Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-43308 State: PUBLISHED Published: 2022-06-01T16:47:49.228959Z Last Updated: 2024-09-16T17:28:35.115Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: markdown-link-extractor Products: markdown-link-extractor Problem Types: CWE-1333 Description: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function Additional Analyst Notes: - CVE Program Container: References: - https://research.jfrog.com/vulnerabilities/markdown-link-extractor-redos-xray-211350/
CVE ID: CVE-2021-43309 State: PUBLISHED Published: 2022-08-24T15:48:36 Last Updated: 2024-08-04T03:55:29.287Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: uri-template-lite Products: uri-template-lite Problem Types: CWE-1333 Description: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method Additional Analyst Notes: - CVE Program Container: References: - https://research.jfrog.com/vulnerabilities/uri-template-lite-redos-xray-211351/ - https://github.com/litejs/uri-template-lite/compare/v22.1.0...v22.9.0
CVE ID: CVE-2021-43310 State: PUBLISHED Published: 2022-09-21T18:23:41.000Z Last Updated: 2025-05-27T20:37:03.390Z Vendors: n/a Products: keylime Problem Types: CWE-290 Description: A vulnerability in Keylime before 6.3.0 allows an attacker to craft a request to the agent that resets the U and V keys as if the agent were being re-added to a verifier. This could lead to a remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/oss-sec/2022/q1/101 - https://github.com/keylime/keylime/security/advisories/GHSA-2m39-75g9-ff5r
CVE ID: CVE-2021-43311 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-02-25T15:17:28.186Z Vendors: n/a Products: upx Problem Types: CWE-119 Description: A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5382. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/upx/upx/issues/380
CVE ID: CVE-2021-43312 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-02-25T15:13:30.750Z Vendors: n/a Products: upx Problem Types: CWE-119 Description: A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the function PackLinuxElf64::invert_pt_dynamic at p_lx_elf.cpp:5239. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/upx/upx/issues/379
CVE ID: CVE-2021-43313 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-02-25T15:12:23.571Z Vendors: n/a Products: upx Problem Types: CWE-119 Description: A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the function PackLinuxElf32::invert_pt_dynamic at p_lx_elf.cpp:1688. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/upx/upx/issues/378
CVE ID: CVE-2021-43314 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-02-25T15:10:26.821Z Vendors: n/a Products: upx Problem Types: CWE-119 Description: A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5368 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/upx/upx/issues/380
CVE ID: CVE-2021-43315 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-02-25T15:08:37.064Z Vendors: n/a Products: upx Problem Types: CWE-119 Description: A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5349 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/upx/upx/issues/380
CVE ID: CVE-2021-43316 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-02-25T15:06:32.962Z Vendors: n/a Products: upx Problem Types: CWE-119 Description: A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le64(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/upx/upx/issues/381
CVE ID: CVE-2021-43317 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-02-25T15:05:22.989Z Vendors: n/a Products: upx Problem Types: CWE-119 Description: A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf64::elf_lookup() at p_lx_elf.cpp:5404 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/upx/upx/issues/380
CVE ID: CVE-2021-43319 State: PUBLISHED Published: 2021-11-30T18:44:16 Last Updated: 2024-08-04T03:55:28.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality. Additional Analyst Notes: - CVE Program Container: References: - https://manageengine.com - https://www.manageengine.com/network-configuration-manager/release-notes.html#125488
CVE ID: CVE-2021-43320 State: REJECTED Published: 2021-11-30T19:31:47 Last Updated: 2021-11-30T19:31:47 Description: No description available.
