rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-43892 Microsoft BizTalk ESB Toolkit Spoofing Vulnerability
Problem types: description: Spoofing
Affected products: vendor: Microsoft
product: Microsoft BizTalk ESB Toolkit 2.2
cpes: cpe:2.3:a:microsoft:biztalk_esb_toolkit:2.2:*:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft BizTalk ESB Toolkit 2.4
cpes: cpe:2.3:a:microsoft:biztalk_esb_toolkit:2.4:*:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft BizTalk ESB Toolkit 2.3
cpes: cpe:2.3:a:microsoft:biztalk_esb_toolkit:2.3:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C
Published: 2021-12-15T14:15:37.000Z
CVE-2021-43896 Microsoft PowerShell Spoofing Vulnerability
Problem types: description: Spoofing
Affected products: vendor: Microsoft
product: CBL Mariner 2.0 x64
vendor: Microsoft
product: CBL Mariner 2.0 ARM
vendor: Microsoft
product: CBL Mariner 1.0 x64
cpes: cpe:2.3:o:microsoft:cbl_mariner:1.0:*:*:*:*:*:*:x64
vendor: Microsoft
product: CBL Mariner 1.0 ARM
cpes: cpe:2.3:o:microsoft:cbl_mariner:1.0:*:*:*:*:*:*:arm
vendor: Microsoft
product: PowerShell 7.2
cpes: cpe:2.3:a:microsoft:powershell:7.2:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Published: 2021-12-15T14:15:38.000Z
CVE-2021-43899 Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft 4K Wireless Display Adapter
cpes: cpe:2.3:h:microsoft:wireless_display_adapter:-:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-12-15T14:15:39.000Z
CVE-2021-43905 Microsoft Office app Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Office app
cpes: cpe:2.3:a:microsoft:office:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: CRITICAL
baseScore: 9.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
Published: 2021-12-15T14:15:40.000Z
CVE-2021-43907 Visual Studio Code WSL Extension Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Visual Studio Code WSL Extension
cpes: cpe:2.3:a:microsoft:windows_subsystem_for_linux:*:*:*:*:*:visual_studio_code:*:*
CVSS v3.1: version: 3.1
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-12-15T14:15:41.000Z
CVE-2021-43908 Visual Studio Code Spoofing Vulnerability
Problem types: description: Spoofing
Affected products: vendor: Microsoft
product: Visual Studio Code
cpes: cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
Published: 2021-12-15T14:15:41.000Z
CVE-2021-43925 
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Synology
product: DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-02-07T02:15:11.105Z
CVE-2021-43926 
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Synology
product: DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-02-07T02:15:16.305Z
CVE-2021-43927 
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Synology
product: DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-02-07T02:15:21.419Z
CVE-2021-43928 
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving component in Synology Mail Station before 20211105-10315 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Synology
product: Mail Station
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2022-02-07T02:15:26.417Z
CVE-2021-43929 
Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: cwe_id: CWE-74
description: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: Synology
product: DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Published: 2022-02-07T02:15:31.468Z
CVE-2021-43930 Elcomplus SmartPtt Path Traversal
Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Elcomplus
product: SmartPTT
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA
Published: 2022-04-28T14:53:29.000Z
CVE-2021-43931 Distributed Data Systems WebHM
The authentication algorithm of the WebHMI portal is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
Problem types: description: Authentication Bypass by Primary Weakness
Affected products: vendor: Distributed Data Systems
product: WebHMI
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Marcin Dudek of CERT.PL reported these vulnerabilities to CISA.
Published: 2021-12-06T17:40:45.000Z
CVE-2021-43932 Elcomplus SmartPtt Cross-site Scripting
Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main page.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Elcomplus
product: SmartPTT
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA
Published: 2022-04-28T14:54:57.000Z
CVE-2021-43933 ICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform
The affected product is vulnerable to a network-based attack by threat actors sending unimpeded requests to the receiving server, which could cause a denial-of-service condition due to lack of heap memory resources.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: FANUC
product: ROBOGUIDE
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov with Claroty reported these vulnerabilities to CISA.
Published: 2022-04-20T15:30:30.872Z
CVE-2021-43934 Elcomplus SmartPtt Unrestricted Upload of File with Dangerous Type
Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload arbitrary files.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Elcomplus
product: SmartPTT
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA
Published: 2022-04-28T14:54:20.000Z
CVE-2021-43935 ICSMA-21-343-01 Hillrom Welch Allyn Cardio Products
The impacted products, when configured to use SSO, are affected by an improper authentication vulnerability. This vulnerability allows the application to accept manual entry of any active directory (AD) account provisioned in the application without supplying a password, resulting in access to the application as the supplied AD account, with all associated privileges.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Hillrom
product: Welch Allyn Q-Stress Cardiac Stress Testing System
vendor: Hillrom
product: Welch Allyn X-Scribe Cardiac Stress Testing System
vendor: Hillrom
product: Welch Allyn Diagnostic Cardiology Suite
vendor: Hillrom
product: Welch Allyn Vision Express
vendor: Hillrom
product: Welch Allyn H-Scribe Holter Analysis System
vendor: Hillrom
product: Welch Allyn R-Scribe Resting ECG System
vendor: Hillrom
product: Welch Allyn Connex Cardio
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Hillrom reported this vulnerability to CISA
Published: 2021-12-15T18:05:16.799Z
CVE-2021-43936 Distributed Data Systems WebHM
The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's environment or lead to arbitrary code execution.
