rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-43955 
The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about installation directories via information disclosure vulnerability.
Problem types: description: Information Disclosure
Affected products: vendor: Atlassian
product: Fisheye
vendor: Atlassian
product: Crucible
Published: 2022-03-16T00:55:15.263Z
CVE-2021-43956 
The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Fisheye
vendor: Atlassian
product: Crucible
Published: 2022-03-16T00:55:16.739Z
CVE-2021-43957 
Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9.
Problem types: description: Insecure Direct Object References (IDOR)
Affected products: vendor: Atlassian
product: Fisheye
vendor: Atlassian
product: Crucible
Published: 2022-03-16T00:55:18.206Z
CVE-2021-43958 
Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required solving a CAPTCHA in addition to providing user credentials for authentication via a improper restriction of excess authentication attempts vulnerability.
Problem types: description: Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: Atlassian
product: Fisheye
vendor: Atlassian
product: Crucible
Published: 2022-03-16T00:55:19.574Z
CVE-2021-43959 
Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a Server-Side Request Forgery (SSRF) vulnerability in the CSV importing feature of JSM Insight. When running in an environment like Amazon EC2, this flaw may be used to access to a metadata resource that provides access credentials and other potentially confidential information. The affected versions are before version 4.13.20, from version 4.14.0 before 4.20.8, and from version 4.21.0 before 4.22.2.
Problem types: description: Server-Side Request Forgery
Affected products: vendor: Atlassian
product: Jira Service Management Server
vendor: Atlassian
product: Jira Service Management Data Center
Published: 2022-07-26T08:00:14.034Z
CVE-2021-43960 
Lorensbergs Connect2 3.13.7647.20190 is affected by an XSS vulnerability. Exploitation requires administrator privileges and is performed through the Wizard editor of the application. The attack requires an administrator to go into the Wizard editor and enter an XSS payload within the Page title, Page Instructions, Text before, Text after, or Text on side box. Once this has been done, the administrator must click save and finally wait until any user of the application performs a booking for rental items in the booking area of the application, where the XSS triggers. NOTE: another perspective is that the administrator may require JavaScript to customize any aspect of the page rendering. There is no effective way for the product to defend users in the face of a malicious administrator
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-12T18:11:55.000Z
CVE-2021-43961 
Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-17T21:13:13.000Z
CVE-2021-43963 
An issue was discovered in Couchbase Sync Gateway 2.7.0 through 2.8.2. The bucket credentials used to read and write data in Couchbase Server were insecurely being stored in the metadata within sync documents written to the bucket. Users with read access could use these credentials to obtain write access. (This issue does not affect clusters where Sync Gateway is authenticated with X.509 client certificates. This issue also does not affect clusters where shared bucket access is not enabled on Sync Gateway.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T21:05:13.000Z
CVE-2021-43969 
The login.jsp page of Quicklert for Digium 10.0.0 (1043) is affected by both Blind SQL Injection with Out-of-Band Interaction (DNS) and Blind Time-Based SQL Injections. Exploitation can be used to disclose all data within the database (up to and including the administrative accounts' login IDs and passwords) via the login.jsp uname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-07T20:58:08.000Z
CVE-2021-43970 
An arbitrary file upload vulnerability exists in albumimages.jsp in Quicklert for Digium 10.0.0 (1043) via a .mp3;.jsp filename for a file that begins with audio data bytes. It allows an authenticated (low privileged) attacker to execute remote code on the target server within the context of application's permissions (SYSTEM).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-07T20:58:14.000Z
CVE-2021-43971 
A SQL injection vulnerability in /mobile/SelectUsers.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to execute arbitrary SQL commands via the filterText parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-11T19:17:47.000Z
CVE-2021-43972 
An unrestricted file copy vulnerability in /UserSelfServiceSettings.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to copy arbitrary files on the server filesystem to the web root (with an arbitrary filename) via the tempFile and fileName parameters in the HTTP POST body.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-11T19:19:23.000Z
CVE-2021-43973 
An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST body. A successful request returns the absolute, server-side filesystem path of the uploaded file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-11T19:20:43.000Z
