rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-33546 UDP Technology/Geutebrück camera devices: Buffer overflow in name parameter leading to RCE
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the name parameter, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Geutebrück
product: E2 Series
vendor: Geutebrück
product: Encoder G-Code
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Titouan Lazard and Ibrahim Ayadhi from RandoriSec reported these vulnerabilities.
Published: 2021-09-13T17:55:36.920Z
CVE-2021-33547 UDP Technology/Geutebrück camera devices: Buffer overflow in profile parameter leading to RCE
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the profile parameter which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Geutebrück
product: E2 Series
vendor: Geutebrück
product: Encoder G-Code
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Titouan Lazard and Ibrahim Ayadhi from RandoriSec reported these vulnerabilities.
Published: 2021-09-13T17:55:38.601Z
CVE-2021-33548 UDP Technology/Geutebrück camera devices: Command injection in preserve parameter leading to RCE
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Geutebrück
product: E2 Series
vendor: Geutebrück
product: Encoder G-Code
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Titouan Lazard and Ibrahim Ayadhi from RandoriSec reported these vulnerabilities.
Published: 2021-09-13T17:55:40.187Z
CVE-2021-33549 UDP Technology/Geutebrück camera devices: Buffer overflow in action parameter leading to RCE
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the action parameter, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Geutebrück
product: E2 Series
vendor: Geutebrück
product: Encoder G-Code
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Titouan Lazard and Ibrahim Ayadhi from RandoriSec reported these vulnerabilities.
Published: 2021-09-13T17:55:41.804Z
CVE-2021-33550 UDP Technology/Geutebrück camera devices: Command injection in date parameter leading to RCE
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Geutebrück
product: E2 Series
vendor: Geutebrück
product: Encoder G-Code
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Titouan Lazard and Ibrahim Ayadhi from RandoriSec reported these vulnerabilities.
Published: 2021-09-13T17:55:43.372Z
CVE-2021-33551 UDP Technology/Geutebrück camera devices: Command injection in environment.lang parameter leading to RCE
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Geutebrück
product: E2 Series
vendor: Geutebrück
product: Encoder G-Code
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Titouan Lazard and Ibrahim Ayadhi from RandoriSec reported these vulnerabilities.
Published: 2021-09-13T17:55:44.932Z
CVE-2021-33552 UDP Technology/Geutebrück camera devices: Command injection in date parameter leading to RCE
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Geutebrück
product: E2 Series
vendor: Geutebrück
product: Encoder G-Code
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Titouan Lazard and Ibrahim Ayadhi from RandoriSec reported these vulnerabilities.
Published: 2021-09-13T17:55:46.549Z
CVE-2021-33553 UDP Technology/Geutebrück camera devices: Command injection in command parameter leading to RCE
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Geutebrück
product: E2 Series
vendor: Geutebrück
product: Encoder G-Code
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Titouan Lazard and Ibrahim Ayadhi from RandoriSec reported these vulnerabilities.
Published: 2021-09-13T17:55:48.174Z
CVE-2021-33554 UDP Technology/Geutebrück camera devices: Command injection in appfile.filename parameter leading to RCE
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Geutebrück
product: E2 Series
vendor: Geutebrück
product: Encoder G-Code
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Titouan Lazard and Ibrahim Ayadhi from RandoriSec reported these vulnerabilities.
Published: 2021-09-13T17:55:49.767Z
CVE-2021-33555 A vulnerability may allow remote attackers to read arbitrary files on the server of the WirelessHART-Gateway
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the server.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Phoenix Contact
product: WHA-GW-F2D2-0-AS- Z2-ETH
vendor: Phoenix Contact
product: WHA-GW-F2D2-0-AS- Z2-ETH.EIP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Pepperl+Fuchs reported this vulnerability. CERT@VDE coordinated.
