpes: cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1415:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1415:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1415:*:*:*:*:*:x86:*
vendor: Microsoft
product: Windows Server 2022
cpes: cpe:2.3:o:microsoft:windows_server_2022:10.0.20348.405:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 2004
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.19041.1415:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:10.0.19041.1415:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 20H2
cpes: cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1415:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1415:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:10.0.19042.1415:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 11 version 21H2
cpes: cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.376:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.376:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows 10 Version 21H2
cpes: cpe:2.3:o:microsoft:windows_10_21H2:10.0.19044.1415:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21H2:10.0.19044.1415:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21H2:10.0.19044.1415:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows 10 Version 1507
cpes: cpe:2.3:o:microsoft:windows_10_1507:10.0.10240.19145:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1507:10.0.10240.19145:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows 10 Version 1607
cpes: cpe:2.3:o:microsoft:windows_10_1607:10.0.14393.4825:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1607:10.0.14393.4825:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2016
cpes: cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4825:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4825:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Published: 2021-12-15T14:15:12.000Z
CVE-2021-43228 SymCrypt Denial of Service Vulnerability
Problem types: description: Denial of Service
Affected products: vendor: Microsoft
product: Windows 10 Version 1809
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2366:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2366:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2366:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server 2019
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2366:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2366:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 1909
cpes: cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1977:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1977:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.18363.1977:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows 10 Version 21H1
cpes: cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1415:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1415:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1415:*:*:*:*:*:x86:*
vendor: Microsoft
product: Windows Server 2022
cpes: cpe:2.3:o:microsoft:windows_server_2022:10.0.20348.405:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 2004
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.19041.1415:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:10.0.19041.1415:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 20H2
cpes: cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1415:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1415:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:10.0.19042.1415:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 11 version 21H2
cpes: cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.376:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.376:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows 10 Version 21H2
cpes: cpe:2.3:o:microsoft:windows_10_21H2:10.0.19044.1415:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21H2:10.0.19044.1415:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21H2:10.0.19044.1415:*:*:*:*:*:x64:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Published: 2021-12-15T14:15:13.000Z
CVE-2021-43231 Windows NTFS Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Windows 10 Version 1809
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2366:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2366:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2366:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server 2019
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2366:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2366:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 1909
cpes: cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1977:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1977:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.18363.1977:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows 10 Version 21H1
cpes: cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1415:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1415:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1415:*:*:*:*:*:x86:*
vendor: Microsoft
product: Windows Server 2022
cpes: cpe:2.3:o:microsoft:windows_server_2022:10.0.20348.405:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 2004
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.19041.1415:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:10.0.19041.1415:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 20H2
cpes: cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1415:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1415:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:10.0.19042.1415:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 11 version 21H2
cpes: cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.376:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.376:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows 10 Version 21H2
cpes: cpe:2.3:o:microsoft:windows_10_21H2:10.0.19044.1415:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21H2:10.0.19044.1415:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21H2:10.0.19044.1415:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows 10 Version 1607
cpes: cpe:2.3:o:microsoft:windows_10_1607:10.0.14393.4825:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1607:10.0.14393.4825:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2016
cpes: cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4825:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4825:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-12-15T14:15:16.000Z