stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2021-43099 (severity: MEDIUM, weakness: CWE-22)
An Archive Extraction (AKA "Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips the arbitrary upladed zip file without checking filenames. The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe).
CVE-2021-4310 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in 01-Scripts 01-Artikelsystem. It has been classified as problematic. Affected is an unknown function of the file 01article.php. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. It is possible to launch the attack remotely. The patch is identified as ae849b347a58c2cb1be38d04bbe56fc883d5d84a. It is recommended to apply a patch to fix this issue. VDB-217662 is the identifier assigned to this vulnerability.
CVE-2021-43100 (severity: HIGH, weakness: CWE-434)
A File Upload vulnerability exists in bbs 5.3 is via TopicManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.
CVE-2021-43101 (severity: HIGH, weakness: CWE-434)
A File Upload vulnerability exists in bbs 5.3 is via MembershipCardManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.
CVE-2021-43102 (severity: HIGH, weakness: CWE-434)
A File Upload vulnerability exists in bbs 5.3 is via HelpManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.
CVE-2021-43103 (severity: HIGH, weakness: CWE-434)
A File Upload vulnerability exists in bbs 5.3 is via ForumManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code.
CVE-2021-43105 (severity: MEDIUM, weakness: NVD-CWE-Other)
A vulnerability in the bailiwick checking function in Technitium DNS Server <= v7.0 exists that allows specific malicious users to inject `NS` records of any domain (even TLDs) into the cache and conduct a DNS cache poisoning attack.
CVE-2021-43106 (severity: MEDIUM, weakness: CWE-116)
A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online (TWO) 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the request to be sent to a completely different Domain/IP address. This is due to that the server implicitly trusts the Host header, and fails to validate or escape it properly. An attacker can use this input to redirect target users to a malicious domain/web page. This would result in expanding the potential to further attacks and malicious actions.
CVE-2021-43109 (severity: HIGH, weakness: CWE-89)
An SQL Injection vulnerability exits in PuneethReddyHC online-shopping-system as of 11/01/2021 via the p parameter in product.php.
CVE-2021-4311 (severity: CRITICAL, weakness: CWE-611)
A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component XML Handler. The manipulation leads to xml external entity reference. The patch is identified as 31d442b9fb1d518128fd18f6e4d54e06c3d67793. It is recommended to apply a patch to fix this issue. VDB-217666 is the identifier assigned to this vulnerability.
CVE-2021-43110 (severity: CRITICAL, weakness: NVD-CWE-Other)
An Access Conrol vulnerability exists in PuneethReddyHC online-shopping-system as of 11/01/2021 in add_products.
CVE-2021-43113 (severity: CRITICAL, weakness: CWE-77)
iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.
CVE-2021-43114 (severity: HIGH, weakness: NVD-CWE-Other)
FORT Validator versions prior to 1.5.2 will crash if an RPKI CA publishes an X.509 EE certificate. This will lead to RTR clients such as BGP routers to lose access to the RPKI VRP data set, effectively disabling Route Origin Validation.
CVE-2021-43116 (severity: HIGH, weakness: CWE-287)
An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login.
CVE-2021-43117 (severity: CRITICAL, weakness: CWE-434)
fastadmin v1.2.1 is affected by a file upload vulnerability which allows arbitrary code execution through shell access.
CVE-2021-43118 (severity: CRITICAL, weakness: CWE-77)
A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 via a crafted HTTP message containing malformed QUERY STRING in mainfunction.cgi, which could let a remote malicious user execute arbitrary code.
CVE-2021-4312 (severity: MEDIUM, weakness: CWE-79)
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in Th3-822 Rapidleech. This affects the function zip_go of the file classes/options/zip.php. The manipulation of the argument archive leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named 885a87ea4ee5e14fa95801eca255604fb2e138c6. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218295. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2021-43129 (severity: MEDIUM, weakness: NVD-CWE-Other)
A bypass exists for Desire2Learn/D2L Brightspace’s “Disable Right Click” option in the quizzing feature, which allows a quiz-taker to access print and copy functionality via the browser’s right click menu even when “Disable Right Click” is enabled on the quiz.