CVE-2021-43974 
An issue was discovered in SysAid ITIL 20.4.74 b10. The /enduserreg endpoint is used to register end users anonymously, but does not respect the server-side setting that determines if anonymous users are allowed to register new accounts. Configuring the server-side setting to disable anonymous user registration only hides the client-side registration form. An attacker can still post registration data to create new accounts without prior authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-11T19:21:52.000Z
CVE-2021-43975 
In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-17T16:32:30.000Z
CVE-2021-43976 
In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-17T00:00:00.000Z
CVE-2021-43977 
SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-17T16:54:13.000Z
CVE-2021-43978 
Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary files, which allows users to access and modify data using the same credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:A/A:N/C:H/I:L/PR:N/S:U/UI:N
version: 3.1
Published: 2021-12-08T18:30:11.000Z
CVE-2021-43979 
Styra Open Policy Agent (OPA) Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control. The data replication mechanism allows policies to access the Kubernetes cluster state. During data replication, OPA/Gatekeeper does not wait for the replication to finish before processing a request, which might cause inconsistencies between the replicated resources in OPA/Gatekeeper and the resources actually present in the cluster. Inconsistency can later be reflected in a policy bypass. NOTE: the vendor disagrees that this is a vulnerability, because Kubernetes states are only eventually consistent
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-17T18:26:13.000Z
CVE-2021-43980 Apache Tomcat: Information disclosure
The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.
Problem types: cwe_id: CWE-362
description: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
Credits: lang: en
value: Thanks to Adam Thomas, Richard Hernandez and Ryan Schmitt for discovering the issue and working with the Tomcat security team to identify the root cause and appropriate fix.
Published: 2022-09-28T00:00:00.000Z
CVE-2021-43981 mySCADA myPRO
mySCADA myPRO: Versions 8.20.0 and prior has a feature to send emails, which may allow an attacker to inject arbitrary operating system commands through a specific parameter.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: mySCADA
product: myPRO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-12-23T19:48:39.215Z
CVE-2021-43982 Delta Electronics CNCSoft
Delta Electronics CNCSoft Versions 1.01.30 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Delta Electronics
product: CNCSoft
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-12-09T21:36:14.437Z
CVE-2021-43983 WECON LeviStudioU
WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to multiple stack-based buffer overflow instances while parsing project files, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: WECON
product: LeviStudioU
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-12-13T15:48:06.183Z
CVE-2021-43984 mySCADA myPRO
mySCADA myPRO: Versions 8.20.0 and prior has a feature where the firmware can be updated, which may allow an attacker to inject arbitrary operating system commands through a specific parameter.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: mySCADA
product: myPRO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-12-23T19:48:37.725Z
CVE-2021-43985 mySCADA myPRO
An unauthenticated remote attacker can access mySCADA myPRO Versions 8.20.0 and prior without any form of authentication or authorization.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: mySCADA
product: myPRO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2021-12-23T19:48:40.631Z
CVE-2021-43986 ICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform
The setup program for the affected product configures its files and folders with full access, which may allow unauthorized users permission to replace original binaries and achieve privilege escalation.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: FANUC
product: ROBOGUIDE
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov with Claroty reported these vulnerabilities to CISA.
Published: 2022-04-20T15:30:29.227Z
CVE-2021-43987 mySCADA myPRO
An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web interface, which cannot be deleted or changed through the regular web interface.
Problem types: cwe_id: CWE-912
description: CWE-912 Hidden Functionality
Affected products: vendor: mySCADA
product: myPRO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-12-23T19:48:36.147Z
CVE-2021-43988 ICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform
The affected product is vulnerable to a network-based attack by threat actors utilizing crafted naming conventions of files to gain unauthorized access rights.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: FANUC
product: ROBOGUIDE
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov with Claroty reported these vulnerabilities to CISA.
