Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-26278 State: PUBLISHED Published: 2024-12-17T03:05:03.842Z Last Updated: 2024-12-17T17:30:08.414Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: vivo Products: Wifi Problem Types: CWE-306 Description: The wifi module exposes the interface and has improper permission control, leaking sensitive information about the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vivo.com/en/support/security-advisory-detail?id=7
CVE ID: CVE-2021-26279 State: PUBLISHED Published: 2024-12-17T03:34:42.148Z Last Updated: 2024-12-17T17:30:02.358Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: vivo Products: Weather Problem Types: CWE-200 Description: Some parameters of the weather module are improperly stored, leaking some sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vivo.com/en/support/security-advisory-detail?id=10
CVE ID: CVE-2021-26280 State: PUBLISHED Published: 2024-12-17T06:27:22.498Z Last Updated: 2024-12-17T14:38:18.226Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:H) Vendors: vivo Products: Permission manager module Problem Types: CWE-306 Description: Locally installed application can bypass the permission check and perform system operations that require permission. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vivo.com/en/support/security-advisory-detail?id=6
CVE ID: CVE-2021-26281 State: PUBLISHED Published: 2024-12-17T06:37:53.687Z Last Updated: 2024-12-17T14:41:26.391Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: vivo Products: Alarm clock Problem Types: CWE-200 Description: Some parameters of the alarm clock module are improperly stored, leaking some sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vivo.com/en/support/security-advisory-detail?id=9
CVE ID: CVE-2021-26291 State: PUBLISHED Published: 2021-04-23T14:20:13 Last Updated: 2024-08-03T20:19:20.126Z Vendors: Apache Software Foundation Products: Apache Maven Problem Types: Unexpected Behavior Description: Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently
ow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r9a027668558264c4897633e66bcb7784099fdec9f9b22c38c2442f00%40%3Cusers.maven.apache.org%3E - https://lists.apache.org/thread.html/r06db4057b74e0598a4127
784099fdec9f9b22c38c2442f00%40%3Cusers.maven.apache.org%3E - https://lists.apache.org/thread.html/r06db4057b74e0598a412734f693a34a8836ac6f06d16d139e5e1027c%40%3Cdev.maven.apache.org%3E - https://lists.apache.org/thread.html/r9a027668558264c4897633e66bcb7784099fdec9f9b22c38c2442f00%40%3Cusers.maven.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/04/23/5 - https://lists.apache.org/thread.html/r0556ce5db7231025785477739ee416b169d8aff5ee9bac7854d64736%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/ra88a0eba7f84658cefcecc0143fd8bbad52c229ee5dfcbfdde7b6457%40%3Cdev.jena.apache.org%3E - https://lists.apache.org/thread.html/r3f0450dcab7e63b5f233ccfbc6fca5f1867a75c
cbfdde7b6457%40%3Cdev.jena.apache.org%3E - https://lists.apache.org/thread.html/r3f0450dcab7e63b5f233ccfbc6fca5f1867a75c8aa2493ea82732381%40%3Cdev.jena.apache.org%3E - https://lists.apache.org/thread.html/rfc27e2727a20a574f39273e0432aa97486a332f9b3068f6ac1346594%40%3Cdev.myfaces.apache.org%3E - https://lists.apache.org/thread.html/r86e1c81e03f441855f127980e9b3d41939d04a7caea2b7ab718e2288%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/red3bf6cbfd99e36b0c0a4fa1cea1eef1eb300c6bd8f372f497341265%40%3Cdev.kafka.apache.org%3E - https://lists.apache.org/thread.html/r340e75c9bb6e8661b89e1cf2c52f4638a18312e57bd884722bc28f52%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org
.html/r340e75c9bb6e8661b89e1cf2c52f4638a18312e57bd884722bc28f52%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r78fb6d2cf0ca332cfa43abd4471e75fa6c517ed9cdfcb950bff48d40%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r39fa6ec4b7e912d3e04ea68efd23e554ec9c8efa2c96f5b45104fc61%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r30e9fcba679d164158cc26236704c351954909c18cb2485d11038aa6%40%3Cdev.kafka.apache.org%3E - https://lists.apache.org/thread.html/rc7ae2530063d1cd1cf8e9fa130d10940760f927168d4063d23b8cd0a%40%3Ccommits.kafka.apache.org%3E - https://lists.apache.org/thread.html/r5ae6aaa8a2ce86145225c3516bb45d315c0454e3765d651527e5df8a
its.kafka.apache.org%3E - https://lists.apache.org/thread.html/r5ae6aaa8a2ce86145225c3516bb45d315c0454e3765d651527e5df8a%40%3Ccommits.kafka.apache.org%3E - https://lists.apache.org/thread.html/r0a5e4ff2a7ca7ad8595d7683afbaeb3b8788ba974681907f97e7dc8e%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r86aebd0387ae19b740b3eb28bad83fe6aceca0d6257eaa810a6e0002%40%3Ccommits.kafka.apache.org%3E - https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E - https://lists.apache.org/thread.html/r71bc13669be84c2ff45b74a67929bc2da905c152e12a39b406e3c2a0%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/threa