CVE-2021-4313 (severity: CRITICAL, weakness: CWE-89)
A vulnerability was found in NethServer phonenehome. It has been rated as critical. This issue affects the function get_info/get_country_coor of the file server/index.php. The manipulation leads to sql injection. The identifier of the patch is 759c30b0ddd7d493836bbdf695cf71624b377391. It is recommended to apply a patch to fix this issue. The identifier VDB-218393 was assigned to this vulnerability.
CVE-2021-43130 (severity: CRITICAL, weakness: CWE-89)
An SQL Injection vulnerability exists in Sourcecodester Customer Relationship Management System (CRM) 1.0 via the username parameter in customer/login.php.
CVE-2021-43136 (severity: CRITICAL, weakness: CWE-798)
An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to the platform.
CVE-2021-43137 (severity: HIGH, weakness: CWE-79)
Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exits in hostel management system 2.1 via the name field in my-profile.php. Chaining to this both vulnerabilities leads to account takeover.
CVE-2021-43138 (severity: HIGH, weakness: CWE-1321)
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
CVE-2021-4314 (severity: MEDIUM, weakness: CWE-269)
It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This issue affects: 1.16 versions to 1.19. What happens is that the services using the ZAAS client or the API ML API to query will be deceived into believing the information in the JWT token is valid when it isn’t. It’s possible to use this to persuade the southbound service that different user is authenticated.
CVE-2021-43140 (severity: CRITICAL, weakness: CWE-89)
SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login.
CVE-2021-43141 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Simple Subscription Website 1.0 via the id parameter in plan_application.
CVE-2021-43142 (severity: CRITICAL, weakness: CWE-611)
An XML External Entity (XXE) vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput.
CVE-2021-43145 (severity: HIGH, weakness: NVD-CWE-Other)
With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts.
CVE-2021-4315 (severity: HIGH, weakness: CWE-1336)
A vulnerability has been found in NYUCCL psiTurk up to 3.2.0 and classified as critical. This vulnerability affects unknown code of the file psiturk/experiment.py. The manipulation of the argument mode leads to improper neutralization of special elements used in a template engine. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.1 is able to address this issue. The name of the patch is 47787e15cecd66f2aa87687bf852ae0194a4335f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-219676.
CVE-2021-43154 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php.
CVE-2021-43155 (severity: CRITICAL, weakness: CWE-89)
Projectsworlds Online Book Store PHP v1.0 is vulnerable to SQL injection via the "bookisbn" parameter in cart.php.
CVE-2021-43156 (severity: MEDIUM, weakness: CWE-352)
In ProjectWorlds Online Book Store PHP 1.0 a CSRF vulnerability in admin_delete.php allows a remote attacker to delete any book.
CVE-2021-43157 (severity: CRITICAL, weakness: CWE-89)
Projectsworlds Online Shopping System PHP 1.0 is vulnerable to SQL injection via the id parameter in cart_remove.php.
CVE-2021-43158 (severity: MEDIUM, weakness: CWE-352)
In ProjectWorlds Online Shopping System PHP 1.0, a CSRF vulnerability in cart_remove.php allows a remote attacker to remove any product in the customer's cart.
CVE-2021-43159 (severity: HIGH, weakness: CWE-77)
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the setSessionTime function in /cgi-bin/luci/api/common..
CVE-2021-4316 (severity: MEDIUM, weakness: NVD-CWE-Other)
Inappropriate implementation in Cast UI in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to spoof browser UI via a crafted HTML page. (Chromium security severity: Low)
CVE-2021-43160 (severity: HIGH, weakness: CWE-77)
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the switchFastDhcp function in /cgi-bin/luci/api/diagnose.
CVE-2021-43161 (severity: HIGH, weakness: CWE-77)
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the doSwitchApi function in /cgi-bin/luci/api/switch.
CVE-2021-43162 (severity: HIGH, weakness: CWE-77)
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the runPackDiagnose function in /cgi-bin/luci/api/diagnose.
CVE-2021-43163 (severity: CRITICAL, weakness: CWE-77)
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the checkNet function in /cgi-bin/luci/api/auth.
CVE-2021-43164 (severity: HIGH, weakness: CWE-78)
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the updateVersion function in /cgi-bin/luci/api/wireless.
CVE-2021-4317 (severity: HIGH, weakness: CWE-416)
Use after free in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
CVE-2021-43171 (severity: MEDIUM, weakness: CWE-347)
Improper verification of applications' cryptographic signatures in the /e/OS app store client App Lounge before 0.19q allows attackers in control of the application server to install malicious applications on user's systems by altering the server's API response.