Problem types: description: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Distributed Data Systems
product: WebHMI
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Marcin Dudek of CERT.PL reported these vulnerabilities to CISA.
Published: 2021-12-06T17:39:24.000Z
CVE-2021-43937 Elcomplus SmartPTT SCADA Server Cross-site Request Forgery
Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Elcomplus
product: SmartPTT SCADA Server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2022-04-29T15:17:35.000Z
CVE-2021-43938 Elcomplus SmartPTT SCADA Server Information Exposure
Elcomplus SmartPTT SCADA Server is vulnerable to an unauthenticated user can request various files from the server without any authentication or authorization.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Elcomplus
product: SmartPTT SCADA Server
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2022-04-29T15:18:14.000Z
CVE-2021-43939 Elcomplus SmartPtt Improper Authorization
Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests directly to the desired endpoints.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: Elcomplus
product: SmartPTT
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA
Published: 2022-04-28T14:55:52.000Z
CVE-2021-43940 
Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking vulnerability in the Confluence installer. This vulnerability only affects installations of Confluence Server and Data Center on Windows. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
Problem types: cwe_id: CWE-427
description: Uncontrolled Search Path Element (CWE-427)
Affected products: vendor: Atlassian
product: Confluence Server
vendor: Atlassian
product: Confluence Data Center
Published: 2022-02-15T03:15:09.899Z
CVE-2021-43941 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPage.jspa and ImporterValueMappingsPage.jspa) via a Cross-Site Request Forgery (CSRF) vulnerability in the jira-importers-plugin. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.
Problem types: description: Cross Site Request Forgery (CSRF)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2022-02-15T03:30:09.668Z
CVE-2021-43942 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue, the attacker must trick a user into visiting a malicious website. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.
Problem types: description: Reflected Cross-Site Scripting (RXSS)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2022-01-04T02:40:09.824Z
CVE-2021-43943 
Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the "Object Schema" field of /secure/admin/InsightDefaultCustomFieldConfig.jspa. The affected versions are before version 4.21.0.
Problem types: description: Stored XSS (SXSS)
Affected products: vendor: Atlassian
product: Jira Service Management Server
vendor: Atlassian
product: Jira Service Management Data Center
Published: 2022-02-24T04:40:09.642Z
CVE-2021-43944 
This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.
Problem types: description: Remote Code Execution (RCE)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2022-03-08T02:00:13.209Z
CVE-2021-43945 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrary HTML or JavaScript via a Stored Cross-Site Scripting (SXSS) vulnerability in the /rest/jpo/1.0/hierarchyConfiguration endpoint. The affected versions are before version 8.20.3.
Problem types: description: Stored Cross-Site Scripting (SXSS)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2022-02-28T00:20:09.118Z
CVE-2021-43946 
Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscriptions via a Broken Access Control vulnerability in the /secure/EditSubscription.jspa endpoint. The affected versions are before version 8.13.21, and from version 8.14.0 before 8.20.9.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2022-01-05T03:40:09.602Z
CVE-2021-43947 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Execution (RCE) vulnerability in the Email Templates feature. This issue bypasses the fix of https://jira.atlassian.com/browse/JSDSERVER-8665. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.
Problem types: description: Remote Code Execution (RCE)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2022-01-06T01:05:10.045Z
CVE-2021-43948 
Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of private objects via an Improper Authorization vulnerability in the "Move objects" feature. The affected versions are before version 4.21.0.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Service Management Server
vendor: Atlassian
product: Jira Service Management Data Center
Published: 2022-02-15T03:35:10.202Z
CVE-2021-43949 
Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects via a Broken Access Control vulnerability in the Custom Fields feature. The affected versions are before version 4.21.0.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Service Management Server
vendor: Atlassian
product: Jira Service Management Data Center
Published: 2022-01-10T15:26:24.469Z
CVE-2021-43950 
Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source configuration information via a Broken Access Control vulnerability in the Insight Import Source feature. The affected versions are before version 4.21.0.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Service Management Server
vendor: Atlassian
product: Jira Service Management Data Center
Published: 2022-02-15T03:10:09.438Z
CVE-2021-43951 
Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import configuration details via an Information Disclosure vulnerability in the Create Object type mapping feature. The affected versions are before version 4.21.0.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Service Management Server
vendor: Atlassian
product: Jira Service Management Data Center
Published: 2022-01-10T15:26:14.791Z
CVE-2021-43952 
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/RestoreDefaults.jspa endpoint. The affected versions are before version 8.21.0.
Problem types: description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2022-02-15T00:45:10.037Z
CVE-2021-43953 
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU monitoring settings via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/ViewInstrumentation.jspa endpoint. The affected versions are before version 8.13.16, and from version 8.14.0 before 8.20.5.
Problem types: description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2022-02-15T02:40:10.288Z
CVE-2021-43954 
The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.
Problem types: description: Server Side Request Forgery (SSRF)
Affected products: vendor: Atlassian
product: Fisheye
vendor: Atlassian
product: Crucible
Published: 2022-03-14T01:45:18.016Z