1bc13669be84c2ff45b74a67929bc2da905c152e12a39b406e3c2a0%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r53cd5de57aaa126038c5301d8f518f3defab3c5b1c7e17c97bad08d8%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r52c6cda14dc6315dc79e72d30109f4589e9c6300ef6dc1a019da32d4%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r74329c671df713f61ae4620ee2452a0443ccad7f33c60e8ed7d21ff9%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r07a89b32783f73bda6903c1f9aadeb859e5bef0a4daed6d87db8e4a9%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r96cc126d3ee9aa42af9d3bb4baa94828b0a5f656584a50dcc594125f
ues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r96cc126d3ee9aa42af9d3bb4baa94828b0a5f656584a50dcc594125f%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/ra9d984eccfd2ae7726671e025f0296bf03786e5cdf872138110ac29b%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r0d083314aa3934dd4b6e6970d1f6ee50f6eaa9d867deb2cd96788478%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/re75f8b3dbc5faa1640908f87e644d373e00f8b4e6ba3e2ba4bd2c80b%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r08a401f8c98a99f68d061fde6e6659d695f28d60fe4f0413bcb355b0%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thr
08a401f8c98a99f68d061fde6e6659d695f28d60fe4f0413bcb355b0%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rdcbad6d8ce72c79827ed8c635f9a62dd919bb21c94a0b64cab2efc31%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/rfc0db1f3c375087e69a239f9284ded72d04fbb55849eadde58fa9dc2%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r77af3ac7c3bfbd5454546e13faf7aec21d627bdcf36c9ca240436b94%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/rcd37d9214b08067a2e8f2b5b4fd123a1f8cb6008698d11ef44028c21%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r167dbc42ef7c59802c2ca1ac14735ef9cf687c25208229993d6206
ssues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r167dbc42ef7c59802c2ca1ac14735ef9cf687c25208229993d6206fe%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r4e1619cfefcd031fac62064a3858f5c9229eef907bd5d8ef14c594fc%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r2ddabd06d94b60cfb0141e4abb23201c628ab925e30742f61a04d013%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/r30a139c165b3da6e0d5536434ab1550534011b1fdfcd2f5d95892c5b%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/rf9abfc0223747a56694825c050cc6b66627a293a32ea926b3de22402%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/th
/rf9abfc0223747a56694825c050cc6b66627a293a32ea926b3de22402%40%3Cissues.karaf.apache.org%3E - https://lists.apache.org/thread.html/rc9e441c1576bdc4375d32526d5cf457226928e9c87b9f54ded26271c%40%3Cissues.karaf.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2022.html - https://lists.apache.org/thread.html/r7212b874e575e59d648980d91bc22e684906aee9b211ab92da9591f5%40%3Cdev.kafka.apache.org%3E - https://lists.apache.org/thread.html/rcd6c3a36f1dbc130da1b89d0f320db7040de71661a512695a8d513ac%40%3Cdev.kafka.apache.org%3E - https://www.whitesourcesoftware.com/resources/blog/maven-security-vulnerability-cve-2021-26291/ - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-26293 State: PUBLISHED Published: 2021-03-04T20:32:44 Last Updated: 2024-08-03T20:19:20.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the web root). This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x. Additional Analyst Notes: - CVE Program Container: References: - https://auroramail.wordpress.com/2021/02/03/addressing-dav-related-vulnerability-in-webmail-and-aurora/
CVE ID: CVE-2021-26294 State: PUBLISHED Published: 2021-03-07T03:42:34 Last Updated: 2024-08-03T20:19:20.346Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_user account (with caldav_public_user as its password). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/E3SEC/AfterLogic/blob/main/CVE-2021-26294-exposure-of-sensitive-information-vulnerability.m
rences: - https://github.com/E3SEC/AfterLogic/blob/main/CVE-2021-26294-exposure-of-sensitive-information-vulnerability.md
CVE ID: CVE-2021-26295 State: PUBLISHED Published: 2021-03-22T12:00:18.000Z Last Updated: 2025-02-13T16:27:51.958Z Vendors: Apache Software Foundation Products: Apache OFBiz Problem Types: Java serialisation Description: Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r3c1802eaf34aa78a61b4e8e044c214bc94accbd28a11f3a276586a31%40%3Cuser.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r6e4579c4ebf7efeb462962e359501c6ca4045687f12212551df2d607%40%3Cnotifications.ofbiz.apache.org%3E
