CVE-2021-21100
published 2021-04-15CVE-2021-21100: Adobe Digital Editions version 4.5.11.187245 (and earlier) is affected by a Privilege Escalation vulnerability during installation. An unauthenticated attacker…
PriorityP343high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
1.72%
74.9th percentile
Adobe Digital Editions version 4.5.11.187245 (and earlier) is affected by a Privilege Escalation vulnerability during installation. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary file system write in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | digital_editions | <= 4.5.11.187245 | — |
| adobe | digital_editions | unspecified – 4.5.11.187245 | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Qualys
April 2021 Patch Tuesday – 108 Vulnerabilities, 19 Critical, Adobe
blogs_qualys·2021-04-14·CVSS 7.8
CVE-2021-28310 [HIGH] April 2021 Patch Tuesday – 108 Vulnerabilities, 19 Critical, Adobe
This month’s Microsoft Patch Tuesday addresses 108 vulnerabilities, of which 19 are rated critical severity and 88 are rated high severity. Adobe released patches for its Photoshop, Digital Editions, and Bridge products.
## CVE-2021-28310: Win32k Elevation of Privilege Vulnerability
Microsoft released patches addressing another 0-day vulnerability (CVE-2021-28310). CVE-2021-28310 is an out-of-bounds (OOB) write vulnerability in dwmcore.dll, which is part of Desktop Window Manager (dwm.exe). There is a public exploit available which is being used in the wild. BITTER APT group is suspected of exploiting this CVE in the wild. This CVE has a temporal score of 7.2 from the vendor and should be prioritized for patching.
## Microsoft Exchange Server Remote Code Execution (RCE) Vulnerabilities
Qualys
April 2021 Patch Tuesday – 108 Vulnerabilities, 19 Critical, Adobe | Qualys
blogs_qualys·2021-04-14·CVSS 7.8
CVE-2021-28310 [HIGH] April 2021 Patch Tuesday – 108 Vulnerabilities, 19 Critical, Adobe | Qualys
This month’s Microsoft Patch Tuesday addresses 108 vulnerabilities, of which 19 are rated critical severity and 88 are rated high severity. Adobe released patches for its Photoshop, Digital Editions, and Bridge products.
#### CVE-2021-28310: Win32k Elevation of Privilege Vulnerability
Microsoft released patches addressing another 0-day vulnerability (CVE-2021-28310). CVE-2021-28310 is an out-of-bounds (OOB) write vulnerability in dwmcore.dll, which is part of Desktop Window Manager (dwm.exe). There is a public exploit available which is being used in the wild. BITTER APT group is suspected of exploiting this CVE in the wild. This CVE has a temporal score of 7.2 from the vendor and should be prioritized for patching.
#### Microsoft Exchange Server Remote Code Execution (RCE) Vulnerabilit
2021-04-15
Published