rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-38197 
unarr.go in go-unarr (aka Go bindings for unarr) 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-08T15:18:17.000Z
CVE-2021-38198 
arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-08T19:28:12.000Z
CVE-2021-38199 
fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which allows operators of remote NFSv4 servers to cause a denial of service (hanging of mounts) by arranging for those servers to be unreachable during trunking detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-08T19:27:50.000Z
CVE-2021-38200 
arch/powerpc/perf/core-book3s.c in the Linux kernel before 5.12.13, on systems with perf_event_paranoid=-1 and no specific PMU driver support registered, allows local users to cause a denial of service (perf_instruction_pointer NULL pointer dereference and OOPS) via a "perf record" command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-08T19:27:29.000Z
CVE-2021-38201 
net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-08T19:26:54.000Z
CVE-2021-38202 
fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-08T19:25:59.000Z
CVE-2021-38203 
btrfs in the Linux kernel before 5.13.4 allows attackers to cause a denial of service (deadlock) via processes that trigger allocation of new system chunks during times when there is a shortage of free space in the system space_info.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-08T19:25:31.000Z
CVE-2021-38204 
drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-08T19:25:01.000Z
CVE-2021-38205 
drivers/net/ethernet/xilinx/xilinx_emaclite.c in the Linux kernel before 5.13.3 makes it easier for attackers to defeat an ASLR protection mechanism because it prints a kernel pointer (i.e., the real IOMEM pointer).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-08T19:23:51.000Z
CVE-2021-38206 
The mac80211 subsystem in the Linux kernel before 5.12.13, when a device supporting only 5 GHz is used, allows attackers to cause a denial of service (NULL pointer dereference in the radiotap parser) by injecting a frame with 802.11a rates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-08T19:23:24.000Z
CVE-2021-38207 
drivers/net/ethernet/xilinx/ll_temac_main.c in the Linux kernel before 5.12.13 allows remote attackers to cause a denial of service (buffer overflow and lockup) by sending heavy network traffic for about ten minutes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-08T19:22:47.000Z
CVE-2021-38208 
net/nfc/llcp_sock.c in the Linux kernel before 5.12.10 allows local unprivileged users to cause a denial of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure of a bind call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-08T19:22:22.000Z
CVE-2021-38209 
net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS sysctls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-08T19:21:00.000Z
CVE-2021-38217 
SEMCMS v 1.2 is vulnerable to SQL Injection via SEMCMS_User.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-28T00:00:00.000Z
CVE-2021-38221 
bbs-go <= 3.3.0 including Custom Edition is vulnerable to stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-02T17:27:46.000Z
CVE-2021-38239 
SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-15T00:00:00.000Z
CVE-2021-38241 
Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-16T00:00:00.000Z
CVE-2021-38243 
xunruicms up to v4.5.1 was discovered to contain a remote code execution (RCE) vulnerability in /index.php. This vulnerability allows attackers to execute arbitrary code via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-26T00:00:00.000Z
CVE-2021-38244 
A regular expression denial of service (ReDoS) vulnerability exits in cbioportal 3.6.21 and older via a POST request to /ProteinArraySignificanceTest.json.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-16T18:15:34.000Z
CVE-2021-38258 
NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB_HostProcessCallback().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-25T21:19:11.000Z
CVE-2021-38260 
NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB_HostParseDeviceConfigurationDescriptor().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-25T21:19:14.000Z
CVE-2021-38263 
Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 20 and 7.2 before fix pack 10 allows remote attackers to inject arbitrary web script or HTML via the output of a script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T23:10:21.000Z
CVE-2021-38264 
Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter. This issue is caused by an incomplete fix in CVE-2021-35463.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T23:06:32.000Z
CVE-2021-38265 
Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T23:03:31.000Z
CVE-2021-38266 
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T23:00:44.000Z
CVE-2021-38267 
Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_blogs_web_portlet_BlogsAdminPortlet_title and _com_liferay_blogs_web_portlet_BlogsAdminPortlet_subtitle parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T23:15:45.000Z
CVE-2021-38268 
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T18:45:26.000Z
CVE-2021-38269 
Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 before fix pack 23, 7.2 before fix pack 13, and 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the output of a Gogo Shell command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T23:25:56.000Z
CVE-2021-38278 
Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow via the urls parameter in the saveParentControlInfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T18:57:10.000Z
CVE-2021-38283 
Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read application log files containing sensitive information via a predictable /log URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-29T07:45:45.000Z
CVE-2021-38289 
An issue has been discovered in Novastar-VNNOX-iCare Novaicare 7.16.0 that gives attacker privilege escalation and allows attackers to view corporate information and SMTP server details, delete users, view roles, and other unspecified impacts. NOTE: As of April 2026, the vendor has officially decommissioned the affected legacy endpoints and associated services. The vulnerability is mitigated as the functional logic is no longer operational and the URLs have been removed from production.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-12T12:33:15.000Z
CVE-2021-38290 
A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php. An attacker can use a man in the middle attack such as phishing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-09T10:58:28.000Z
CVE-2021-38291 
FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-12T00:00:00.000Z
CVE-2021-38294 Shell Command Injection Vulnerability in Nimbus Thrift Server
A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.