.apache.org/thread.html/r6e4579c4ebf7efeb462962e359501c6ca4045687f12212551df2d607%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r0d97a3b7a14777b9e9e085b483629d2774343c4723236d1c73f43ff0%40%3Cdev.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/reccf8c8a58337ce7c035495d3d82fbc549e97036a9789a2a7d9cccf6%40%3Cdev.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rec5e9fdcdca13099cfb29f632333f44ad1dd60d90f67b90434e4467a%40%3Cdev.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rc9bd0d3d794dc370bc70585960841868cb29b92dcc80552b84ca2599%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r3ee005dd767cd83f522719423
c80552b84ca2599%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r3ee005dd767cd83f522719423f5e7dd316f168ddbd1dc51a13d4e244%40%3Cnotifications.ofbiz.apache.org%3E - http://packetstormsecurity.com/files/162104/Apache-OFBiz-SOAP-Java-Deserialization.html - https://lists.apache.org/thread.html/rbe512e5ccd6b11169c6379daa1234bc805f3d53c5a38224e956295ce%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r108a964764b8bd21ebd32ccd4f51c183ee80a251c105b849154a8e9d%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rab718cfe6468085d7560c0c1ae816841e175886199f42e36efb8d735%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.a
.html/rab718cfe6468085d7560c0c1ae816841e175886199f42e36efb8d735%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r078351a876ed284ba667b33aba29428d7308a5bd4df78f14a3df6661%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rbe8439b26a71fc3b429aa793c65dcc4a6e349bc7bb5010746a74fa1d%40%3Ccommits.ofbiz.apache.org%3E
CVE ID: CVE-2021-26296 State: PUBLISHED Published: 2021-02-19T08:30:14.000Z Last Updated: 2025-02-13T16:27:52.470Z Vendors: Apache Software Foundation Products: Apache MyFaces Core Problem Types: CWE-352 Description: In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application. Additional Analyst Notes: - CVE Program Container: Ref
o trick a user into executing unwanted actions on an application. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r2b73e2356c6155e9ec78fdd8f72a4fac12f3e588014f5f535106ed9b%40%3Cannounce.apache.org%3E - http://seclists.org/fulldisclosure/2021/Feb/66 - http://packetstormsecurity.com/files/161484/Apache-MyFaces-2.x-Cross-Site-Request-Forgery.html - https://security.netapp.com/advisory/ntap-20210528-0007/
CVE ID: CVE-2021-26303 State: PUBLISHED Published: 2021-01-29T01:48:27 Last Updated: 2024-08-03T20:19:20.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the user-profile.php Full Name field. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/161114/Daily-Expense-Tracker-System-1.0-Cross-Site-Scripting.html
CVE ID: CVE-2021-26304 State: PUBLISHED Published: 2021-01-29T01:48:15 Last Updated: 2024-08-03T20:19:20.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the add-expense.php Item parameter. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/161114/Daily-Expense-Tracker-System-1.0-Cross-Site-Scripting.html
CVE ID: CVE-2021-26305 State: PUBLISHED Published: 2021-01-29T02:27:42 Last Updated: 2024-08-03T20:19:20.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0012.html
CVE ID: CVE-2021-26306 State: PUBLISHED Published: 2021-01-29T02:27:27 Last Updated: 2024-08-03T20:19:20.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It has unsound transmute calls within as_string() methods. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0013.html
CVE ID: CVE-2021-26307 State: PUBLISHED Published: 2021-01-29T02:27:17 Last Updated: 2024-08-03T20:19:20.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It allows __cpuid_count() calls even if the processor does not support the CPUID instruction, which is unsound and causes a deterministic crash. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0013.html
CVE ID: CVE-2021-26308 State: PUBLISHED Published: 2021-01-29T02:27:00 Last Updated: 2024-08-03T20:19:20.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the marc crate before 2.0.0 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated memory, violating soundness. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0014.html
CVE ID: CVE-2021-26309 State: PUBLISHED Published: 2021-05-11T11:53:02 Last Updated: 2024-08-03T20:19:20.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Permissions. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2021/05/07/jetbrains-security-bulletin-q1-2021/
CVE ID: CVE-2021-26310 State: PUBLISHED Published: 2021-05-11T11:48:12 Last Updated: 2024-08-03T20:19:20.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2021/05/07/jetbrains-security-bulletin-q1-2021/