Published: 2021-08-31T10:32:52.841Z
CVE-2021-33557 
An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-17T18:14:52.000Z
CVE-2021-33558 
Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, and config.js. NOTE: multiple third parties report that this is a site-specific issue because those files are not part of Boa.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-27T00:00:00.000Z
CVE-2021-33560 
Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-08T00:00:00.000Z
CVE-2021-33561 
A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customer_name in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when information is fetched from the backend, e.g., in admin/customers/list.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T22:33:22.000Z
CVE-2021-33562 
A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref parameter to a page about an arbitrary product, e.g., a product/insert-product-name-here.html/ref= URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T22:33:12.000Z
CVE-2021-33563 
Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T22:45:08.000Z
CVE-2021-33564 
An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-29T13:19:16.000Z
CVE-2021-33570 
Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-25T21:06:34.000Z
CVE-2021-33571 
In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-08T00:00:00.000Z
CVE-2021-33572 Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Linux Security whereby the FSAVD component used in certain F-Secure products can crash while scanning larger packages/fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: F-Secure
product: F-Secure Products
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2021-06-21T11:10:32.776Z
CVE-2021-33574 
The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-25T00:00:00.000Z
CVE-2021-33575 
The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load during XML document processing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-25T22:52:02.000Z
CVE-2021-33576 
An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filename can include path-traversal characters, allowing the file to be written to an arbitrary location on disk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-18T10:53:06.000Z
CVE-2021-33577 
An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves (via encryption and signing of the message) can be bypassed by changing the Content-Type of the message to text/plain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-18T10:53:15.000Z
CVE-2021-33578 
Echo ShareCare 8.15.5 is susceptible to SQL injection vulnerabilities when processing remote input from both authenticated and unauthenticated users, leading to the ability to bypass authentication, exfiltrate Structured Query Language (SQL) records, and manipulate data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-13T13:54:42.000Z
CVE-2021-33580 regex injection leading to DoS
User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the regex pattern he may cause a ReDoS by regex catastrophic backtracking on the server side. This problem has been fixed in Roller 6.0.2.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Apache Software Foundation
product: Apache Roller
Credits: lang: en
value: Apache Roller would like to thank Ed Ra (https://github.com/edvraa) for reporting this.
Published: 2021-08-18T07:50:10.000Z
CVE-2021-33581 
MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP services, by abusing the feature to check the availability of a PPM connection. This occurs in com.idsscheer.ppmmashup.web.webservice.impl.ZPrestoAdminWebService.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T21:47:48.000Z
CVE-2021-33582 
Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-01T05:32:49.000Z
CVE-2021-33583 
REINER timeCard 6.05.07 installs a Microsoft SQL Server with an sa password that is hardcoded in the TCServer.jar file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-30T19:19:51.000Z
CVE-2021-33586 
InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-27T05:00:36.000Z
CVE-2021-33587 
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-28T00:00:00.000Z
CVE-2021-33589 
Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of the algorithm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-21T00:00:00.000Z
CVE-2021-33590 
GattLib 0.3-rc1 has a stack-based buffer over-read in get_device_path_from_mac in dbus/gattlib.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-27T10:57:50.000Z
CVE-2021-33591 
An exposed remote debugging port in Naver Comic Viewer prior to 1.0.15.0 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
Problem types: cwe_id: CWE-489
description: CWE-489: Active Debug Code
Affected products: vendor: NAVER
product: Naver Comic Viewer
Published: 2021-05-28T10:50:09.000Z
CVE-2021-33592 
NAVER Toolbar before 4.0.30.323 allows remote attackers to execute arbitrary code via a crafted upgrade.xml file. Special characters in filename parameter can be the cause of bypassing code signing check function.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: NAVER
product: NAVER Toolbar
Credits: lang: en
value: powerprove(null2root)
Published: 2021-07-19T05:55:10.000Z
CVE-2021-33593 
Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar spoofing.
Problem types: cwe_id: CWE-451
description: CWE-451: User Interface (UI) Misrepresentation of Critical Information
Affected products: vendor: NAVER
product: NAVER Whale browser
Credits: lang: en
value: YoKo Kho from Telkom Indonesia
Published: 2021-11-02T06:20:09.000Z
CVE-2021-33594 F-Secure Safe browser for Android vulnerable to Address Bar Spoofing
An address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially crafted a malicious URL, it appears like a legitimate one on the address bar, while the content comes from other domain and presented in a window, covering the original content. A remote attacker can leverage this to perform address bar spoofing attack.
Problem types: description: F-Secure Safe browser for Android vulnerable to Address Bar Spoofing
Affected products: vendor: F-Secure
product: F-Secure Mobile Security
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2021-08-11T10:28:33.000Z
CVE-2021-33595 F-Secure Safe browser for iOS vulnerable to Address Bar Spoofing
A address bar spoofing vulnerability was discovered in Safe Browser for iOS. Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit domain. A remote attacker can leverage this to perform address bar spoofing attack.
Problem types: description: F-Secure Safe browser for iOS vulnerable to Address Bar Spoofing
Affected products: vendor: F-Secure
product: F-Secure Mobile Security
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2021-08-11T10:28:27.000Z
CVE-2021-33596 Fake Apple login prompt in F-Secure SAFE browser for iOS
Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit domain. Exploiting the vulnerability requires the user to click on a specially crafted, seemingly legitimate URL containing an embedded malicious redirect while using F-Secure Safe Browser for iOS.
Problem types: description: Fake Apple login prompt in F-Secure SAFE browser for iOS
Affected products: vendor: F-Secure
product: F-Secure Mobile Security
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2021-08-05T19:26:50.000Z
CVE-2021-33597 Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the SAVAPI component used in certain F-Secure products can crash while scanning fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine.
Problem types: description: Denial of Service Vulnerability
Affected products: vendor: F-Secure
product: F-Secure endpoint protection products on Windows, Mac and Linux Security
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-08-05T19:38:03.000Z