Published: 2022-04-20T15:30:31.734Z
CVE-2021-43989 mySCADA myPRO
mySCADA myPRO Versions 8.20.0 and prior stores passwords using MD5, which may allow an attacker to crack the previously retrieved password hashes.
Problem types: cwe_id: CWE-916
description: CWE-916 Use of Password Hash With Insufficient Computational Effort
Affected products: vendor: mySCADA
product: myPRO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2021-12-23T19:48:39.913Z
CVE-2021-43990 ICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform
The affected product is vulnerable to a network-based attack by threat actors supplying a crafted, malicious XML payload designed to trigger an external entity reference call.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
Affected products: vendor: FANUC
product: ROBOGUIDE
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov with Claroty reported these vulnerabilities to CISA.
Published: 2022-04-20T15:30:28.424Z
CVE-2021-43991 Persistent XSS via Avatar Upload in Kentico Xperience CMS
The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data without proper handling of dangerous content. This type of XSS vulnerability is exploited by submitting malicious script content to the application which is then retrieved and executed by other application users. The attacker could exploit this to conduct a range of attacks against users of the affected application such as session hijacking, account take over and accessing sensitive data.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Kentico
product: Kentico Xperience XMS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Published: 2021-12-03T14:42:31.000Z
CVE-2021-43996 
The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-17T19:17:55.000Z
CVE-2021-43997 
FreeRTOS versions 10.2.0 through 10.4.5 do not prevent non-kernel code from calling the xPortRaisePrivilege internal function to raise privilege. FreeRTOS versions through 10.4.6 do not prevent a third party that has already independently gained the ability to execute injected code to achieve further privilege escalation by branching directly inside a FreeRTOS MPU API wrapper function with a manually crafted stack frame. These issues affect ARMv7-M MPU ports, and ARMv8-M ports with MPU support enabled (i.e. configENABLE_MPU set to 1). These are fixed in V10.5.0 and in V10.4.3-LTS Patch 3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-17T00:00:00.000Z
CVE-2021-43998 
HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, and 1.9.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-30T14:59:08.000Z
CVE-2021-43999 Improper validation of SAML responses
Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Apache Software Foundation
product: Apache Guacamole
Credits: lang: en
value: We would like to thank Finn Steglich (ETAS) for reporting this issue.
Published: 2022-01-11T22:10:12.000Z
CVE-2021-44000 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (All versions < SE2022MP1), Teamcenter Visualization V13.1 (All versions < V13.1.0.9), Teamcenter Visualization V13.2 (All versions < V13.2.0.7), Teamcenter Visualization V13.3 (All versions < V13.3.0.1). The plmxmlAdapterSE70.dll contains an out of bounds write past the fixed-length heap-based buffer while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15053)
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Solid Edge SE2021
vendor: Siemens
product: Solid Edge SE2022
vendor: Siemens
product: Teamcenter Visualization V13.1
vendor: Siemens
product: Teamcenter Visualization V13.2
vendor: Siemens
product: Teamcenter Visualization V13.3
Published: 2022-02-09T15:17:07.000Z
CVE-2021-44001 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The DL180pdfl.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14974)
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization
Published: 2021-12-14T12:06:40.000Z
CVE-2021-44002 
A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions < V2023). The Jt1001.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15058, ZDI-CAN-19076, ZDI-CAN-19077)
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: JT Open
default_status: unknown
vendor: Siemens
product: JT Utilities
default_status: unknown
vendor: Siemens
product: Solid Edge
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 7.8
baseSeverity: HIGH
Published: 2021-12-14T12:06:41.000Z
CVE-2021-44003 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to use of uninitialized memory while parsing user supplied TIFF files. This could allow an attacker to cause a denial-of-service condition.
Problem types: cwe_id: CWE-457
description: CWE-457: Use of Uninitialized Variable
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization
Published: 2021-12-14T12:06:41.000Z