CVE ID: CVE-2021-26311 State: PUBLISHED Published: 2021-05-13T11:06:17.662304Z Last Updated: 2024-09-17T04:25:26.352Z Vendors: AMD Products: SEV/SEV-ES Problem Types: Arbitrary Code Execution Description: In the AMD SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a malicious hypervisor to potentially lead to arbitrary code execution within the guest VM if a malicious administrator has access to compromise the server hypervisor. Additional Analyst Notes: - CVE Program Container: References: - https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1004
CVE ID: CVE-2021-26312 State: PUBLISHED Published: 2021-11-16T17:55:24.198997Z Last Updated: 2024-09-16T17:54:14.669Z Vendors: AMD Products: EPYC™ Processors, Ryzen™ Series, Athlon™ Series Problem Types: CWE-665 Description: Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be able to access, resulting in a potential loss of integrity. Additional Analyst Notes: - CVE Program Container: References: - https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027 - https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028
CVE ID: CVE-2021-26313 State: PUBLISHED Published: 2021-06-09T11:23:37.970519Z Last Updated: 2024-09-16T19:41:53.615Z Vendors: AMD Products: All supported processors Problem Types: CWE-208 Description: Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution of overwritten instructions, may cause an incorrect speculation and could result in data leakage. Additional Analyst Notes: - CVE Program Container: References: - https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1003
CVE ID: CVE-2021-26314 State: PUBLISHED Published: 2021-06-09T11:23:44.010985Z Last Updated: 2024-09-17T02:21:23.613Z Vendors: AMD Products: All supported processors Problem Types: CWE-208 Description: Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incorrect floating point results, may cause the use of incorrect data from FPVI and may result in data leakage. Additional Analyst Notes: - CVE Program Container: References: - https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1003 - http://www.openwall.com/lists/oss-security/2021/06/09/2 - http://www.openwall.com/lists/oss-
rity/bulletin/amd-sb-1003 - http://www.openwall.com/lists/oss-security/2021/06/09/2 - http://www.openwall.com/lists/oss-security/2021/06/10/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H36U6CNREC436W6GYO7QUMJIVEA35SCV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVA2NY26MMXOODUMYZN5DCU3FXMBMBOB/
CVE ID: CVE-2021-26315 State: PUBLISHED Published: 2021-11-16T18:12:07.291241Z Last Updated: 2024-09-17T01:21:40.952Z Vendors: AMD Products: 3rd Gen AMD EPYC™ Problem Types: CWE-345 Description: When the AMD Platform Security Processor (PSP) boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient verification of the integrity of decrypted image, arbitrary code may be executed in the PSP when encrypted firmware images are used. Additional Analyst Notes: - CVE Program Container: References: - https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1021
CVE ID: CVE-2021-26316 State: PUBLISHED Published: 2023-01-10T19:46:46.575Z Last Updated: 2025-04-09T15:19:17.090Z Vendors: AMD, AMD Products: Ryzen 5000 Series , Ryzen 2000 Series, Ryzen 3000 Series, 1st Gen EPYC , 2nd Gen EPYC, 3rd Gen EPYC Problem Types: n/a Description: Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management Mode) arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031 - https://www.amd.com/en/corporate/product-security/bul
//www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031 - https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032
CVE ID: CVE-2021-26317 State: PUBLISHED Published: 2022-05-12T18:27:48.589066Z Last Updated: 2024-09-17T01:10:36.785Z Vendors: AMD Products: Ryzen™ Series, Athlon™ Series Problem Types: tbd Description: Failure to verify the protocol in SMM may allow an attacker to control the protocol and modify SPI flash resulting in a potential arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027
CVE ID: CVE-2021-26318 State: PUBLISHED Published: 2021-10-13T18:29:14.977353Z Last Updated: 2024-09-16T16:48:55.696Z Vendors: AMD Products: All supported processors Problem Types: CWE-208 Description: A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked kernel address space information. Additional Analyst Notes: - CVE Program Container: References: - https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1017
CVE ID: CVE-2021-26319 State: REJECTED Published: N/A Last Updated: 2023-01-17T00:00:00 Description: No description available.