DATABASE RESOURCES PRICING ABOUT US

{"id": "CVE-2021-21081", "vendorId": null, "type": "cve", "bulletinFamily": "NVD", "title": "CVE-2021-21081", "description": "This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.", "published": "2022-02-25T08:30:31", "modified": "2022-02-25T08:30:31", "cvss": {}, "cvss2": {}, "cvss3": {}, "href": "", "reporter": "candidate", "references": [], "cvelist": [], "immutableFields": [], "lastseen": "2022-02-25T08:30:31", "viewCount": 10, "enchantments": {"backreferences": {"references": [{"type": "adobe", "idList": ["APSB21-19"]}, {"type": "nessus", "idList": ["ADOBE_CONNECT_APSB21-19.NASL"]}, {"type": "threatpost", "idList": ["THREATPOST:B79D0A844D2D8BF7A75F2D397398D75A"]}]}, "score": {"value": 7.1, "vector": "NONE"}, "dependencies": {"references": [{"type": "adobe", "idList": ["APSB21-19"]}, {"type": "nessus", "idList": ["ADOBE_CONNECT_APSB21-19.NASL"]}, {"type": "threatpost", "idList": ["THREATPOST:B79D0A844D2D8BF7A75F2D397398D75A"]}], "rev": 4}, "vulnersScore": 7.1}, "_state": {"dependencies": 1659895684, "score": 1684013406, "epss": 1679179052}, "_internal": {"score_hash": "c3afa8d4faa3d8dfecec096275a769c7"}, "cpe": [], "cpe23": [], "cwe": [], "affectedSoftware": [], "affectedConfiguration": [], "cpeConfiguration": {}, "extraReferences": [], "product_info": [], "exploits": [], "problemTypes": []}

{"nessus": [{"lastseen": "2023-05-18T15:25:55", "description": "The version of Adobe Connect running on the remote host is 11.0.5 or earlier. It is, therefore, affected by multiple vulnerabilities, including the following:\n\n - Multiple reflected cross-site scripting vulnerabilities due to improper validation of user-supplied input before returning it to users. An remote attacker can exploit these, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session. (CVE-2021-21079, CVE-2021-21080, CVE-2021-21081)\n\n - An arbitrary code execution vulnerability due to improper input validation. (CVE-2021-21085)\n\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-03-10T00:00:00", "type": "nessus", "title": "Adobe Connect <= 11.0.5 Multiple Vulnerabilities (APSB21-19)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-21079", "CVE-2021-21080", "CVE-2021-21081", "CVE-2021-21085"], "modified": "2022-06-28T00:00:00", "cpe": ["cpe:/a:adobe:connect"], "id": "ADOBE_CONNECT_APSB21-19.NASL", "href": "https://www.tenable.com/plugins/nessus/147419", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147419);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/06/28\");\n\n script_cve_id(\n \"CVE-2021-21079\",\n \"CVE-2021-21080\",\n \"CVE-2021-21081\",\n \"CVE-2021-21085\"\n );\n script_xref(name:\"IAVB\", value:\"2021-B-0016-S\");\n\n script_name(english:\"Adobe Connect <= 11.0.5 Multiple Vulnerabilities (APSB21-19)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server contains an application that is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Adobe Connect running on the remote host is 11.0.5 or earlier. It is, therefore, affected by multiple \nvulnerabilities, including the following:\n\n - Multiple reflected cross-site scripting vulnerabilities due to improper validation of user-supplied input\n before returning it to users. An remote attacker can exploit these, by convincing a user to click a\n specially crafted URL, to execute arbitrary script code in a user's browser session. (CVE-2021-21079,\n CVE-2021-21080, CVE-2021-21081)\n\n - An arbitrary code execution vulnerability due to improper input validation. (CVE-2021-21085)\n\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://helpx.adobe.com/security/products/connect/apsb21-19.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Adobe Connect version 11.2 or later\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-21085\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/03/09\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:adobe:connect\");\n script_set_attribute(attribute:\"stig_severity\", value:\"II\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CGI abuses\");\n\n script_copyright(english:\"This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"adobe_connect_detect.nbin\");\n script_require_keys(\"installed_sw/Adobe Connect\");\n script_require_ports(\"Services/www\", 80, 443);\n\n exit(0);\n}\n\ninclude('http.inc');\ninclude('vcf.inc');\n\nport = get_http_port(default:80);\napp_info = vcf::get_app_info(app:'Adobe Connect', port:port, webapp:TRUE);\n\nconstraints = [{'fixed_version' : '11.0.6', 'fixed_display' : '11.2'}];\n\nvcf::check_version_and_report(\n app_info:app_info,\n constraints:constraints,\n severity:SECURITY_WARNING,\n flags:{'xss':TRUE}\n);\n", "cvss": {"score": 0.0, "vector": "NONE"}}], "adobe": [{"lastseen": "2023-05-27T14:32:36", "description": "Adobe has released a security update for Adobe Connect. This update resolves a [critical]() and an [important]() vulnerability. Successful exploitation could lead to arbitrary JavaScript execution within the context of the victim's browser. \n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-03-09T00:00:00", "type": "adobe", "title": "APSB21-19 Security update available for Adobe Connect", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-21078", "CVE-2021-21079", "CVE-2021-21080", "CVE-2021-21081", "CVE-2021-21085"], "modified": "2021-03-09T00:00:00", "id": "APSB21-19", "href": "https://helpx.adobe.com/security/products/connect/apsb21-19.