CVE-2021-43172 (severity: HIGH, weakness: CWE-674)
NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run. In RPKI, a CA can choose the RRDP repository it wishes to publish its data in. By continuously generating a new child CA that only consists of another CA using a different RRDP repository, a malicious CA can create a chain of CAs of de-facto infinite length. Routinator prior to version 0.10.2 did not contain a limit on the length of such a chain and will therefore continue to process this chain forever. As a result, the validation run will never finish, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all.
CVE-2021-43173 (severity: HIGH, weakness: CWE-755)
In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. This can be used to effectively stall validation. While Routinator has a configurable time-out value for RRDP connections, this time-out was only applied to individual read or write operations rather than the complete request. Thus, if an RRDP repository sends a little bit of data before that time-out expired, it can continuously extend the time it takes for the request to finish. Since validation will only continue once the update of an RRDP repository has concluded, this delay will cause validation to stall, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all.
CVE-2021-43174 (severity: HIGH, weakness: CWE-1325)
NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. This encoding can be used by an RRDP repository to cause an out-of-memory crash in these versions of Routinator. RRDP uses XML which allows arbitrary amounts of white space in the encoded data. The gzip scheme compresses such white space extremely well, leading to very small compressed files that become huge when being decompressed for further processing, big enough that Routinator runs out of memory when parsing input data waiting for the next XML element.
CVE-2021-43175 (severity: HIGH, weakness: CWE-305)
The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly, allowing the caller to specify any values for these parameters and successfully authenticate. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
CVE-2021-43176 (severity: HIGH, weakness: CWE-23)
The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the action. This permits an attacker to execute any PHP source file with a .php extension that is present on the disk and readable by the GOautodial web server process. Combined with CVE-2021-43175, it is possible for the attacker to do this without valid credentials. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CVE-2021-43177 (severity: MEDIUM, weakness: CWE-254)
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVE-2021-4318 (severity: HIGH, weakness: NVD-CWE-Other)
Object corruption in Blink in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2021-43180 (severity: HIGH, weakness: NVD-CWE-Other)
In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible.
CVE-2021-43181 (severity: MEDIUM, weakness: CWE-79)
In JetBrains Hub before 2021.1.13690, stored XSS is possible.
CVE-2021-43182 (severity: HIGH, weakness: NVD-CWE-Other)
In JetBrains Hub before 2021.1.13415, a DoS via user information is possible.
CVE-2021-43183 (severity: CRITICAL, weakness: NVD-CWE-Other)
In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed.
CVE-2021-43184 (severity: MEDIUM, weakness: CWE-79)
In JetBrains YouTrack before 2021.3.21051, stored XSS is possible.
CVE-2021-43185 (severity: CRITICAL, weakness: CWE-74)
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection.
CVE-2021-43186 (severity: MEDIUM, weakness: CWE-79)
JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS.
CVE-2021-43187 (severity: MEDIUM, weakness: NVD-CWE-Other)
In JetBrains YouTrack Mobile before 2021.2, the client-side cache on iOS could contain sensitive information.
CVE-2021-43188 (severity: HIGH, weakness: NVD-CWE-Other)
In JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete.
CVE-2021-43189 (severity: HIGH, weakness: NVD-CWE-Other)
In JetBrains YouTrack Mobile before 2021.2, access token protection on Android is incomplete.
CVE-2021-4319 (severity: HIGH, weakness: CWE-416)
Use after free in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
CVE-2021-43190 (severity: MEDIUM, weakness: NVD-CWE-Other)
In JetBrains YouTrack Mobile before 2021.2, task hijacking on Android is possible.
CVE-2021-43191 (severity: MEDIUM, weakness: NVD-CWE-Other)
JetBrains YouTrack Mobile before 2021.2, is missing the security screen on Android and iOS.
CVE-2021-43192 (severity: MEDIUM, weakness: NVD-CWE-Other)
In JetBrains YouTrack Mobile before 2021.2, iOS URL scheme hijacking is possible.
CVE-2021-43193 (severity: CRITICAL, weakness: NVD-CWE-Other)
In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible.
CVE-2021-43194 (severity: MEDIUM, weakness: NVD-CWE-Other)
In JetBrains TeamCity before 2021.1.2, user enumeration was possible.