CVE ID: CVE-2021-43323 State: PUBLISHED Published: 2022-02-03T01:50:01.000Z Last Updated: 2025-11-04T19:12:44.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in UsbCoreDxe in Insyde InsydeH2O with kernel 5.5 before 05.51.45, 5.4 before 05.43.45, 5.3 before 05.35.45, 5.2 before 05.26.45, 5.1 before 05.16.45, and 5.0 before 05.08.45. An SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM. Additional Analyst Notes: - CVE Program Container: References: - https://www.insyde.com/security-pledge - https://security.netapp.com/advisory/n
: - CVE Program Container: References: - https://www.insyde.com/security-pledge - https://security.netapp.com/advisory/ntap-20220217-0013/ - https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
CVE ID: CVE-2021-43324 State: PUBLISHED Published: 2021-11-03T14:05:34 Last Updated: 2024-08-04T03:55:28.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibreNMS through 21.10.2 allows XSS via a widget title. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/librenms/librenms/commit/99d2462b80435b91a35236639b909eebee432126
CVE ID: CVE-2021-43325 State: PUBLISHED Published: 2021-12-15T06:14:23 Last Updated: 2024-08-04T03:55:28.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: Automox Agent 33 on Windows incorrectly sets permissions on a temporary directory. NOTE: this issue exists because of a CVE-2021-43326 regression. Additional Analyst Notes: - CVE Program Container: References: - https://support.automox.com/help/release-notes - https://community.automox.com/product-updates-4/cve-2021-43326-and-cve-2021-43325-local-privilege-escalation-in-automox-agent-windows-only-1636
CVE ID: CVE-2021-43326 State: PUBLISHED Published: 2021-12-15T06:14:57 Last Updated: 2024-08-04T03:55:28.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: Automox Agent before 32 on Windows incorrectly sets permissions on a temporary directory. Additional Analyst Notes: - CVE Program Container: References: - https://support.automox.com/help/release-notes - https://community.automox.com/product-updates-4/cve-2021-43326-and-cve-2021-43325-local-privilege-escalation-in-automox-agent-windows-only-1636 - http://packetstormsecurity.com/files/165449/Automox-Agent-32-Local-Privilege-Escalation.html
CVE ID: CVE-2021-43327 State: PUBLISHED Published: 2021-12-02T20:00:59 Last Updated: 2024-08-04T03:55:28.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Renesas RX65 and RX65N devices. With a VCC glitch, an attacker can extract the security ID key from the device. Then, the protected firmware can be extracted. Additional Analyst Notes: - CVE Program Container: References: - https://www.collshade.fr/articles/reneshack/rx_glitch_article.html
CVE ID: CVE-2021-43329 State: PUBLISHED Published: 2022-08-25T21:31:01 Last Updated: 2024-08-04T03:55:28.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in license_update.php in Mumara Classic through 2.93 allows a remote unauthenticated attacker to execute arbitrary SQL commands via the license parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.mumara.com/classic/ - https://packetstormsecurity.com/files/164947/Mumara-Classic-2.93-SQL-Injection.html - https://www.exploit-db.com/exploits/50518 - https://packetstormsecurity.com/files/164947/mumaraclassic293-sql.txt - https://www.cyberdetails.org/2021/11/mumara-c
- https://packetstormsecurity.com/files/164947/mumaraclassic293-sql.txt - https://www.cyberdetails.org/2021/11/mumara-classic-293-sql-injection.html - https://vulners.com/zdt/1337DAY-ID-37036 - https://www.gen.net.uk/about-us/news/50-exploit-db/18335-webapps-mumara-classic-293-license-sql-injection-unauthenticated - https://www.linkedin.com/posts/shain-lakin_mumara-classic-293-license-sql-injection-activity-6867380934908506112-dAJd - https://cxsecurity.com/issue/WLB-2021110057
CVE ID: CVE-2021-43331 State: PUBLISHED Published: 2021-11-12T20:44:11 Last Updated: 2024-08-04T03:55:28.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mailman/+bug/1949401 - https://mail.python.org/archives/list/mailman-announce%40python.org/message/I2X7PSFXIEPLM3UMKZMGOEO3UFYETGRL/ - https://lists.debian.org/debian-lts-announce/2022/06/msg00011.html
