rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-34418 Pre-auth Null pointer crash in on-premise web console
The login routine of the web console in the Zoom On-Premise Meeting Connector before version 4.6.239.20200613, Zoom On-Premise Meeting Connector MMR before version 4.6.239.20200613, Zoom On-Premise Recording Connector before version 3.8.42.20200905, Zoom On-Premise Virtual Room Connector before version 4.4.6344.20200612, and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5492.20200616 fails to validate that a NULL byte was sent while authenticating. This could lead to a crash of the login service.
Problem types: description: Improper Input Validation
Affected products: vendor: Zoom Video Communications Inc
product: Zoom On-Premise Meeting Connector
vendor: Zoom Video Communications Inc
product: Zoom On-Premise Meeting Connector MMR
vendor: Zoom Video Communications Inc
product: Zoom On-Premise Recording Connector
vendor: Zoom Video Communications Inc
product: Zoom On-Premise Virtual Room Connector
vendor: Zoom Video Communications Inc
product: Zoom On-Premise Virtual Room Connector Load Balancer
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Jeremy Brown
Published: 2021-11-11T22:59:47.920Z
CVE-2021-34419 HTML injection in Zoom Linux client
In the Zoom Client for Meetings for Ubuntu Linux before version 5.1.0, there is an HTML injection flaw when sending a remote control request to a user in the process of in-meeting screen sharing. This could allow meeting participants to be targeted for social engineering attacks.
Problem types: description: Improper Encoding or Escaping of Output
Affected products: vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Ubuntu Linux
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Danny de Weille and Rick Verdoes of hackdefense
Published: 2021-11-11T22:59:34.701Z
CVE-2021-34420 Zoom Windows installation executable signature bypass
The Zoom Client for Meetings for Windows installer before version 5.5.4 does not properly verify the signature of files with .msi, .ps1, and .bat extensions. This could lead to a malicious actor installing malicious software on a customer’s computer.
Problem types: description: Improper Verification of Cryptographic Signature
Affected products: vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Windows
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Laurent Delosieres of ManoMano
Published: 2021-11-11T22:59:18.504Z
CVE-2021-34421 Retained exploded messages in Keybase Clients for Android and iOS
The Keybase Client for Android before version 5.8.0 and the Keybase Client for iOS before version 5.8.0 fails to properly remove exploded messages initiated by a user if the receiving user places the chat session in the background while the sending user explodes the messages. This could lead to disclosure of sensitive information which was meant to be deleted from the customer's device.
Problem types: description: Cleartext Storage of Sensitive Information
Affected products: vendor: Zoom Video Communications Inc
product: Keybase Client for Android
vendor: Zoom Video Communications Inc
product: Keybase Client for iOS
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Olivia O'Hara, John Jackson, Jackson Henry, and Robert Willis
Published: 2021-11-11T22:58:37.355Z
CVE-2021-34422 Path traversal of file names in Keybase Client for Windows
The Keybase Client for Windows before version 5.7.0 contains a path traversal vulnerability when checking the name of a file uploaded to a team folder. A malicious user could upload a file to a shared folder with a specially crafted file name which could allow a user to execute an application which was not intended on their host machine. If a malicious user leveraged this issue with the public folder sharing feature of the Keybase client, this could lead to remote code execution.
Problem types: description: Relative Path Traversal
Affected products: vendor: Zoom Video Communications Inc
product: Keybase Client for Windows
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: m4t35z
Published: 2021-11-11T22:58:22.996Z
CVE-2021-34425 Server Side Request Forgery in Zoom Client for Meetings chat
The Zoom Client for Meetings before version 5.7.3 (for Android, iOS, Linux, macOS, and Windows) contain a server side request forgery vulnerability in the chat\'s "link preview" functionality. In versions prior to 5.7.3, if a user were to enable the chat\'s "link preview" feature, a malicious actor could trick the user into potentially sending arbitrary HTTP GET requests to URLs that the actor cannot reach directly.
Problem types: description: Server-Side Request Forgery (SSRF)
Affected products: vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Android
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for iOS
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Linux
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for macOS
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Windows
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Johnny Yu of Walmart Global Tech
Published: 2021-12-14T19:25:59.088Z
CVE-2021-34426 Arbitrary command execution in Keybase Client for Windows
A vulnerability was discovered in the Keybase Client for Windows before version 5.6.0 when a user executed the "keybase git lfs-config" command on the command-line. In versions prior to 5.6.0, a malicious actor with write access to a user\'s Git repository could leverage this vulnerability to potentially execute arbitrary Windows commands on a user\'s local system.
Problem types: description: Untrusted Search Path
Affected products: vendor: Zoom Video Communications Inc
product: Keybase Client for Windows
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: RyotaK (https://blog.ryotak.me/)
Published: 2021-12-14T19:26:03.894Z
CVE-2021-34427 
In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir) to inject JSP code into the running instance.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: The Eclipse Foundation
product: Eclipse BIRT
Published: 2021-06-25T00:00:00.000Z
CVE-2021-34428 
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.
Problem types: cwe_id: CWE-613
description: CWE-613
Affected products: vendor: The Eclipse Foundation
product: Eclipse Jetty
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 2.9
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2021-06-22T14:45:11.000Z
CVE-2021-34429 
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
Problem types: cwe_id: CWE-200
description: CWE-200
cwe_id: CWE-551
description: CWE-551
Affected products: vendor: The Eclipse Foundation
product: Eclipse Jetty
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-07-15T17:00:10.000Z
CVE-2021-34430 
Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the master key and then decrypt DTLS traffic.