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "threatpost": [{"lastseen": "2021-03-09T20:51:30", "description": "Adobe has issued patches for a slew of critical security vulnerabilities, which, if exploited, could allow for arbitrary code execution on vulnerable Windows systems.\n\nAffected products include Adobe\u2019s Framemaker document processor, designed for writing and editing large or complex documents; Adobe\u2019s Connect software used for remote web conferencing; and the Adobe Creative Cloud software suite for video editing.\n\n\u201cAdobe is not aware of any exploits in the wild for any of the issues addressed in these updates,\u201d according to an Adobe spokesperson.\n\n[](<https://threatpost.com/newsletter-sign/>)\n\nWhile these vulnerabilities are classified as critical-severity flaws, it\u2019s important to note that they were given \u201cpriority 3\u201d ratings by Adobe. This means that the update \u201cresolves vulnerabilities in a product that has historically not been a target for attackers,\u201d and that administrators are urged to \u201cinstall the update at their discretion.\u201d\n\n## **Adobe Framemaker Security Flaw**\n\nAdobe [fixed a critical flaw](<https://helpx.adobe.com/security/products/framemaker/apsb21-14.html>) (CVE-2021-21056) in Framemaker, which could allow for arbitrary code execution if exploited. The vulnerability is an out-of-bounds read error; which is [a type of buffer-overflow flaw](<https://cwe.mitre.org/data/definitions/125.html>) where the software reads data past the end of the intended buffer. An attacker who can read out-of-bounds memory might be able to get \u201csecret values\u201d (like memory addresses) that could ultimately allow him to achieve code execution or denial of service.\n\nAdobe Framemaker version 2019.0.8 and below (for Windows) are affected by the flaw; a patch is issued in version 2020.0.2. Francis Provencher, working with Trend Micro\u2019s Zero Day Initiative, is credited with finding the bug.\n\n## **Creative Cloud Desktop Application For Windows**\n\nAdobe also [fixed three critical vulnerabilities](<https://helpx.adobe.com/security/products/creative-cloud/apsb21-18.html>) in the desktop application version of Adobe Creative Cloud for Windows users.\n\nTwo of the three critical flaws could enable arbitrary code execution: One of these (CVE-2021-21068) stems from an arbitrary file-overwrite hole, while the other (CVE-2021-21078) exists due to an OS command-injection error. The third critical flaw (CVE-2021-21069) stems from improper input validation and could allow an attacker to gain escalated privileges.\n\nThe Creative Cloud desktop application versions 5.3 and earlier are affected; fixes are released in version 5.4.\n\n## **Adobe Connect Critical and Important Flaws**\n\nSeveral [critical- and important-severity bugs](<https://helpx.adobe.com/security/products/connect/apsb21-19.html>) were patched in Adobe Connect.\n\nOne critical bug (CVE-2021-21078) stemmed from improper input validation; this could allow for arbitrary code execution.\n\nAnd, three important cross-site scripting (XSS) flaws (CVE-2021-21079, CVE-2021-21080, CVE-2021-21081) were patched. These could allow for arbitrary JavaScript execution in the victim\u2019s browser, if exploited.\n\nAdobe Connect version 11.0.5 and earlier are affected; the fix was released in version 11.2.\n\n## **Adobe Security Updates Continue **\n\nThis month\u2019s regularly-scheduled security fixes come on the heels of [an actively-exploited critical flaw in February](<https://threatpost.com/critical-adobe-windows-flaw/163789/>), which attackers leveraged to target Adobe Reader users on Windows.\n\nThat bug (CVE-2021-21017) was exploited in \u201climited attacks,\u201d according to [Adobe\u2019s monthly advisory](<https://helpx.adobe.com/security/products/acrobat/apsb21-09.html>), containing its regularly scheduled February updates. The flaw in question is a critical-severity [heap-based buffer-overflow](<https://threatpost.com/google-chrome-zero-day-windows-mac/163688/>) flaw.\n\n**_Check out our free _****_[upcoming live webinar events](<https://threatpost.com/category/webinars/>)_****_ \u2013 unique, dynamic discussions with cybersecurity experts and the Threatpost community:_** \n\u00b7 March 24: **Economics of 0-Day Disclosures: The Good, Bad and Ugly **([Learn more and register!](<https://threatpost.com/webinars/economics-of-0-day-disclosures-the-good-bad-and-ugly/>)) \n\u00b7 April 21: **Underground Markets: A Tour of the Dark Economy** ([Learn more and register!](<https://threatpost.com/webinars/underground-markets-a-tour-of-the-dark-economy/>))\n", "cvss3": {}, "published": "2021-03-09T20:44:18", "type": "threatpost", "title": "Adobe Critical Code-Execution Flaws Plague Windows Users", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2021-21017", "CVE-2021-21056", "CVE-2021-21068", "CVE-2021-21069", "CVE-2021-21078", "CVE-2021-21079", "CVE-2021-21080", "CVE-2021-21081"], "modified": "2021-03-09T20:44:18", "id": "THREATPOST:B79D0A844D2D8BF7A75F2D397398D75A", "href": "https://threatpost.com/adobe-critical-flaws-windows/164611/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}]}