CVE ID: CVE-2021-43332 State: PUBLISHED Published: 2021-11-12T20:45:35 Last Updated: 2024-08-04T03:55:28.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mailman/+bug/1949403 - https://mail.python.org/archives/list/mailman-announce%40python.org/message/I2X7PSFXIEPLM3UMKZMGOEO3UFYETGRL/ - https://lists.debian.org/debian-lts-announce/2022/06/msg00011.html
CVE ID: CVE-2021-43333 State: PUBLISHED Published: 2022-01-01T05:05:44 Last Updated: 2024-08-04T03:55:28.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Datalogic DXU service on (for example) DL-Axist devices does not require authentication for configuration changes or disclosure of configuration settings. Additional Analyst Notes: - CVE Program Container: References: - https://developer.datalogic.com/upload/res/ds/adc/dl-axist/DS-DL-AXIST-ENA4.pdf - https://datalogic.github.io/dxu/security
CVE ID: CVE-2021-43334 State: PUBLISHED Published: 2022-01-26T15:37:46 Last Updated: 2024-08-04T03:55:28.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field. Additional Analyst Notes: - CVE Program Container: References: - https://www.buddyboss.com/resources/buddyboss-platform-releases/ - https://www.cygenta.co.uk/post/buddyboss
CVE ID: CVE-2021-43336 State: PUBLISHED Published: 2021-11-14T00:00:00 Last Updated: 2024-08-04T03:55:28.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Out-of-Bounds Write vulnerability exists when reading a DXF or DWG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DXF and DWG files. Crafted data in a DXF or DWG file (an invalid number of properties) can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/securit
the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories - https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf - https://www.zerodayinitiative.com/advisories/ZDI-22-334/ - https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE ID: CVE-2021-43337 State: PUBLISHED Published: 2021-11-17T05:22:03 Last Updated: 2024-08-04T03:55:28.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: SchedMD Slurm 21.08.* before 21.08.4 has Incorrect Access Control. On sites using the new AccountingStoreFlags=job_script and/or job_env options, the access control rules in SlurmDBD may permit users to request job scripts and environment files to which they should not have access. Additional Analyst Notes: - CVE Program Container: References: - https://www.schedmd.com/news.php - https://lists.schedmd.com/pipermail/slurm-announce/ - https://www.schedmd.com/news.php?id=256 - https://lists.schedmd.com/pipermail/slurm-announce/2
permail/slurm-announce/ - https://www.schedmd.com/news.php?id=256 - https://lists.schedmd.com/pipermail/slurm-announce/2021/000068.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DUWNGDQTS7AWFI7FIHUWQOYJSD2IQTCG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VY34WSSPRPA6MISNYBZWHSGX2SYSEEE/
CVE ID: CVE-2021-43338 State: REJECTED Published: 2021-11-03T19:39:06 Last Updated: 2021-11-17T17:23:53 Description: No description available.
CVE ID: CVE-2021-43339 State: PUBLISHED Published: 2021-11-03T19:38:53 Last Updated: 2024-08-04T03:55:28.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via file_name in the export functionality. For example, a new admin user could be created. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50469 - https://pentest.com.tr/blog/RCE-via-Meow-Variant-along-with-an-Example-0day-PacketHackingVillage-Defcon29.html - https://www.exploit-db.com/exploits/50468
CVE ID: CVE-2021-43350 State: PUBLISHED Published: 2021-11-11T13:00:15 Last Updated: 2024-08-04T03:55:28.477Z Vendors: Apache Software Foundation Products: Apache Traffic Control Problem Types: CWE-90 Description: An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter. Additional Analyst Notes: - CVE Program Container: References: - https://trafficcontrol.apache.org/security/ - http://www.openwall.com/lists/oss-security/2021/11/11/3 - http://www.openwall.com/lists/oss-security/2021/11/11/4 - http://www.openwall.com/lists/oss-security/2021/
021/11/11/3 - http://www.openwall.com/lists/oss-security/2021/11/11/4 - http://www.openwall.com/lists/oss-security/2021/11/17/1
CVE ID: CVE-2021-43351 State: REJECTED Published: N/A Last Updated: 2025-02-13T16:28:43.162Z Description: No description available.