CVE-2021-43195 (severity: MEDIUM, weakness: NVD-CWE-Other)
In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing.
CVE-2021-43196 (severity: HIGH, weakness: NVD-CWE-Other)
In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible.
CVE-2021-43197 (severity: MEDIUM, weakness: CWE-79)
In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS.
CVE-2021-43198 (severity: MEDIUM, weakness: CWE-79)
In JetBrains TeamCity before 2021.1.2, stored XSS is possible.
CVE-2021-43199 (severity: MEDIUM, weakness: CWE-276)
In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient.
CVE-2021-4320 (severity: HIGH, weakness: CWE-416)
Use after free in Blink in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
CVE-2021-43200 (severity: CRITICAL, weakness: NVD-CWE-Other)
In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient.
CVE-2021-43201 (severity: MEDIUM, weakness: NVD-CWE-Other)
In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project.
CVE-2021-43202 (severity: CRITICAL, weakness: NVD-CWE-Other)
In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases.
CVE-2021-43203 (severity: HIGH, weakness: CWE-287)
In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly.
CVE-2021-43204 (severity: MEDIUM, weakness: NVD-CWE-Other)
A improper control of a resource through its lifetime in Fortinet FortiClientWindows version 6.4.1 and 6.4.0, version 6.2.9 and below, version 6.0.10 and below allows attacker to cause a complete denial of service of its components via changes of directory access permissions.
CVE-2021-43205 (severity: MEDIUM, weakness: CWE-200)
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Linux version 7.0.2 and below, 6.4.7 and below and 6.2.9 and below may allow an unauthenticated attacker to access the confighandler webserver via external binaries.
CVE-2021-43206 (severity: MEDIUM, weakness: CWE-209)
A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x and FortiProxy 7.0.0 through 7.0.1, 2.0.x allows malicious webservers to retrieve a web proxy's client username and IP via same origin HTTP requests triggering proxy-generated HTTP status codes pages.
CVE-2021-43207 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2021-43208 (severity: HIGH, weakness: CWE-94)
3D Viewer Remote Code Execution Vulnerability
CVE-2021-43209 (severity: HIGH, weakness: NVD-CWE-Other)
3D Viewer Remote Code Execution Vulnerability
CVE-2021-4321 (severity: MEDIUM, weakness: NVD-CWE-Other)
Policy bypass in Blink in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2021-43211 (severity: HIGH, weakness: CWE-269)
Windows 10 Update Assistant Elevation of Privilege Vulnerability
CVE-2021-43214 (severity: CRITICAL, weakness: NVD-CWE-Other)
Web Media Extensions Remote Code Execution Vulnerability
CVE-2021-43215 (severity: CRITICAL, weakness: CWE-787)
iSNS Server Memory Corruption Vulnerability Can Lead to Remote Code Execution
CVE-2021-43216 (severity: MEDIUM, weakness: CWE-668)
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
CVE-2021-43217 (severity: CRITICAL, weakness: NVD-CWE-Other)
Windows Encrypting File System (EFS) Remote Code Execution Vulnerability
CVE-2021-43219 (severity: HIGH, weakness: NVD-CWE-Other)
DirectX Graphics Kernel File Denial of Service Vulnerability
CVE-2021-4322 (severity: HIGH, weakness: CWE-416)
Use after free in DevTools in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE-2021-43220 (severity: HIGH, weakness: CWE-290)
Microsoft Edge for iOS Spoofing Vulnerability
CVE-2021-43221 (severity: MEDIUM, weakness: CWE-94)
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2021-43222 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Message Queuing Information Disclosure Vulnerability
CVE-2021-43223 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
CVE-2021-43224 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Common Log File System Driver Information Disclosure Vulnerability
CVE-2021-43225 (severity: CRITICAL, weakness: NVD-CWE-Other)
Bot Framework SDK Remote Code Execution Vulnerability
CVE-2021-43226 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2021-43227 (severity: MEDIUM, weakness: NVD-CWE-Other)
Storage Spaces Controller Information Disclosure Vulnerability
CVE-2021-43228 (severity: HIGH, weakness: NVD-CWE-Other)
SymCrypt Denial of Service Vulnerability
CVE-2021-43229 (severity: HIGH, weakness: NVD-CWE-Other)
Windows NTFS Elevation of Privilege Vulnerability