Problem types: cwe_id: CWE-74
description: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: Apache Software Foundation
product: Apache Storm
vendor: Apache Software Foundation
product: Apache Storm
Credits: lang: en
value: Apache Storm would like to thank @pwntester Alvaro Muñoz of the GitHub Security Lab team for reporting this issue.
Published: 2021-10-25T12:22:36.000Z
CVE-2021-38295 Privilege escalation vulnerability when using HTML attachments
In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2
Problem types: description: Privilege escalation
Affected products: vendor: Apache Software Foundation
product: Apache CouchDB
vendor: Apache Software Foundation
product: IBM Cloudant
Credits: lang: en
value: This issue was identified by Cory Sabol of Secure Ideas.
Published: 2021-10-14T19:55:12.000Z
CVE-2021-38296 Apache Spark Key Negotiation Vulnerability
Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later
Problem types: cwe_id: CWE-294
description: CWE-294 Authentication Bypass by Capture-replay
Affected products: vendor: Apache Software Foundation
product: Apache Spark
Credits: lang: en
value: Steve Weis (Databricks)
Published: 2022-03-10T08:20:12.000Z
CVE-2021-38297 
Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-18T00:00:00.000Z
CVE-2021-38298 
Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T21:33:30.000Z
CVE-2021-38299 
Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-27T05:55:51.000Z
CVE-2021-38300 
arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when transforming unprivileged cBPF programs, allowing execution of arbitrary code within the kernel context. This occurs because conditional branches can exceed the 128 KB limit of the MIPS architecture.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-20T05:25:30.000Z
CVE-2021-38302 
The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T16:48:50.000Z
CVE-2021-38303 
A SQL injection vulnerability exists in Sureline SUREedge Migrator 7.0.7.29360.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-28T18:52:48.000Z
CVE-2021-38304 
Improper input validation in the National Instruments NI-PAL driver in versions 20.0.0 and prior may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-17T15:51:16.000Z
CVE-2021-38305 
23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-09T20:48:52.000Z
CVE-2021-38306 
Network Attached Storage on LG N1T1*** 10124 devices allows an unauthenticated attacker to gain root access via OS command injection in the en/ajp/plugins/access.ssh/checkInstall.php destServer parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-24T12:33:14.000Z
CVE-2021-38311 
In Contiki 3.0, potential nonterminating acknowledgment loops exist in the Telnet service. When the negotiated options are already disabled, servers still respond to DONT and WONT requests with WONT or DONT commands, which may lead to infinite acknowledgment loops, denial of service, and excessive CPU consumption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-09T21:19:35.000Z
CVE-2021-38312 Gutenberg Template Library & Redux Framework <= 4.2.11 Incorrect Authorization check to Arbitrary plugin installation and post deletion
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the “redux/v1/templates/” REST Route in “redux-templates/classes/class-api.php”. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
cwe_id: CWE-280
description: CWE-280 Improper Handling of Insufficient Permissions or Privileges
Affected products: vendor: Redux.io
product: Gutenberg Template Library & Redux Framework
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
version: 3.1
Credits: lang: en
value: Ramuel Gall, Wordfence
Published: 2021-09-02T16:53:39.328Z
CVE-2021-38314 Gutenberg Template Library & Redux Framework <= 4.2.11 Sensitive Information Disclosure
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the previous hash with a known salt value of '-support'. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of site’s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
cwe_id: CWE-760
description: CWE-760 Use of a One-Way Hash with a Predictable Salt
Affected products: vendor: Redux.io
product: Gutenberg Template Library & Redux Framework
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Ramuel Gall, Wordfence
Published: 2021-09-02T16:53:54.200Z
CVE-2021-38315 SP Project & Document Manager <= 4.25 Reflected Cross-Site Scripting
The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the ~/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.25.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: SmartyPants
product: SP Project & Document Manager
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Thinkland Security Team
Published: 2021-08-16T18:49:23.979Z
CVE-2021-38316 WP Academic People List <= 0.4.1 Reflected Cross-Site Scripting
The WP Academic People List WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category_name parameter in the ~/admin-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.4.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: WP Academic People List
product: WP Academic People List
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: p7e4
Published: 2021-09-09T18:09:41.799Z
CVE-2021-38317 Konnichiwa! Membership <= 0.8.3 Reflected Cross-Site Scripting
The Konnichiwa! Membership WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the plan_id parameter in the ~/views/subscriptions.html.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.8.3.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Konnichiwa! Membership
product: Konnichiwa! Membership
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: p7e4
Published: 2021-09-09T18:10:17.035Z
CVE-2021-38318 3D Cover Carousel <= 1.0 Reflected Cross-Site Scripting
The 3D Cover Carousel WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the ~/cover-carousel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: 3D Cover Carousel
product: 3D Cover Carousel
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: p7e4
Published: 2021-09-09T18:09:29.218Z