CVE ID: CVE-2021-43353 State: PUBLISHED Published: 2022-01-18T16:52:24.000Z Last Updated: 2025-01-31T18:56:22.096Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Crisp Live Chat Products: Crisp Live Chat Problem Types: CWE-352 Description: The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 0.31. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-a
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-43353 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2643954%40crisp&new=2643954%40crisp&sfp_email=&sfph_mail=
CVE ID: CVE-2021-43355 State: PUBLISHED Published: 2022-01-21T18:17:44.000Z Last Updated: 2025-04-16T16:46:31.988Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Fresenius Kabi Products: Vigilant Software Suite (Mastermed Dashboard) Problem Types: CWE-603 Description: Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without authentication by the server. The server should not rely on the correctness of the data because users might not support or block JavaScript or intentionally bypass the client-side checks. An attacker with knowledge of the service user could circumvent the clie
or intentionally bypass the client-side checks. An attacker with knowledge of the service user could circumvent the client-side control and login with service privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01
CVE ID: CVE-2021-43358 State: PUBLISHED Published: 2021-12-01T02:00:22.492825Z Last Updated: 2024-09-17T02:21:18.827Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Sunnet Products: eHRD Problem Types: CWE-22 Description: Sunnet eHRD has inadequate filtering for special characters in URLs, which allows a remote attacker to perform path traversal attacks without authentication, access restricted paths and download system files. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5353-4ebee-1.html
CVE ID: CVE-2021-43359 State: PUBLISHED Published: 2021-12-01T02:00:23.979053Z Last Updated: 2024-09-16T18:43:15.405Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Sunnet Products: eHRD Problem Types: CWE-732 Description: Sunnet eHRD has broken access control vulnerability, which allows a remote attacker to access account management page after being authenticated as a general user, then perform privilege escalation to execute arbitrary code and control the system or interrupt services. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5354-0aac0-1.html
CVE ID: CVE-2021-43360 State: PUBLISHED Published: 2021-12-01T02:00:25.412656Z Last Updated: 2024-09-17T03:44:10.703Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Sunnet Products: eHRD Problem Types: CWE-502 Description: Sunnet eHRD e-mail delivery task schedule’s serialization function has inadequate input object validation and restriction, which allows a post-authenticated remote attacker with database access privilege, to execute arbitrary code and control the system or interrupt services. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5355-6e339-1.html
CVE ID: CVE-2021-43361 State: PUBLISHED Published: 2022-09-29T01:50:01.000Z Last Updated: 2025-05-20T19:39:50.100Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L) Vendors: MedData Products: HBYS Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MedData HBYS allows SQL Injection.This issue affects HBYS: from unspecified before 1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bartutku/CVE-2021-43361/blob/main/CVE-2021-43361.txt
CVE ID: CVE-2021-43362 State: PUBLISHED Published: 2022-09-29T01:51:27.000Z Last Updated: 2025-05-20T19:39:20.751Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L) Vendors: MedData Products: HBYS Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MedData HBYS allows SQL Injection.This issue affects HBYS: from unspecified before 1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/Blackh4n/9d8feaf1cfb68f66de17361e85f616d4
CVE ID: CVE-2021-43388 State: PUBLISHED Published: 2021-12-14T18:00:16 Last Updated: 2024-08-04T03:55:28.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup. The issue is addressed by ensuring that the allowBackup flag (in the manifest) is False. Additional Analyst Notes: - CVE Program Container: References: - https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=65
CVE ID: CVE-2021-43389 State: PUBLISHED Published: 2021-11-04T18:39:06 Last Updated: 2024-08-04T03:55:28.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15 - https://seclists.org/oss-sec/2021/q4/39 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d - https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_Bb
?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d - https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA%40mail.gmail.com/ - http://www.openwall.com/lists/oss-security/2021/11/05/1 - https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5096 - https://www.oracle.com/security-alerts/cpujul2022.html - https://bugzilla.redhat.com/show_bug.cgi?id=2013180
CVE ID: CVE-2021-43390 State: PUBLISHED Published: 2021-11-14T20:56:44 Last Updated: 2024-08-04T03:55:28.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Out-of-Bounds Write vulnerability exists when reading a DGN file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DGN files. Crafted data in a DGN file and lack of proper validation of input data can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories
process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories - https://www.zerodayinitiative.com/advisories/ZDI-21-1348/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1347/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1362/