Problem types: cwe_id: CWE-338
description: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Affected products: vendor: The Eclipse Foundation
product: Eclipse TinyDTLS
Published: 2021-07-08T03:00:10.000Z
CVE-2021-34431 
In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted CONNECT message to the broker a memory leak would occur, which could be used to provide a DoS attack against the broker.
Problem types: cwe_id: CWE-401
description: CWE-401: Missing Release of Memory after Effective Lifetime
Affected products: vendor: The Eclipse Foundation
product: Eclipse Mosquitto
Credits: lang: en
value: Thanks to Kathrin Kleinhammer of OTARIS Interactive Services GmbH for discovering and reporting this issue.
Published: 2021-07-22T13:45:13.000Z
CVE-2021-34432 
In Eclipse Mosquitto versions 2.07 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: The Eclipse Foundation
product: Eclipse Mosquitto
Published: 2021-07-27T15:25:17.000Z
CVE-2021-34433 
In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side's signature on the client side, if that signature is not included in the server's ServerKeyExchange.
Problem types: cwe_id: CWE-322
description: CWE-322: Key Exchange without Entity Authentication
Affected products: vendor: The Eclipse Foundation
product: Eclipse Californium
Published: 2021-08-20T17:10:10.000Z
CVE-2021-34434 
In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make subscriptions on a topic is revoked when a durable client is offline, then existing subscriptions for that client are not revoked.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: The Eclipse Foundation
product: Eclipse Mosquitto
Published: 2021-08-30T00:00:00.000Z
CVE-2021-34435 
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file..
Problem types: cwe_id: CWE-942
description: CWE-942
Affected products: vendor: The Eclipse Foundation
product: Eclipse Theia
Published: 2021-09-01T17:20:09.000Z
CVE-2021-34436 
In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extension uses lsp4xml (recently renamed to LemMinX) in order to provide language support for XML. This is installed by default.
Problem types: cwe_id: CWE-611
description: CWE-611
cwe_id: CWE-22
description: CWE-22
Affected products: vendor: The Eclipse Foundation
product: Eclipse Theia
Published: 2021-09-02T20:55:10.000Z
CVE-2021-34438 Windows Font Driver Host Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Windows 10 Version 1809
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2061:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2061:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2061:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server 2019
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2061:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2061:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 1909
cpes: cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1679:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1679:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.18363.1679:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows 10 Version 21H1
cpes: cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1110:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1110:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1110:*:*:*:*:*:x86:*
vendor: Microsoft
product: Windows 10 Version 2004
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.19041.1110:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:10.0.19041.1110:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 20H2
cpes: cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1110:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1110:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:10.0.19042.1110:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-07-16T20:19:31.000Z
CVE-2021-34439 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Windows 10 Version 1507
cpes: cpe:2.3:o:microsoft:windows_10_1507:10.0.10240.19003:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1507:10.0.10240.19003:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows 10 Version 1607
cpes: cpe:2.3:o:microsoft:windows_10_1607:10.0.14393.4530:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1607:10.0.14393.4530:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2016
cpes: cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4530:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4530:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-07-16T20:19:32.000Z
CVE-2021-34442 Windows DNS Server Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Windows Server 2019
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2061:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2061:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:10.0.19041.1110:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:10.0.19042.1110:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2016
cpes: cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4530:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4530:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2008 Service Pack 2
cpes: cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.21167:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2008 Service Pack 2 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.21167:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.21167:*:*:*:*:*:x86:*
vendor: Microsoft
product: Windows Server 2008  Service Pack 2
cpes: cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.21167:*:*:*:*:*:x86:*
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1
cpes: cpe:2.3:o:microsoft:windows_server_2008_R2:6.1.7601.25661:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2008_R2:6.1.7601.25661:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2012
cpes: cpe:2.3:o:microsoft:windows_server_2012:6.2.9200.23409:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2012:6.2.9200.23409:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2012 R2
cpes: cpe:2.3:o:microsoft:windows_server_2012_R2:6.3.9600.20069:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2012_R2:6.3.9600.20069:*:*:*:*:*:x64:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-07-16T20:19:34.000Z
CVE-2021-34444 Windows DNS Server Denial of Service Vulnerability
Problem types: description: Denial of Service
Affected products: vendor: Microsoft
product: Windows Server 2019
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2061:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2061:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:10.0.19041.1110:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:10.0.19042.1110:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2016
cpes: cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4530:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4530:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2008 Service Pack 2
cpes: cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.21167:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2008 Service Pack 2 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.21167:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.21167:*:*:*:*:*:x86:*
vendor: Microsoft
product: Windows Server 2008  Service Pack 2
cpes: cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.21167:*:*:*:*:*:x86:*
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1
cpes: cpe:2.3:o:microsoft:windows_server_2008_R2:6.1.7601.25661:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2008_R2:6.1.7601.25661:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2012
cpes: cpe:2.3:o:microsoft:windows_server_2012:6.2.9200.23409:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2012:6.2.9200.23409:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2012 R2
cpes: cpe:2.3:o:microsoft:windows_server_2012_R2:6.3.9600.20069:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2012_R2:6.3.9600.20069:*:*:*:*:*:x64:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Published: 2021-07-16T20:19:35.000Z
CVE-2021-34445 Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Windows 10 Version 1809
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2061:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2061:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2061:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server 2019
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2061:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2061:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 1909
cpes: cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1679:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1679:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.18363.1679:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows 10 Version 21H1
cpes: cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1110:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1110:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1110:*:*:*:*:*:x86:*
vendor: Microsoft
product: Windows 10 Version 2004
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.19041.1110:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:10.0.19041.1110:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 20H2
cpes: cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1110:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1110:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:10.0.19042.1110:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-07-16T20:19:36.000Z